Please help reload printer after a virus

[mockuppro]

Hi,

I had second thought virus. After removing the virus, it left my computer in a strange state, many little things not working properly. First, it knocks off the printer setting. I tried reloading it.

I got a HP Office Jet printer. I has plenty of space on the computer. When I try to reload the printer, after 90% completion, I had a message, "Not enough disk space".

Please help. Thanks.

[AnnMarie]

Welcome to CTH mockuppro. Are you sure that there is no more malware running on your PC? Let's have a look. Go here and download the latest version of Hijack This to a new folder on your drive, unzip it and click on scan. Most of the files listed will be harmless and/or required so do not make any changes, just click on Save Log, copy it and post it back in this thread.

[mockuppro]

Hi AnnMarie,

Thanks for your prompt reply. Here's my log.

Logfile of HijackThis v1.98.2
Scan saved at 10:46:36 PM, on 9/6/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE FIREWALL\CPD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE FIREWALL\CPD.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE
C:\PROGRAM FILES\THE CLEANER\TCA.EXE
C:\PROGRAM FILES\THE CLEANER\TCM.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\INSTANT UPDATER\RULAUNCH.EXE
C:\Program Files\Hewlett-Packard\HP OfficeJet R Series\PrecisionScan\hpmdlbwa.exe
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\ENTERNET.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS1977\HIJAC KTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.yahoo.com/config/login?...g/mail%3f.intl=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Dell
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSCSHELLEXTENSION.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [McAfee Guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\Run: [tcactive] C:\PROGRAM FILES\THE CLEANER\tca.exe
O4 - HKLM\..\Run: [tcmonitor] C:\PROGRAM FILES\THE CLEANER\tcm.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\RunServices: [VidSvr]
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] c:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [McAfee Firewall] "C:\PROGRAM FILES\MCAFEE\MCAFEE FIREWALL\CPD.EXE" /SERVICE
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "c:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: hpmdlbwa.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet R Series\PrecisionScan\hpmdlbwa.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: Dell Home - {9B52B540-E403-11D3-B2BC-80415BC10000} - http://www.dellnet.com/ (file missing) (HKCU)
O16 - DPF: {D600B8BE-E2C0-11D0-82C0-00A0C91F048A} (SSCTL.SSDLoad) - http://broadcast.microsoft.com/code/...a/ssct1960.CAB
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.co...veX/winrep.cab
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.co...X/FileXfer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pu...sh/swflash.cab
O16 - DPF: {B8E71371-F7F7-11D2-A2CE-0060B0FB9D0D} (CDToolCtrl Class) - http://free.aol.com/tryaolfree/cdt175/aolcdt175.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/system...SysProfLCD.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/game...ts/y/tt3_x.cab

[AnnMarie]

Hi mockuppro, your log is fine however it does look as though some of the software is running. I did a bit of snooping about and I have found that you need a driver update - see here (Install at 90% error). Before you do this though, manually remove the registry entries and delete the files that are running. See "Uninstall fails" in the link I posted.

Transferring to the Win98 Forum.

[mockuppro]

"you need a driver update - see here (Install at 90% error). Before you do this though, manually remove the registry entries and delete the files that are running. See "Uninstall fails" in the link I posted.
Transferring to the Win98 Forum."

Hi AnnMarie,

I am not familiar with the computer lingo. See if this is what I am supposed to do:

1. manually remove the registry entries and delete the files that are running.
Does this meaning delete the HP folder in the Program files?

2. you need a driver update - see here (Install at 90% error).
So, I go to the HP place and find "uninstall fails"
3. download driver update.

The file I get stuck on is the precision scan\plugins\hpsbrxwa.sip

Thanks so much for your patience.

[AnnMarie]

Have you uninstalled the HP software from Add/Remove Programs in Control Panel and rebooted your PC? If not do so and then try reinstalling the software (check to make sure that all the files were uninstalled first though). If that doesnt help, follow the instructions in the link and download a new driver.

The instructions for removing the files are listed in the link I posted under "Uninstall Fails" . I recommended this because I could see some HP OfficeJet R Series files running however I assumed (perhaps incorrectly) that you had uninstalled the software before attempting a reinstall. Have you read the information in that link yet?

You will be able to obtain your driver download from http://welcome.hp.com/country/us/en/support.html. Just follow the online instructions.

[mockuppro]

Thanks. I got the download. However, when I rebooted the computer, the computer asked where the printer is at, I used the default and that wasn't it.

Now, the printer will self-test, but I have "user intervention" message when I try to print. How can I fix that?

The next bug:
After the virus, another thing that happened is that the computer doesn't turn off everytime when I click shut down. Sometimes, it reboot and sometimes it shut down just fine. Anything I can do about it?

[AnnMarie]

Your error message is here -> An Error Message Occurs When I Try to Print with the HP All-in-One. Follow the instruction on the front panel of your printer.

Re your shutdown problem, try installing the Win98 SE Shutdown Supplement.

[mockuppro]

Somehow I manage to get the print to work.

The HP OfficeJet R series folder is totally empty, and I can't find the scanner. Any suggestion?

[AnnMarie]

How can the folder be empty when I can see the below file running? It's part of your installation.

C:\Program Files\Hewlett-Packard\HP OfficeJet R Series\PrecisionScan\hpmdlbwa.exe

If you are still having problems with this hardware after uninstalling, reinstalling and upgrading the drivers, your best source of help is Hewlett Packard Support http://h10025.www1.hp.com/ewfrf/wc/siteHome.