Still having some problems, could somebody read this log for me?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by pace, Dec 5, 2004.

Page 1 of 2
  1. pace

    pace Private First Class

    I am still having some issues, could somebody read this log for me and see if I need to delete anything?

    Thanks,

    Shannon
     

    Attached Files:

    pace, Dec 5, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You say you are still having some issues. Is there another thread that began a discussion on these issues? Have you run READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    It does not look like it. I see a few well know trojans that should have been fix if the above was run. For example:

    C:\WINDOWS\System32\lssrv.exe <--- http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_RBOT.CW&VSect=T
    C:\WINDOWS\system\lsvchost.exe <--- http://www.symantec.com/avcenter/venc/data/trojan.webus.d.html

    What are your issues?
     
    chaslang, Dec 6, 2004
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    And you have a load of other problems too! Run the READ ME FIRST now. All steps.
     
    chaslang, Dec 6, 2004
    #3
  4. pace

    pace Private First Class

    Phillie Phan and I fought through a pretty mean issue (Swap X hijack). One of the problems I am currently fighting is two IE windows popping up at start-up, their addresses are:
    http//63.246.131.130/car.html
    http//63.246.131.130/index.htm
    Another issue is several (Up to 32 windows) of IE popping up when I try to close IE down. Also, I am getting the About:Blank page popping up occasionally. I have been through the Spyware removal tool listed here. I am also haveing some hardware issues such as the sound wont play anymore and a software issue that seems to be preventing Word Perfect from working correctly. The computer is a Sony Vaio PCV-RS220.

    I am also getting the following errors:

    I am getting the following error message everytime I reboot my computer.

    Windows Registry Error:
    "One of the files containing the system's registry data had to be recovered by use of a log or alternative copy. The recovery was successful."
    This message pops up on every reboot and it is also taking a long time for the icons to pop up on my screen.


    Plus, I have tried updating to service pack 2 and I get the following error message when trying to use Windows Update:

    Update for Background Intelligent Transfer Service (BITS) 2.0 and WinHTTP 5.1 (KB842773)

    I also set up for automatic updates but when I checked under properties on My Computer it still shows Service Pack 1, even though add/remove Programs page shows several Windows Hotfix's with (SP2) in the title.


    Thanks,

    Shannon
     
    pace, Dec 6, 2004
    #4
  5. pace

    pace Private First Class

    I'll try running it again. Maybe I missed a step or something.

    Thanks,

    Shannon
     
    pace, Dec 6, 2004
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You must not attempt to update to SP2 with all these problems still on your PC. They must be fixed first. See my messages again below. Run ALL steps of the READ ME FIRST. In your case you should also run the Alternative Scans steps.
     
    chaslang, Dec 6, 2004
    #6
  7. PhilliePhan

    PhilliePhan Guest

    WOW, Shannon! This is way worse than the last time. Maybe not as difficult to remove, but a lot more stuff! Probably hit you in the time that your AV and Firewall were expired or down.

    Chas is correct - a run through the cleanup tutorial is in order! And NO SP2 until you are clean again.

    Hang in there. I bet you want to shoot your computer right now! :)

    You may be able to Uninstall 180 Solutions and Internet Optimizer via Add or Remove Programs

    PP
     
    Last edited by a moderator: Dec 6, 2004
    PhilliePhan, Dec 6, 2004
    #7
  8. pace

    pace Private First Class

    I am ready to shoot the thing. :)

    Thanks again for everyones help here.
     
    pace, Dec 6, 2004
    #8
  9. pace

    pace Private First Class

    Should I upgrade my firewall or anything before I run the spyware killer again, or run it first then upgrade everything?

    Shannon
     
    pace, Dec 6, 2004
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just to give you an idea of how much bad stuff you have, I have attached a file with all the bad items observed in you HJT log. Hopefully running the READ ME will fix some of these but I'm sure we will need some hand manipulation after you complete the READ ME.
     

    Attached Files:

    chaslang, Dec 6, 2004
    #10
  11. pace

    pace Private First Class

    I have attached the latest HJT log on with this post. I ran through the entire spywar removal program including the Alternative scans and some of the programs did remove several items, some programs didn’t find anything. I did keep some logs in a word perfect file, I can attach them if you want to see them. Also I noticed the information below on the HJT program:

    When I clicked on the Config tab on HJT I noticed on the page that is directed by the Main Tab the following:
    Below URL’s will be used when fixing hijacked/unwanted MSIE pages

    Default Start Page: About:Blank
    Default Search Page: http://www.microsoft.com/isapi/redir.dll?prd=ietar=iesearch
    Default Search Assistant:http://ie.search.msn.com/{SUB_RFC1766}/Srchasst/Srchasst.htm
    Dfault Seach Assistant Customize: http://ie.search.msn.com/{SUB_RFC1766}/Srchasst/Srchcust.htm

    Also, in my add/remove programs page do I need to address any of the following?

    Agere Systems AC’97 Modem
    Dvgate
    IPSwitch WS_FTP LE 1.15 MB rarely used
    OpenMG Secure Module 3.1 1.50MB rarely used
    Quicktime 2.19 MB
    Shock Wave
    TSA
    Wextech Answer Works .87MB
    Windows Ad Service .11MB
    Windows Task Ad .11MB
     

    Attached Files:

    pace, Dec 6, 2004
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure you have system restore disabled and viewing of hidden files enabled.

    Print this instructions or save them locally. I want you to disconnect physically (unplug your cable) before running these steps. And do not have any browser sessions running until I ask you to come back here and post your results.

    Okay, exit all browsers and disconnect NOW!

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below processes and if found End them:
    C:\WINDOWS\System32\notepad.exe
    C:\WINDOWS\System32\rsvp.exe
    C:\WINDOWS\System32\msrepair.exe
    C:\WINDOWS\gam.exe
    C:\WINDOWS\dieset.exe
    C:\Program Files\Windows AdService\WinAdServ.exe <--- on this one use End Process Tree
    C:\Program Files\Windows AdService\WinAdSlave.exe <--- on this one use End Process Tree
    C:\WINDOWS\system\lsvchost.exe
    C:\WINDOWS\cphabadq.exe
    C:\WINDOWS\System32\scvhost32.exe


    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\Run: [Microsoft SCVHOST32 Protocol] scvhost32.exe
    O4 - HKLM\..\Run: [Adobe] C:\WINDOWS\gam.exe
    O4 - HKLM\..\Run: [Printer] C:\WINDOWS\dieset.exe
    O4 - HKLM\..\Run: [Windows AdService] C:\Program Files\Windows AdService\WinAdServ.exe
    O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe
    O4 - HKLM\..\Run: [.mscdsr] C:\WINDOWS\system\lsvchost.exe
    O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
    O4 - HKLM\..\Run: [Notepad] notepad.exe
    O4 - HKLM\..\Run: [Internet Explorer] rsvp.exe
    O4 - HKLM\..\Run: [msrepair] msrepair.exe
    O4 - HKLM\..\Run: [xAU7e3A9] C:\WINDOWS\cphabadq.exe
    O4 - HKLM\..\RunServices: [Microsoft SCVHOST32 Protocol] scvhost32.exe
    O4 - HKLM\..\RunServices: [Notepad] notepad.exe
    O4 - HKLM\..\RunServices: [Internet Explorer] rsvp.exe
    O4 - HKLM\..\RunServices: [msrepair] msrepair.exe
    O4 - HKLM\..\RunOnce: [Notepad] notepad.exe
    O4 - HKLM\..\RunOnce: [Internet Explorer] rsvp.exe
    O4 - HKLM\..\RunOnce: [msrepair] msrepair.exe
    O4 - HKCU\..\Run: [Microsoft SCVHOST32 Protocol] scvhost32.exe
    O4 - HKCU\..\Run: [Internet Explorer] rsvp.exe
    O4 - HKCU\..\Run: [Windows service] sysdos.exe
    O4 - HKCU\..\Run: [Notepad] notepad.exe
    O4 - HKCU\..\Run: [msrepair] msrepair.exe
    O4 - HKCU\..\RunOnce: [Notepad] notepad.exe
    O4 - HKCU\..\RunOnce: [Internet Explorer] rsvp.exe
    O4 - HKCU\..\RunOnce: [msrepair] msrepair.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
    O15 - Trusted Zone: http://my.ebay.com
    O15 - Trusted Zone: http://download.windowsupdate.com


