Help with removing "You need to update your version of media player"

Viruses and worms
1

I haven’t been able to stop the “You need to update your version of media player” screen from showing up. Malwarebytes and avast haven’t stopped it. Any help would be appreciated. Thank you.

2

Just do what is shown in the topic “Logs in assist in cleaning malware” at the top of the viruses and worms section
and attach the logs here, dont copy and paste them.

Run in list ordered, after that malware removers will be notified. :wink:

3

I’m monitoring this … :slight_smile:

4

Magna86 will guide you through the cleanup process, just do what he says
until he gives you a all clean. :smiley:

So good luck… 8)

5

Can you post a screenshot of this warning/notification ?
Use the ‘Attachments and other options’ link in the Reply window to attach the screenshot to your post.

6

Logs are attached from requested scans. Thank you.

7

Re-run OTL.exe.

[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.

:COMMANDS
[CREATERESTOREPOINT]

:OTL
FF - prefs.js..extensions.enabledAddons: addon%40infobirdpro.com:3.0
FF - prefs.js..extensions.enabledAddons: addon%40bazaarfriend.com:2.0
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@bestbuy.com/npBestBuyPcAppDetector,version=1.0: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy)
FF - HKLM\Software\MozillaPlugins\@WeatherBlink.com/Plugin: C:\Program Files (x86)\WeatherBlink\bar\1.bin\NPgcStub.dll (MindSpark)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\gcffxtbr@WeatherBlink.com: C:\Program Files (x86)\WeatherBlink\bar\1.bin [2012/12/23 16:14:06 | 000,000,000 | ---D | M]
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [test] c:\windows\test.bat File not found
O4 - HKLM..\Run: [WeatherBlink Search Scope Monitor] C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcSrchMn.exe (MindSpark)
[1 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]

:FILES
dir C:\Users\Barry\AppData\Roaming\SoftGrid Client /c
ipconfig /flushdns /c
C:\ProgramData\Best Buy pc app
C:\Program Files (x86)\WeatherBlink
C:\Users\Barry\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
C:\Users\Barry\AppData\Roaming\Mozilla\Firefox\Profiles\1u9nao9u.default\extensions\addon@bazaarfriend.com
C:\Users\Barry\AppData\Roaming\Mozilla\Firefox\Profiles\1u9nao9u.default\extensions\addon@infobirdpro.com

:COMMANDS
[resethosts]
[emptytemp]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

If the log doesn’t appear, it can be found here:

c:_OTL\MovedFiles\mmddyyyy_hhmmss.log

THEN …

http://imageshack.us/a/img841/7292/thisisujrt.gif
Please download Junkware Removal Tool to your desktop.

[]Shut down your protection software now to avoid potential conflicts.
[]Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select “Run as Administrator”.
[]The tool will open and start scanning your system.
[]Please be patient as this can take a while to complete depending on your system’s specifications.
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[]Post the contents of JRT.txt into your next message.

8

OTL log attached. Thank you

9

JRT log attached.

10

How’s your computer running now? Any pop-up?

11

I haven’t had any pop ups in almost a week. They would come at irregular times and sometimes days apart when I had them. If everything looks good to you I’ll assume the problem has been fixed. Thank you for the help.

12

NP. :wink: If something pops out, please feel free to report here. :slight_smile:

I will remove used tools;

Please download DelFix by “Xplode” to your Desktop.

Run the tool and check the following boxes below;

[] Remove disinfection tools
[] Create registry backup
[*] Purge System Restore

Now click on “Run” button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

I don’t need DelFix log report.

I recommended you to keep Malwarebytes and to use MCShield if you will.
You may download MCShield from one of the following links:

MyCity - Official download link
Softpedija - Mirror download link

It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but it will immediately clean flash drive, memory card or external HDD.

Be safe :wink: