Flash Player with IE8 problems

Report · May 01, 2011

I have Vista 64 bit and McAfee security suite. The system came with IE8, and has been running Flash Player

until Tuesday. Now I get the white box with the little red x. It says I don't have FP and should download it.

Also, embedded pictures in e-mail do the same.

When I started IE, my homepage is yahoo, a box appeared that said 'A problem occurred, the page would restart'.

When I clicked ok, a file started to download and ran a setup program. McAfee normally asks if I want to allow this,

but not this time. It created a folder in Program Files X86\e-set. The scan started id'ing everything as a threat and

I should click on 'fix'. I couldn't kill the program, I couldn't delete the .exe. I was able to rename it, but when I tried

to soft boot the scan id'd taskmgr as a threat. I cycled power and the scan didn't restart.

I found a malware scan on MS support and downloaded and ran it. It also removed a file named Rogue fakesystem32.

That's when I started to have these problems.

I can't remember the name of the bad scan, but it said it was created by Heavenstools.

I downloaded a beta version of 64 bit FP, but after reading this board, I checked and it was in SYS32 and not in

SYSWOW64. I copied them over.

The MS scanner removed the the problem software. Everything else works, I'm

using the PC now. FP works in FF and Google browsers.

I can't run any player on IE, Youtube, EBAUMSWORLD, newspaper crosswords

etc.

McAfee did nothing on the malware. I ran a quick scan AND a scan on the

e-set folder itself. I can't remember how or where I found the MS scan. It

was on MS/support.

I've tried getting into Adobe on the other browsers too.

Les H

Report · May 01, 2011

Hi les, thanks for starting your thread. I have a few questions and need some information.

Go to C:\Windows\System32\Macromed\Flash Open Flash and post back all files listed there. The NPSWF files you'll need to right click on and then click on Properties to obtain the version numbers.

While you are there, replace "System32" with SysWOW64 and post back the files listed there.

Using IE8, go to Tools>Manage addons under "Show"(very light text) look in all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If so what Flash Player version is it?

That Rogue Fakesystem32, was more than likely a Trojan. Now is that folder still in Program files X86\e-set?

After you obtain the above information for me, go to www.malwarebytes.org and download and SAVE this to your Desktop.

Click on the Update feature and allow it to update. Then close it.

Next, close all browser windows. Disable McAfee this way:

RE: security suite disable
Double-click the taskbar icon to open Security Center
Click Advanced Menu (bottom left)
Click Configure (left)
Click Computer & Files (top left)

You can disable VirusScan in the riught-hand module and tell it for how long.

Then Open MBAM(malwarebytes) and run a full scan. This may take 30-45 minutes. If anything is found, follow their instructions for removing.

Send me the info prior to MBAM etc.

Thanks,

eidnolb

Report · May 01, 2011

Report · May 02, 2011

Answered

*Go to C:\Windows\System32\Macromed\Flash Open Flash and post back all files

listed there. The NPSWF files you'll need to right click on and then click

on Properties to obtain the version numbers.*

FlashInstall 4/30/11 text file

*While you are there, replace "System32" with SysWOW64 and post back the

files listed there.*

Do you mean all of System32 or just \Adobe and \Macromed?

Contents of SYSWOW64:

\Adobe

\Director

M5drvr app

M5if32.dll app ext

MP32dsw.dll app ext

SwDir.dll app ext

SWDNLD app

\Shockwave11

\Xtras

autodownload text

CBrowser x32

INetURL x32

Multiusr x32

Netfile x32

Netlingo x32

Speech x32

Control.dll app ext

dirapi.dll app ext

DynaPlayer.dll app ext

gi.dll app ext

gt app

gtapi.dll app ext

Iml32.dll app ext

Plugin.dll app ext

Proj.dll app ext

Shockwave_Projector_Loader DCR file

SWHelper_1150600 app

SWInit app

SWLogo bitmap

SWMenu.dll app ext

uninstaller app

*Using IE8, go to Tools>Manage addons under "Show"(very light text) look in

all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If

so what Flash Player version is it?*

No. In Toolbars Extensions there is Adobe PDF Link Helper ver

10.0.1.434

*That Rogue Fakesystem32, was more than likely a Trojan. Now is that folder

still in Program files X86\e-set?*

No.

*After you obtain the above information for me, go to

http://www.malwarebytes.org and download and SAVE this to your Desktop.*

Click on the Update feature and allow it to update. Then close it.

Waiting for your answer about replacing Sys32.

Next, close all browser windows. Disable McAfee this way:

RE: security suite disable

Double-click the taskbar icon to open Security Center

Click Advanced Menu (bottom left)

Click Configure (left)

Click Computer & Files (top left)

You can disable VirusScan in the riught-hand module and tell it for how

long.

*Then Open MBAM(malwarebytes) and run a full scan. This may take 30-45

minutes. If anything is found, follow their instructions for removing.*

Send me the info prior to MBAM etc.

Thanks,

eidnolb

Report · May 01, 2011

Try running a scan with Microsoft Security Essentials and then remove the corrupt add-on completely and allow Adobe's website to reinstall it for you.

Kind regards

Mike

Message was edited by Jochem van Dieten

Report · May 01, 2011

Hi holzeee, Which addon are you referring to? Are you speaking of Adobe Flash Player, since you said to allow the Adobe website to re-install it?

Just trying to understand your suggestion.

Thanks,

eidnolb

Report · May 01, 2011

It appears (to me) that the downloader is only sending the 64 bit files to

SYSWOW64, since there are no files in SYS31.

Report · May 02, 2011

Where is the reply button on the forum? Emailing the answers failed for

'unknown user'.

Here we go again!

Les

Report · May 02, 2011

*Go to C:\Windows\System32\Macromed\Flash Open Flash and post back all files

listed there. The NPSWF files you'll need to right click on and then click

on Properties to obtain the version numbers.*

FlashInstall 4/30/11 text file

*While you are there, replace "System32" with SysWOW64 and post back the

files listed there.*

Do you mean all of System32 or just \Adobe and \Macromed?

    Contents of SYSWOW64:
      \Adobe
         \Director
              M5drvr                app
              M5if32.dll           app ext
              MP32dsw.dll       app ext
              SwDir.dll             app ext
             SWDNLD            app
         \Shockwave11
              \Xtras
                    autodownload     text
                    CBrowser            x32
                    INetURL             x32
                    Multiusr              x32
                    Netfile                 x32
                    Netlingo              x32
                    Speech                x32
             Control.dll            app ext
             dirapi.dll               app ext
             DynaPlayer.dll      app ext
             gi.dll                      app ext
             gt                           app
             gtapi.dll                 app ext
             Iml32.dll                app ext
             Plugin.dll               app ext
             Proj.dll                   app ext
             Shockwave_Projector_Loader     DCR file
             SWHelper_1150600    app
             SWInit                         app
             SWLogo                      bitmap
             SWMenu.dll                app ext
             uninstaller                    app

*Using IE8, go to Tools>Manage addons under "Show"(very light text) look in

all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If

so what Flash Player version is it?*

No. In Toolbars Extensions there is Adobe PDF Link Helper ver
10.0.1.434

*That Rogue Fakesystem32, was more than likely a Trojan. Now is that folder

still in Program files X86\e-set?*

No.

*After you obtain the above information for me, go to

http://www.malwarebytes.org

and download and SAVE this to your Desktop.*

*Click on the Update feature and allow it to update. Then close it.*

Waiting for your answer about replacing Sys32.

*Next, close all browser windows. Disable McAfee this way:*

Report · May 02, 2011

Hi Les, When you want to reply to your thread it is better to look in your email notification and click on "visit the message page". This will bring you directly to the Flash Player Forum and the message that I or anyone else has replied to. Also any links within the message page here should be used and not any links within the email notification. There is a problem between the links in the email notification and the format of the Flash Player Forum.

Replying as I've stated above also doesn't post my message to you again.

Now, please refer to my message in Post#1 to you. When you go here: Go to C:\Windows\System32\Macromed\Flash

Just right click on that Flash folder. There are several listings of files there. I don't need the info in any Install logs or any Text files. I just need to know what is listed there, i.e. Flash10p.ocx, etc.

Then Go to C:\Windows\SysWOW64\Macromed\Flash And do the same thing as in the location of the System32. I need the same information as above.

There will be 3 Files listed in the System32 location PLUS 3 of the NPSWF files. Follow my instructions in Post#1, and the same thing for the SysWOW64 location.

This: Using IE8, go to Tools>Manage addons under "Show"(very light text) look in

all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If

so what Flash Player version is it?

Once you find "Show" there are 4 categories there. All addons, run without permission, currently loaded, etc. That is where the Shockwave Flash Object is listed, not in the Toolbars & Extension location.

Once we get the above information taken care of, then we can proceed.

Thanks,

eidnolb

Report · May 02, 2011

The responses are in post 8, after each topic.

Report · May 02, 2011

Hi Les, It appears that you want to give me information that you think I need instead of what I requested. What I asked for should have taken my request to you and your reply back. 2 messages. Instead we have had 10 message and still what I've asked for has not been supplied.

Until you supply the information I requested, I can't help you.

Take a look at this thread to see how easy it is: http://forums.adobe.com/thread/846207?tstart=0 Post# 3 &#4.

eidnolb

Report · May 02, 2011

C:\Windows\System32\Macromed\Flash

Response:

Only contains FlashInstall 4/30/11 text file

replace "System32" with SysWOW64 and post back the

files listed there.

Response:

Do you mean all of System32 or just \Adobe and \Macromed?

Contents of SYSWOW64:

\Adobe

\Director

M5drvr app

M5if32.dll app ext

MP32dsw.dll app ext

SwDir.dll app ext

SWDNLD app

\Shockwave11

\Xtras

autodownload text

CBrowser x32

INetURL x32

Multiusr x32

Netfile x32

Netlingo x32

Speech x32

Control.dll app ext

dirapi.dll app ext

DynaPlayer.dll app ext

gi.dll app ext

gt app

gtapi.dll app ext

Iml32.dll app ext

Plugin.dll app ext

Proj.dll app ext

Shockwave_Projector_Loader DCR file

SWHelper_1150600 app

SWInit app

SWLogo bitmap

SWMenu.dll app ext

uninstaller app

Using IE8, go to Tools>Manage addons under "Show"(very light text) look in

all 4 categories for Shockwave Flash Object. Is it Installed and Enabled? If

so what Flash Player version is it?*

Response:

No. In Toolbars Extensions there is Adobe PDF Link Helper ver

10.0.1.434

That Rogue Fakesystem32, was more than likely a Trojan. Now is that folder

still in Program files X86\e-set?*

Response:

No.

Sorry for the mis-understanding, this info was posted in message #8.

Report · May 03, 2011

Seems messages truncated. Answers should have been in post #4.

Rest of info:

SSYWOS64/Macromed contains.

Flash10p.ocx

FlashInstall

FlashPlayer.xpt

Flash10p_activeX.dll

Flash_Plugin

install

NPSWF32.dll ver 10.2.159.1