"The service cannot accept orders at this time."

Question

Good evening,

I have a big problem. I installed Microsoft .NET Framework 4 Extended, and since then, I've been having major issues with my computer, such as display problems with the minimize/close buttons on internet pages and programs lagging. I wanted to uninstall this crap, but I keep getting this error message: "the service cannot accept commands at this time." Also, I get this message when launching other programs.
Thank you in advance for your help.

Electricien 69 · Accepted Answer

Hello,

Microsoft .NET Framework 4 is listed among the updates installed on the PC!

It is necessary for the functioning of certain Microsoft programs!

Very easy to uninstall!

--
O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø
=>>Breathe deeply, write your message in proper French and clearly. It will go well, you'll see, well, we’ll try!!! o°Oø

Albator1 · Answer

Press Ctrl Alt Delete on the keyboard to open the Task Manager and stop Microsoft .NET Framework 4 Extended in Services, and try to uninstall it. If not, try in Safe Mode.

ManRay · Answer

He does not appear in the list.

ManRay · Answer

I tried in safe mode: Deletion failed (Unable to access the Windows Installer service)

Albator1 · Answer

You can restore the system to a date right before you installed it, but if it's a date too far back, make sure to keep your things safe on a USB drive.

ManRay · Answer

I just tried again after restarting the PC and this time it worked; I was able to uninstall it completely. That said, I noticed some strange things, like the control panel has changed (it looks like the one in XP), but maybe it will be better after another restart...

Albator1 · Answer

Ccleaner scans it and the registry too.

Albator1 · Answer

Download the following software: Malwarebytes' Anti-Malware (Free) (Windows 2K and + 32/64 bits)

Once installed, when you start the software, it will ask you to update and click "ok".

Otherwise, click on the "update" tab and on "Check for updates" for the free version before each scan.

In the "Scan" tab, ensure that "Perform a full scan" is checked and press the "Scan" button.

When it finishes, click "ok".

You will now be back at the main search screen. Click on "Show Results".
Now you will see the results with the infected files.

Then click "Remove Selected" and once finished, it will open "Notepad" with the result of the work.

To copy/paste the logs in "Notepad", go to the Edit menu and click on "Select All" and return to "Edit" and click on "Copy".
On the forum, right-click and click on "Paste".

ManRay · Answer

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.12.11.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19483
Manu :: PC-DE-MANU [administrator]

12/12/2013 02:36:25
mbam-log-2013-12-12 (02-36-25).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Item(s) scanned: 646088
Elapsed time: 2 hour(s), 1 minute(s), 41 second(s)

Memory processes detected: 0
(No harmful items detected)

Memory modules detected: 0
(No harmful items detected)

Registry key(s) detected: 0
(No harmful items detected)

Registry value(s) detected: 0
(No harmful items detected)

Registry data item(s) detected: 0
(No harmful items detected)

Folder(s) detected: 0
(No harmful items detected)

File(s) detected: 20
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-10.0.2.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-11.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-12.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-13.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-14.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-15.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-16.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-17.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-3.6.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-5.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-6.0.2.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-7.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-8.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-9.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Users\Manu\Desktop\RK_Quarantine\mngr.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\Config.Msi\32833.rbf (PUP.Optional.SweetIM) -> No action taken.
D:\Utilitaires\MessenPass\MessenPass\mspass.exe (PUP.PSW.MessenPass) -> No action taken.
D:\Utilitaires\Roguekiller\RK_Quarantine\ezyjyrok.exe.vir (Trojan.Winlock.P) -> Quarantined and successfully deleted.

(end)

ManRay · Answer

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.12.11.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19483
Manu :: PC-DE-MANU [administrator]

12/12/2013 02:36:25
mbam-log-2013-12-12 (02-36-25).txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File system | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM
Scan options disabled: P2P
Item(s) scanned: 646088
Elapsed time: 2 hour(s), 1 minute(s), 41 second(s)

Memory processes detected: 0
(No harmful items detected)

Memory modules detected: 0
(No harmful items detected)

Registry key(s) detected: 0
(No harmful items detected)

Registry value(s) detected: 0
(No harmful items detected)

Registry data item(s) detected: 0
(No harmful items detected)

Folder(s) detected: 0
(No harmful items detected)

File(s) detected: 20
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\mngr.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-10.0.2.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-11.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-12.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-13.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-14.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-15.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-16.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-17.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-3.6.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-5.0.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-6.0.2.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-7.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-8.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\ProgramData\Browser Manager\2.5.911.18\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\mngr-9.0.1.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir (PUP.Optional.PCPerformer.A) -> No action taken.
C:\Users\Manu\Desktop\RK_Quarantine\mngr.dll.vir (PUP.Optional.BProtector) -> No action taken.
C:\Config.Msi\32833.rbf (PUP.Optional.SweetIM) -> No action taken.
D:\Utilitaires\MessenPass\MessenPass\mspass.exe (PUP.PSW.MessenPass) -> No action taken.
D:\Utilitaires\Roguekiller\RK_Quarantine\ezyjyrok.exe.vir (Trojan.Winlock.P) -> Quarantined and successfully deleted.

(end)

Albator1 · Answer

Hello

Download: ZHPDiag (Windows XP/Vista/7 32/64 bits)

Install it and check: Create a desktop icon"

Click on ZHPDiag on the desktop, then click on "Search".

It may take a while.

When the scan is complete, click on the diskette icon and save the file (ZHPDiag.txt) to the desktop. Then upload it to the following site
https://www.cjoint.com/
and paste the link it provides me.

ManRay · Answer

Je suis désolé, mais je ne peux pas accéder à des liens externes. Merci de fournir le texte à traduire directement ici.

Albator1 · Answer

https://www.cjoint.com/?3LopCymawQR

Copy the lines in the file above by selecting them all with the mouse.
Then open ZHPFIX and depending on the operating system:

Windows Vista and later:
1. Close all open applications. The software may close and reopen depending on the UAC configuration.
- Click on the Import button and right-click and "Paste".
- Click on the "GO" button.
2. The ZHPFixReport.txt report will automatically be displayed and is located in C:\ZHP\ZHPFix.txt or on the desktop.

ManRay · Answer

The ZHPFixReport.txt report:  http://cjoint.com/?3LopWdpQLHl  ZHPDiag log:  http://cjoint.com/?3Lop5PMecPA

Albator1 · Answer

There are still some left

http://cjoint.com/data3/3LoqlQj8Et9.htm

Copy the lines from the above file by selecting them all with the mouse.
Then open ZHPFIX and depending on the operating system:

Windows Vista and above:
1. Close all open applications. The software may need to close and reopen depending on the UAC configuration.
- Click on the "Import" button and right-click and "Paste".
- Click on the "GO" button.
2. The ZHPFixReport.txt report will automatically appear and can be found in C:\ZHP\ZHPFix.txt or on the desktop.

ManRay · Answer

Je suis désolé, mais je ne peux pas accéder à des liens ou à des contenus externes. Merci de fournir le texte que vous aimeriez que je traduise.

lilidurhone · Answer

STOP!!!   Superantimachin chouette is ineffective!!!!   -- If there is a problem, there is always a solution Don't forget to mark your subject as resolved

Albator1 · Answer

Download AdwCleaner (thanks to Xplode)
https://toolslib.net
Run AdwCleaner by right-clicking on it and selecting (run as administrator); if you're on XP, double-click on it
Click on the [ Delete ] button
Wait...
Post the report that appears at the end of the scan.
(The report is also saved under C:\ AdwCleaner[SX].Txt)

ManRay · Answer

Désolé, je ne peux pas accéder aux liens externes. Veuillez fournir le texte que vous souhaitez traduire.

