Blocking Websites...

[ameerat42]

Checked that (HDD) before and also nothing. Have no other media that I have
recently used.

[John King]

Did you track down that exe file Rick mentioned before?

Might be worth trying to uninstall that via Control Panel if it hasn't got its own uninstaller.

Meanwhile, back at the ranch, I will see if I can track down what it is and what it's for.

[ameerat42]

Yes, only to the extent of finding it is a Windows incorporated 3rd-party beast, so I left it alone.
Seems it has its fair job - whatever that really is? - to do.

I can report that since this second scan I have had NO blocking messages.

[John King]

How to uninstall this program is here:

http://www.advanceduninstaller.com/D...pplication.htm

Needless to say, use the manual method. Their uninstaller could contain further poxware!!

[ameerat42]

Yep. Read that link before, but I will leave the prog.

[John King]

I'd be inclined to kill it off ... Its credentials, or lack thereof, don't recommend it to me .

[John King]

Ummmm
Am, read this:

http://www.orange-defender.com/deskt...1406456207.htm

Not what I would call a high recommendation for this program! Lack of an uninstall program and running as a background service are each enough to make me feel highly suspicious.

[ameerat42]

Interesting reading, JK, esp the 3rd-last point.

So why is it included in Windows, I ask
BTW, last nights full scan of ext HDD showed nothing.
800 odd Gigs. Took a while.

[John King]

Yeah, mate, those full scans take a while! My main w/s takes around 24-28 hours for 9 TB.

Those files/folders don't exist on my Windows 7 Pro boxes (64 bit). Are you sure they are part of the OS install?

[Edit] Something that's logging keystrokes has no business being on any computer. Key loggers are always viruses, IMNSHO.

[ameerat42]

Gosh, 9 Terrrbytes!

More info on that here: http://www.freefixer.com/library/fil...ce.exe-277934/

Seems no definitive answer, as this is like a couple of other refs.

- - - Updated - - -

--And another thing: would you believe I could not find it in Microsoft Forums?

[John King]

Yes, that lack of concrete references also has me bothered and a bit confused. Maybe we should be using another search engine? Google is not what it once was
I will try using some other search engines.

BTW there are another 9 TBs of offline/portable HDDs ... A 2 TB Toshiba drive lives in my camera bag when not being updated.

- - - Updated - - -

Have a look here.

Seems to cover best practice removal from the MWB forum. Applies to mainly different viruses, but came up when I searched with Yahoo.

https://forums.malwarebytes.com/topi...tc-infections/

[ameerat42]

OTOH, there's this: http://startups.glarysoft.com/Deskto...ce.exe/384434/

(I used Duck Duck Go)

[John King]

Nothing on answers.microsoft either.

Maybe just let MWB block its access to the Internet FTM? Keep a watching brief on its activity.

If you have bought MWB, raise a ticket with their support group about it, including the image you captured.

[ameerat42]

I have stopped it for now in Task Mgr, but I can't see how to disable it permanently there.

- - - Updated - - -

Hah! Found its "parent" - Native Desktop Media Service and stopped that.

[John King]

Go to Administrative Tools/Services and disable the service there to stop it from starting at next reboot.

[ameerat42]

I think I've done it through (the entrails of) Task Mgr, JK...
Actually disabled it here...
Native.jpg

And ta for PM info.

[John King]

That looks good, Am. Check that it is still DISABLED after your next reboot.

And no worries. Glad to be of any help I can be.

[ricktas]

Have you looked in : C:\Program Files\JetMedia to see what else is in that folder. As that is where this App is. It could well be that looking in that folder enlightens you further.

I just checked all three windows machines here and I (1) do not have that folder (2) have no application running that matches up with this desktop media server in any way. Generally if it was part of windows it would be in C:\Windows\ or otherwise it is generally c:\program files\microsoft\ The fact is has its own folder suggests it is some sort of standalone application.

[ameerat42]

Yes, Rick, I had a look. It's in:
C:\Program Files\Jetmedia\NativeDesktopMediaService
There are:
checker.exe
Desktop_Media_service.exe
Uninstall.exe

But I have successfully stopped it, and now MawareB takes over any blocking of sites.
Before MWB WinDefender used to/may still do as well?

[John King]

Hoho. Now run the uninstall program in that folder.

@ricktas Good work checking your own PCs, Rick. It seems that the program is definitely a foreigner.