Some strange things on this PC

WinXP Pro SP3- I guess I'll just list the weirdness: first, the PC makes the "Asterisk DING" noise at random. It doesn't matter if it's online or sitting idle with no windows or programs open; just every so often, it goes "DING!" for no apparent reason. The only programs that are running at startup are Avira's free antivirus, Microsoft Security Essentials, and some drivers. The second weird thing: when I enabled viewing of hidden devices in the Device Manager (I was looking for something; it's weird thing number 3), I noticed an entry for "MpKsl2281ed78" (screenshot #1 below). I searched it online and found nothing. I then searched the registry and found dozens of entries starting with "MPKSL" with almost identical data (screenshot #2 below). These registry entries cannot be deleted. Weird thing #3: the hard drive is not listed in the Device Manager (screenshot #3). I enabled every option in the "View" options and it simply does not appear. MalwareBytes scans have come up clean, Avira scans are clean. What's the deal?

 

First, you shouldn't be using two AVs. Uninstall one or the other.

See what things are like after getting your AVs straightened out.

 

It looks like a possible rootkit. Did you try scanning with Tdss killer? Aswmbr is also pretty good at detecting rootkits.

http://majorgeeks.com/Kaspersky_TDSSKiller_d6895.html

http://public.avast.com/~gmerek/aswMBR.htm

 

Mpksl has to do with MS Security Essentials
http://answers.microsoft.com/en-us/...rying-to/05886700-30ac-4512-a943-7221bf0f1a90

As far as the ding, check in sounds to see what "events" are associated with the ding. You might be able to figure out what service is doing this.

Anything listed under Legacy can not be deleted. I ran into this a few years back when I was beta testing SunBelt Software's av program, now known as VIPRE.

 

"MpKsl2281ed78" is the driver for MSE.

 

Hmmmm..... "MpKslxxxxxxxx" is part of MS Security Essentials? Strange that a search of the interweb came up with nothing when I used "MpKsl2281ed78" as a search word. I believe ya tho'

@ kipfeet: thanks for the suggestion, but MalwareBytes and Avira run VERY well together as they both cover different things, and you can actually run MS Security Essentials with those two programs also w/o the fear of conflict or PC lag. It's not like running Norton with McAfee for example. I've been using the full MBAM and the free Avira together on my home PC for YEARS and I find it to be an excellent combo; they compliment each other well.

@ tgell: rootkit? You're right!!! :banghead To be precise, it was Rootkit.Boot.Pihar.B according to TDSSkiller. Once that was taken care of, the mysterious "Ding" vanished, and the PC's overall performance increased a bit. I decided to run TDSSkiller about 2 hours after I originally posted (I got sidetracked on a different project and it took me 24hrs to get back to this post) and got everything straightened out. Good instincts tgell.

 

I wasn't referring to MalwareBytes and Avira running together. The two AVs you are running are AVira and MSE. Hardly anyone on MG would tell you that running two AVs is OK; I know the Malware-Removal folks wouldn't. See
http://forums.majorgeeks.com/showthread.php?t=44525 point #2 for details.

You might also see http://answers.microsoft.com/en-us/...th-avira/83369439-7ed4-45fa-8f94-265516c8c3b1

I'm glad you dug out that rootkit, though.

 

Wow, a rootkit with sound effects! That has to be a first, for me anyway!

 

Some casual reading links:

Answers.Microsoft.com discussion about the subject...

Checklist for installing MSE...

Avira's position about the subject...

Bottom line: both Avira and Microsoft offer the stock mantras about not running two a/v programs, but other than the common sense stuff about butting heads, performance problems, system instability issues, yada yada ad nauseum, neither source seems to offer definitive proof that the two programs cannot coexist peacefully on a single machine...

</rant>

 

Well, isn't that enough reason not to do it? :confused I can't imagine how anyone who knows those points to be valid would still want to run two anti-virus programs at the same time.

If you want to have two antivirus programs installed, then the best approach is to allow only one to be constantly running and use the other for manually started one-time scans, during which the one normally running in real-time mode would be disabled. That's the only way using two antivirus programs makes good sense.

 

Hi my friend , another idea is that , creating a rescue cd

http://majorgeeks.com/Kaspersky_Rescue_Disk_d6501.html

http://www.liberiangeek.net/2009/12/kaspersky-rescue-disk-clean-pc-viruses-spyware/

checking your machine every day , uninstall one of them , it's a good thinking than using two antivirus in your machine !! :wave