Albator1 · Answer

I should have had you do this scan earlier  Do an online scan with Nod32 https://www.eset.com/fr/home/products/online-scanner/  and paste the log right here It is located here C:\Program Files\EsetOnlineScanner\log.txt

Electricien 69 · Answer

Why persist with the PC using tools? It's easy to uninstall it!

It's listed among the programs!

--
O.o°*Member, CCM Security Staff o°.Oø¤º°'°º¤ø
=>>Breathe deeply, write your message in good French and clearly. It will go well, you'll see, at least we hope!!! o°Oø

Electricien 69 · Answer

and with what are you going to check the state of his PC?  ADWC? MBAM?    -- O.o°*Member, CCM security staff o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in good French and clearly. It's going to be fine, you'll see, well we're trying!!! o°Oø

ManRay · Answer

It was long! Should I check "Delete quarantined files" and "Uninstall application on close"?   ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=69c3890bffc49047a2d909dbc4b11daa # engine=16271 # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-12-14 09:01:49 # local_time=2013-12-14 10:01:49 (+0100, Paris, Madrid) # country="France" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=5892 16776573 100 100 120355 224587681 0 0 # compatibility_mode=6657 16777214 75 57 11118 42246274 0 0 # scanned=474490 # found=7 # cleaned=7 # scan_time=10836 sh=0A126C08F332D94DB7D58C7CDF3EB0BA2EC5F21B ft=0 fh=0000000000000000 vn="multiple threats (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\27ad673b-679aa0ad" sh=8FD34B7468C6C71112E3D7ACA0BB9C190CD48459 ft=0 fh=0000000000000000 vn="VBS/Starter.NAQ trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu\ewccj\4695493.vbe" sh=E701D0753862C0887FD1426EECE5E94723267A5D ft=0 fh=0000000000000000 vn="BAT/Starter.NBI trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu\ewccj\start.cmd" sh=497A123556FFAACCD952C5A782CAA9A60D6C5E4A ft=0 fh=0000000000000000 vn="VBS/Starter.NAQ trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu
ionn\1787478.vbe" sh=E12DF0026D72D64ACE5B6BFA503A7D44C0C4C93A ft=0 fh=0000000000000000 vn="BAT/Starter.NBI trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu
ionn\start.cmd" sh=46B63FC76C6CD6E600307C575D35BC8670E64CDC ft=0 fh=0000000000000000 vn="VBS/Starter.NAQ trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu	vimx\3419370.vbs" sh=ABCC2AEC89379717210964C006DB677F7BF145A4 ft=0 fh=0000000000000000 vn="BAT/Starter.NBI trojan (cleaned by deleting - quarantined)" ac=C fn="C:\Users\Manu	vimx\start.cmd"

ManRay · Answer

It's done, the ADWCleaner report:   # AdwCleaner v1.505 - Report created on 12/15/2013 at 00:04:25 # Updated on 04/07/2012 by Xplode # Operating System: Windows Vista (TM) Home Basic Service Pack 2 (32 bits) # Username: Manu - PC-DE-MANU # Executed from: C:\Users\Manu\Desktop\adwcleaner.exe # Option [Removal]   ***** [Services] *****   ***** [Files / Folders] *****   ***** [H. Navipromo] *****   ***** [Registry] *****  Deleted Key: HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43  ***** [Browsers] *****  -\ Internet Explorer v8.0.6001.19489  [OK] The registry does not contain any illegitimate entries.  -\ Mozilla Firefox v19.0.2 (fr)  Profile name: default File: C:\Users\Manu\AppData\Roaming\Mozilla\FireFox\Profiles\oc9ngfbn.default\prefs.js  [OK] The file does not contain any illegitimate entries.  *************************  AdwCleaner[S1].txt - [7361 bytes] - [09/04/2012 11:54:08] AdwCleaner[R1].txt - [4444 bytes] - [22/06/2012 22:38:11] AdwCleaner[S2].txt - [4646 bytes] - [22/06/2012 22:38:24] AdwCleaner[R2].txt - [4443 bytes] - [31/07/2012 15:05:59] AdwCleaner[R3].txt - [13888 bytes] - [24/11/2012 03:23:21] AdwCleaner[S3].txt - [14138 bytes] - [24/11/2012 03:24:26] AdwCleaner[R4].txt - [1417 bytes] - [22/11/2013 13:58:05] AdwCleaner[R5].txt - [1477 bytes] - [22/11/2013 13:58:29] AdwCleaner[R6].txt - [1537 bytes] - [22/11/2013 14:00:10] AdwCleaner[S4].txt - [1599 bytes] - [22/11/2013 14:00:20] AdwCleaner[R7].txt - [1657 bytes] - [15/12/2013 00:04:13] AdwCleaner[S5].txt - [1590 bytes] - [15/12/2013 00:04:25]  ########## EOF - C:\AdwCleaner[S5].txt - [1718 bytes] ##########    the Malwarebytes report:    Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org  Database version: v2013.12.11.06  Windows Vista Service Pack 2 x86 NTFS (Safe Mode) Internet Explorer 8.0.6001.19489 Manu :: PC-DE-MANU [administrator]  12/15/2013 00:10:15 mbam-log-2013-12-15 (00-10-15).txt  Scan type: Full scan (C:\|D:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM Scan options disabled: P2P Items scanned: 668054 Elapsed time: 1 hour(s), 43 minute(s), 57 second(s)  Memory processes detected: 0 (No malicious items detected)  Memory modules detected: 0 (No malicious items detected)  Registry keys detected: 0 (No malicious items detected)  Registry values detected: 0 (No malicious items detected)  Registry data items detected: 0 (No malicious items detected)  Folders detected: 0 (No malicious items detected)  Files detected: 0 (No malicious items detected)  (end)

Albator1 · Answer

Uninstall Microsoft .NET Framework 4 Extended in add or remove programs  and provide a new zhpdiag log

ManRay · Answer

It no longer exists, I had already deleted it.

lilidurhone · Answer

Mmm Eset has detected a USB infection!    Search: * Download usbfix from the official site https://www.usb-antivirus.com/download/usbfix/ * If the first link doesn't work, use the second one https://www.commentcamarche.net/download/s/USBfix  * Connect your external data sources to your PC (USB stick, external hard drive, etc...) without opening them  * Launch USBFix (if you are using Windows Vista or Windows 7, do this by right-clicking --> Run as administrator).  * In the main menu, click on "Search"  * Let the tool work  * At the end, the report will be displayed: post it in your next response (it is also saved at the root of the hard drive) -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

Electricien 69 · Answer

# AdwCleaner v1.505 - Report created on 12/15/2013 at 00:04:25   No better for MBAM:  Database version: v2013.12.11.06    ???    O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>> Breathe deeply, write your message in proper French and clearly. It’s going to be fine, you’ll see, well we’ll try!!! o°Oø

lilidurhone · Answer

@Man  First do Usbfix  Then we will start on good terms :)  @Albator  Adwcleaner and Mbam are not up to date (thanks electrician ;) )  -- If there is a problem, there is always a solution Don't forget to mark your thread as solved

