Pictures not showing, brand new pc, trogan (generic) HELP

[kaytee03]

Ok, so we get this brand new hp computer a few weeks ago. Well for about a week now, random pictures on websites are "Xs" I mean, it's on Yahoo, My Space, azlyrics.com, just any website you go to, random buttons and pictures are not showing up, and they are for everybody else it is obviously something wrong with my pc. Sometimes when i hit refresh, others will show that were "Xs" before, BUT then the ones that were showing are now "Xs"....So i scanned my pc 3 times before Trendo Micro Antivirus tells me that I have a "trojan generic" virus, so i delete the file...and it didn't work. However the scanner also brought up this other location, but i could not find it anywhere in my computer...the location file was c:\Program Files\webHancer\programs\whiehlpr.dll

anyways, so i'm scanning with noadware right now and they are saying the following file locations are "severe"

(2spy) c:\windows\unins000.dat; c:\windows\unins000;

(BearShare) HKEY_CLASSES_ROOT\\WUSN.1; HKEY_CLASSES_ROOT\WUSN.1\WUSNid

and i also cannot find those anywhere when i searched my whole computer in search for files or whatever. Beacause I would like to remove them. Anyways, it's really annoying that my pictures aren't showing up, and my mom will freak if she finds out something's wrong with our new pc already lol...so if anyone knows anyhing PLEASE HELP!! Thanks!!!!

<3 Katie

p.s. i've never even d/l BearShare so how the heck is that even on my pc?

[-pops-]

Hello and welcome to Windows Forum :)

Try running a scan with SuperAntiSpyware click here and/or Ewido click here and see what they come up with.

You will most likely need to run a HiJackThis scan and let one of our experts look at it but, see how it goes with my suggestions first.

[kaytee03]

k, i'll try & i'll letcha know, thanx so much!

[kaytee03]

ok so i tried the superantispyware...and so far it has detected 56 threats and it says "Trojan.NewDotNet"

and than there are 50 for "Adware tracking cookie" and "Adware WhenUsave"? so do i have 56 files infected with trojans or what? lol...i'm not sure if i can finish scanning tonight because i must get to bed, but i will tomorrow, let me know your opinion of this..thanks

[-pops-]

Wait for the scan to complete and then follow the instructions about removing the threats.

I suggest you also do an Ewido scan.

If you machine still misbehaves after all this, go to http://forums.windowsforum.org/index.php?showtopic=6901 and do a HJT scan and post the reults to that section of the forum. One of the resident experts will take it from there.

[kaytee03]

Ok what is an HJT scan? I haven't been able to get on the net for a while, I was out of town. So I get back and now everytime I open IE, my homepage is changed to &quot;http://www.syssecuritysite.com" and this box pops up that says the following:

Warning!

w32.Myzor.FK@yf is a virus that infects files with .exe extensions.

It attempts to steal passwords and private information from the infected computer.

Type: Virus

Infection Lenth: 138,293 bytes

Systems Affected: Windows 95,98,ME,NT(all versions)XP(all service packs)

Systems Not Affected: DOS,EPOC,Linux,Macintos,Novel, etc

Technical details: 1. Creates files in %Windir%\directory. Bydefault, this isc:\windows.

2. Adds values to registry keys:

HKEY_LOCAL_MNACHINE\Software\Microsoft\Windows\CurrentVersion\Run

3. Scans the hard drive for .exe files and infects any executable files.

and that "HKEY" thing was one of the things that came up when I've done other scans...also, I tried restoring our computer, but everytime I choose a date to do it on, it won't let me! So I guess please let me know what an HJT scan is? thanx!!!

[ɹəuəllıʍ ʇɐb]

Looks like you are infecting yourself more and more with this stuff!

• Did you complete the superantispyware scan, and did you remove all threats?
  
• Did you run the online Ewido scan that -pops- suggested (http://www.ewido.net/)?
  
• Did you look at the Windows Forum link that -pops- gave (HJT = HijackThis)?
  

[kaytee03]

yes i did all of that....i just did the ewido or whatever and, it says i have "trojan.small" viruses in the following files..

these are both in c:\windows\system32\....

they are: atmclk.exe and \1024\ld3DB1.tmp

and than it says "not-a-virus.win32.renos.du in guzza.dll"??(which i think is a hoax maybe)

then there is a "trojan.small" in c:\program files\media-codec\unist.exe

so is it alright to just completely delete those files or what?

i'm somewhat computer smart but when it comes to viruses...please help lol i just want our pc to be back to normal, thanx again!

[-pops-]

OK, as you are still having problems, go the the link I gave in my second post here, do a HiJackThis scan and post it in the appropriate section of the forum. One of our experts will examine it for you and tell you how to proceed.

[andsome]

OK, as you are still having problems, go the the link I gave in my second post here, do a HiJackThis scan and post it in the appropriate section of the forum. One of our experts will examine it for you and tell you how to proceed.

Further to pops advice. DO NOT DELETE ANYTHING FROM THE HIJACK THIS SCAN until advised to do so. There is another thread running present and someone has done this and caused even more trouble.

[jason.b.c]

I haven't been able to get on the net for a while, I was out of town. So I get back and now everytime I open IE, my homepage is changed

Looks like you are infecting yourself more and more with this stuff!

Kaytee , Do you have high speed internet or something..??

Do you have any spyware/adware/anti-virus software in your computer..??? A firewall..??

The reason i asked is that it seems awfully strange that you've got that much infection in your computer..

There's alot of free stuff you can download from the internet that can take care of that stuff..

Anti-virus

Avast Anti-Virus ( My personal favorite )

Bit-Defender for Windows

Spyware removal

Spybot search and destroy

Super antispyware already mentioned..

Adware removal

Ad-aware se personal

Firewalls

The "R" Firewall

Comodo personal firewall

Zone Alarm

:D

[kaytee03]

k i will do that...um...also we have 3 seperate user accounts other than our main screen, my mom, my brother and mine. but i always go to the main admininstrator when i scan and what not, but do you think i should do a seperate one on each account or maybe delete the accounts and start all over? or no?

[cozofdeath]

Yeah, sounds like you need more protection. But anyway I wanted to post this because its a weird coincidence. I won't tell you how I got about it because it is boring but I was looking up LSPs (layered service provider) to find out what they are and on one of the pages it mentioned webhancer to use an LSP. So it is very possible that is what is causing your pictures to get screwed up. An LSP gets in your TCP/IP layer to monitor certain things like statistics, usage, whatever. Legitimate programs can use these such as zone alarm, but malicious programs do as well. If you don't know about them you should look them up, it will add to your info arsenal against malware. I did for me anyway. Another thing is after installing a program that uses the network or internet, if your connection suddenly stops that programs LSP could be the reason. Zone alarm has a LSP remover or fixer that I ran into in my windows directory. Hope this info helps someone