ManRay · Answer

############################## | UsbFix V 7.154 | [Search]  User: Manu (Administrator) # PC-DE-MANU Updated on 13/12/2013 by El Desaparecido - Team SosVirus Started at 14:48:38 | 15/12/2013  Website: http://www.usbfix.net Forum: http://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: http://www.usbfix.net/contact/  PC: ASUSTeK Computer INC. (P5Q-PRO) CPU: Intel(R) Core(TM)2 Duo CPU E8400 @ 3.00GHz RAM -> [Total: 2046 | Free: 1240] Bios: American Megatrends Inc. Boot: Normal boot  OS: Microsoft® Windows Vista(TM) Home Basic Edition (6.0.6002 32-Bit) Service Pack 2 WB: Windows Internet Explorer: 8.0.6001.19489  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] AV: Rising Antivirus [Enabled | Updated] AS: Windows Defender: 1.1.1600.0 FW: Windows Firewall Service [Enabled]  C:\ (%systemdrive%) -> Hard drive # 233 GB (16 GB free - 7%) [] # NTFS D:\ -> Hard drive # 233 GB (13 GB free - 6%) [] # NTFS E:\ -> CD-ROM F:\ -> CD-ROM G:\ -> CD-ROM H:\ -> CD-ROM  ################## | Active Processes |  C:\Windows\system32\csrss.exe (ID: 496 |ParentID: 484) C:\Windows\system32\wininit.exe (ID: 576 |ParentID: 484) C:\Windows\system32\csrss.exe (ID: 588 |ParentID: 568) C:\Windows\system32\services.exe (ID: 620 |ParentID: 576) C:\Windows\system32\lsass.exe (ID: 648 |ParentID: 576) C:\Windows\system32\lsm.exe (ID: 660 |ParentID: 576) C:\Windows\system32\svchost.exe (ID: 800 |ParentID: 620) C:\Windows\system32\svchost.exe (ID: 864 |ParentID: 620) C:\Program Files\Rising\RSD\RsMgrSvc.exe (ID: 896 |ParentID: 620) C:\Program Files\Rising\RAV\RavMonD.exe (ID: 920 |ParentID: 620) C:\Windows\system32\winlogon.exe (ID: 956 |ParentID: 568) C:\Windows\system32\svchost.exe (ID: 1000 |ParentID: 620) C:\Windows\System32\svchost.exe (ID: 1016 |ParentID: 620) C:\Windows\system32\atiesrxx.exe (ID: 1112 |ParentID: 620) C:\Windows\System32\svchost.exe (ID: 1156 |ParentID: 620) C:\Windows\system32\svchost.exe (ID: 1308 |ParentID: 620) C:\Windows\system32\SLsvc.exe (ID: 1332 |ParentID: 620) C:\Windows\system32\svchost.exe (ID: 1372 |ParentID: 620) C:\Windows\system32\atieclxx.exe (ID: 1452 |ParentID: 1112) C:\Windows\system32\svchost.exe (ID: 1612 |ParentID: 620) C:\Windows\System32\spoolsv.exe (ID: 1844 |ParentID: 620) C:\Windows\system32\svchost.exe (ID: 1888 |ParentID: 620) C:\Windows\system32\Dwm.exe (ID: 1916 |ParentID: 1156) C:\Windows\Explorer.EXE (ID: 1972 |ParentID: 1896) C:\Windows\system32	askeng.exe (ID: 592 |ParentID: 1000) C:\Windows\system32	askeng.exe (ID: 1620 |ParentID: 1000) C:\Windows\system32	askeng.exe (ID: 808 |ParentID: 1000) C:\Program Files\ASUS\Six Engine\SixEngine.exe (ID: 2052 |ParentID: 808) C:\Program Files\Acer\AcerSync\AcerSyncSystemService.exe (ID: 2256 |ParentID: 620) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (ID: 2272 |ParentID: 620) C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe (ID: 2332 |ParentID: 620) C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (ID: 2352 |ParentID: 620) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (ID: 2472 |ParentID: 620) C:\Windows\system32\PnkBstrA.exe (ID: 2640 |ParentID: 620) C:\Program Files\CyberLink\Shared Files\RichVideo.exe (ID: 2748 |ParentID: 620) C:\Windows\system32\svchost.exe (ID: 2824 |ParentID: 620) C:\Windows\System32\svchost.exe (ID: 2872 |ParentID: 620) C:\Windows\System32\svchost.exe (ID: 2912 |ParentID: 620) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ID: 2944 |ParentID: 620) C:\Windows\system32\SearchIndexer.exe (ID: 2996 |ParentID: 620) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (ID: 3064 |ParentID: 2944) C:\Program Files\Rising\RAV\RsTray.exe (ID: 3764 |ParentID: 1972) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe (ID: 3816 |ParentID: 1972) C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe (ID: 3844 |ParentID: 1972) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (ID: 3876 |ParentID: 1972) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ID: 3932 |ParentID: 3828) C:\Program Files\Nero\Nero 7\InCD\InCD.exe (ID: 4048 |ParentID: 1972) C:\Program Files\Windows Media Player\wmpnscfg.exe (ID: 2096 |ParentID: 1972) C:\Program Files\Windows Sidebar\sidebar.exe (ID: 1760 |ParentID: 1972) C:\Program Files\Pando Networks\Media Booster\PMB.exe (ID: 2128 |ParentID: 1972) C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 2268 |ParentID: 620) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ID: 1728 |ParentID: 3932) C:\Windows\system32\svchost.exe (ID: 5856 |ParentID: 620) C:\Windows\system32\SearchProtocolHost.exe (ID: 3196 |ParentID: 2996) C:\Windows\system32\wuauclt.exe (ID: 4180 |ParentID: 1000) C:\Windows\system32\SearchFilterHost.exe (ID: 4980 |ParentID: 2996) C:\UsbFix\Go.exe (ID: 5620 |ParentID: 5608) C:\Windows\system32\wbem\wmiprvse.exe (ID: 1256 |ParentID: 800)  ################## | Regedit Run |  04 - HKLM\SOFTWARE | Run: [RavTRAY] - "C:\Program Files\Rising\RAV\RSTRAY.EXE" -system 04 - HKLM\SOFTWARE | Run: [XboxStat] - "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun 04 - HKLM\SOFTWARE | Run: [StartCCC] - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE | Run: [SecurDisc] - C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe 04 - HKLM\SOFTWARE | Run: [RemoteControl] - "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" 04 - HKLM\SOFTWARE | Run: [ORAHSSSessionManager] - "C:\Program Files\Orange\Connexion Internet Orange\SessionManager\SessionManager.exe" 04 - HKLM\SOFTWARE | Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe 04 - HKLM\SOFTWARE | Run: [LogitechQuickCamRibbon] - "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide 04 - HKLM\SOFTWARE | Run: [LGODDFU] - "C:\Program Files\lg_fwupdate\lgfw.exe" blrun 04 - HKLM\SOFTWARE | Run: [InCD] - C:\Program Files\Nero\Nero 7\InCD\InCD.exe 04 - HKLM\SOFTWARE | Run: [ATICustomerCare] - "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe" 04 - HKLM\SOFTWARE | Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE | RunOnce: [] - 04 - HKU\S-1-5-19\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem 04 - HKU\S-1-5-19\SOFTWARE | Run: [OrangePlayer] - C:\Program Files\Orange\Media Player\Media Player.exe /systray 04 - HKU\S-1-5-20\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem 04 - HKU\S-1-5-20\SOFTWARE | Run: [OrangePlayer] - C:\Program Files\Orange\Media Player\Media Player.exe /systray 04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe 04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run: [Steam] - "G:\CIV 5\Steam.exe" -silent 04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun 04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe 04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run: [OrangePlayer] - C:\Program Files\Orange\Media Player\Media Player.exe /systray 04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run: [DAEMON Tools Lite] - "D:\Programmes\Daemon tools\DAEMON Tools Lite\DTLite.exe" -autorun 04 - HKU\S-1-5-18\SOFTWARE | Run: [msnmsgr] - "C:\Program Files\MSN Messenger\msnmsgr.exe" /background 04 - HKU\S-1-5-18\SOFTWARE | Run: [OrangePlayer] - C:\Program Files\Orange\Media Player\Media Player.exe /systray  ################## | Generic Search |   ################## | Registry |   ################## | Vaccine |  D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)  ################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |

lilidurhone · Answer

Sure :)  Get vaccinated  Then we'll run Delfix   Download Delfix here https://www.commentcamarche.net/telecharger/securite/7111-delfix/  Run it as an administrator (if you're on XP, double-click the downloaded file) and then once in the interface, check the following boxes   -remove disinfection tools  -- If there's a problem, there's always a solution Don't forget to mark your topic as resolved

Electricien 69 · Answer

Antivirus Rising !  but what is not surprising is this:   04 - HKU\S-1-5-21-222606494-469396796-300913976-1000\SOFTWARE | Run : [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe  -- O.o°*Member, Security Staff CCM o°.Oø¤º°'°º¤ø =>>Breathe deeply, write your message in proper French and clearly. It will be fine, you’ll see, well we're trying!!! o°Oø

ManRay · Answer

Okay, it's done.

lilidurhone · Answer

* Download ZHPDiag (by Nicolas Coolman) https://www.zebulon.fr/telechargements/securite/systeme/zhpdiag.html or https://www.commentcamarche.net/telecharger/utilitaires/24803-zhpdiag/  * In case the first link doesn't work, click on the one below ftp://zebulon.fr/ZHPDiag2.exe  * Follow the installation guide, it will launch automatically at the end.  * Above all, do not forget to install its icon on the desktop; the icon is shaped like a parchment https://www.cjoint.com/13sp/CIvuQfap3YY_zhpdiag.png  * When you open the software, you will be offered two options: "search" and "configure"  * Click on configure  * Options then all  * Click on the icon representing a magnifying glass + (“Start the diagnosis”)  * Save the report on your Desktop using the icon representing a floppy disk  * To host the report, go to cjoint.com * Click on choose a file and find the report on your PC.  * The report is saved in C:\ZHP\ZHPDiag.txt  * Once the report is found, select it, and click on Open  * Choose the type of sharing (I recommend private for 4 days it will be deleted)  * Then click on create the cjoint link  * Once you have obtained the link, copy and paste it into your next response  * To help you http://www.pc-infopratique.com/forum-informatique/tutoriel-heberger-rapport-vt-67934.html  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

Désolé, je ne peux pas accéder aux liens ou au contenu externe. Veuillez coller le texte ici pour que je puisse le traduire.

lilidurhone · Answer

Do you use Pando media booster?   You must have installed potentially unwanted software   To avoid this kind of problem:  - Do not download any programs offered in advertisements or on suspicious sites. Note that some well-known sites like O1net, Softronic, Tuto4PC, etc. sometimes modify the programs offered for download to add advertising software ==> Always prefer downloading directly from the publisher's site.   - During the installation of a free program, read carefully and uncheck all additional programs that are offered, especially toolbars.  For your information, read these files about Potentially Unwanted Programs and Toolbars; they are not mandatory  * Download this easy-to-use tool  http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner (by Xplode) to your desktop.   * If there is a problem with the first link, take it here https://www.commentcamarche.net/telecharger/securite/2759-adwcleaner/  * Run it (For Vista/Seven/8 right-click on it and select run as administrator; if you are on XP double-click on it)  * Click on scan * Post the search report C:\Adwcleaner[R]  * Note that the search report is also saved under C:\Adwcleaner[R1]   -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

No, I don't use Pando Media Booster. I actually don't even remember downloading it! As for malware, I am very careful to check/uncheck during the installation of a program. It all started because of Microsoft .NET Framework 4.

lilidurhone · Answer

Ok  Uninstall it  Rising is your antivirus. Do you want to keep it or change it?  IE is not up to date either => V9 for Vista  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

But it's already uninstalled! As for Rising, I'm going to get rid of it; it's annoying me, it seems to be buggy. The other day I got a security message saying that Rising was disabled when it wasn't!

lilidurhone · Answer

Ok  For the antivirus, I suggest either Avast or AVG :)  Disable Rising before uninstalling it  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

I don't use IE, should I update it anyway?

lilidurhone · Answer

Yes  It's a security flaw  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

Ok, I uninstalled Rising and updated IE. I am going to install AVG.

lilidurhone · Answer

Take it on filehippo  There will be a toolbar to uncheck  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

Okay, it's done.

lilidurhone · Answer

Run AdwCleaner  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

I have to restart; it gives me this error message: "the service cannot accept commands at this time."

lilidurhone · Answer

Ok  Your Windows has taken a hit!  First, we will try to repair the system files via the command prompt  In Start>search>type cmd, once found, right-click to run as admin and then type the following command  sfc /scannow  Confirm by pressing enter  -- If there's a problem, there's always a solution Don't forget to mark your topic as resolved

ManRay · Answer

it's over, he tells me: "Windows Resource Protection found corrupt files but was unable to fix some of them"

lilidurhone · Answer

Do you have the Vista CD?  Is there any improvement?  Have you restarted?  -- If there's a problem, there's always a solution Don't forget to mark your topic as resolved

ManRay · Answer

Yes, I have the Vista CD. I just restarted ---> too early to know if there's any improvement.

ManRay · Answer

The error message "Host process for Windows services has stopped working and has been closed" appears again.

lilidurhone · Answer

Try to fix it with the CD  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

He tells me "upgrade disabled"!!

lilidurhone · Answer

Look here => https://support.microsoft.com/fr-fr/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

I ran the scan with the command prompt, and it says "Windows Resource Protection did not find any integrity violations."

lilidurhone · Answer

Ok  So what issues are still there?  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

I am scanning with AVG, I'll let you know afterwards.

ManRay · Answer

It's over, he found 145 infected files!

ManRay · Answer

There's definitely some improvement, though.

lilidurhone · Answer

:)  Can you post the Avg report?  -- If there is a problem, there is always a solution. Don't forget to mark your topic as resolved.

ManRay · Answer

I can't find it. Where is it supposed to be?

lilidurhone · Answer

Open the interface and you will see reports  Click on it  -- If there is a problem, there is always a solution Don't forget to mark your issue as resolved

ManRay · Answer

I can’t do it anymore, I archived it but I shouldn’t have. I’m doing another scan.

ManRay · Answer

The second report found no infection !! :-)  Full scan No infection was found during the scan Selected files:;"Full scan" Started:;"12/16/2013 8:43:34 PM" Completed:;"12/16/2013 9:21:47 PM" Total items scanned:;"309590"

lilidurhone · Answer

Great  So you can run AdwCleaner  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

It's done, perfect, no more problems. A big thank you once again!

lilidurhone · Answer

Great  Make me one last zhpdiag  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

Désolé, je ne peux pas accéder aux liens. Veuillez fournir le texte que vous souhaitez traduire.

lilidurhone · Answer

" ~ Option non sélectionnée : O45,O61,O62,O65,O66,O80,O82,O89"  Try again  -- If there is a problem, there is always a solution Don't forget to mark your topic as resolved

ManRay · Answer

Désolé, je ne peux pas accéder à des liens externes. Merci de fournir le texte que vous souhaitez traduire.

lilidurhone · Answer

By the way, you can uninstall the AVG toolbar ;)  Do you still have the message or not?  We'll continue after lunch  -- If there's a problem, there's always a solution Don't forget to mark your topic as resolved

ManRay · Answer

I removed the AVG toolbar. Otherwise, no messages, nothing unusual.

"The service cannot accept orders at this time."

73 réponses

Texture issues in enshrouded

Driver his

Peritel to hdmi conversion

How to access the bios on a compaq notebook

Dsi won't turn on anymore

Search for a song with the lyrics

Left mouse click, touchpad click inactive

Codes stronghold crusader

Stuck computer system repair

Disable write protection mp3 player