    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\notepad.exe
    C:\WINDOWS\System32\rsvp.exe
    C:\WINDOWS\System32\msrepair.exe
    C:\WINDOWS\cphabadq.exe
    C:\WINDOWS\gam.exe
    C:\WINDOWS\dieset.exe
    C:\Program Files\Windows AdService <--- delete the whole folder
    c:\program files\180solutions <--- delete the whole folder
    C:\WINDOWS\system\lsvchost.exe
    C:\WINDOWS\cphabadq.exe
    C:\WINDOWS\System32\scvhost32.exe
    C:\WINDOWS\System32\sysdos.exe

    Now reboot in normal mode, reconnect your cables, and post a new HJT log. And tell us how things are working.
     
    chaslang, Dec 6, 2004
    #12
  13. pace

    pace Private First Class

    I am getting ready to try it, I finally was able to even get back on the internet. I'll let you know how it goes shortly.

    Thanks,

    Shannon
     
    pace, Dec 7, 2004
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Let me know when you finish. Let me know if you have any problems with those steps.
     
    chaslang, Dec 7, 2004
    #14
  15. pace

    pace Private First Class

    Attached is the latest HJT log, sorry it took so long but I couldn't get back on the internet last night after I ran the steps. This morning it went in pretty easily. I am still getting the Windows Registery Recovery pop-up box on every log in and I think I have lost NOtepad since I cant open anything in Notepad now, the computer just beeps or alerts me that the program isn't there.

    Thanks,

    Shannon
     

    Attached Files:

    pace, Dec 7, 2004
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay the notepad.exe item is due to what I had you delete. It looked like a trojan the way it was loading at startup. Do you have a directory called c:\i386 or c:\windows\i386 ?
    You should be able to find a copy of notepad.exe in the i386 directory that can be copied back to c:\windows\system32. You can also check c:\windows for notepad.exe and copy it to the system32 directory.

    Were the below two items able to be killed (ended) last time with Task Manager. Also were you able to delete the HJT entries for them and the C:\Program Files\Windows AdService folder as requested. Or did you have a problem doing that.
    C:\Program Files\Windows AdService\WinAdServ.exe
    C:\Program Files\Windows AdService\WinAdSlave.exe


    That whole other large group of trojans appear to be gone now.
     
    chaslang, Dec 7, 2004
    #16
  17. pace

    pace Private First Class

    I will try the notepad recovery, thanks for the info. Under the Add/Remove programs I am still showing:

    Windows Adservice
    Windows TaskAd
    WexTech Answer Works
    TSA
    On Internet Explorer I am showing a Plug In number Q818529

    Here is the latest HJT log.

    Thanks,

    Shannon
     

    Attached Files:

    pace, Dec 7, 2004
    #17
  18. pace

    pace Private First Class

    Also, when trying to delete the files I actually couldn't find:
    C:\Program Files\Windows AdService\WinAdServ.exe
    C:\Program Files\Windows AdService\WinAdSlave.exe

    I can try again.

    Thanks,

    Shannon
     
    pace, Dec 7, 2004
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you sure that you (or you PC manufacturer) did not install WexTech? Here is some info on it.

    WexTech AnswerWorks

    It's a natural language development system that allows corporations to add an easy-to-use natural-language interface to Help systems.

    http://www.wextech.com/index2.html



    Use Task Manager to end WinAdServ.exe if found running.

    You should try to remove the below using Add/Remove Programs (probably will not work):
    Windows Adservice
    Windows TaskAd

    Also have HJT fix
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
    O4 - HKLM\..\Run: [Windows AdService] C:\Program Files\Windows AdService\WinAdServ.exe

    Again make sure you have viewing of hidden files enabled per the tutorial then look for and delete:
    C:\Program Files\Windows AdService <-- the whole directory
     
    chaslang, Dec 7, 2004
    #19
  20. pace

    pace Private First Class

    I tried deleting both programs from Add/Remove and also found both in the C:/Program Files/ directory and deleted both folders.

    The WexTech program is good and has been on my computer for a while, I just didn't recognize it.

    I am still getting the Registry Recovery notice on every reboot and my sound still isn't working, I get an error message saying it cant find the sound card. Other than that everything seems to be working. The attachment is the latest HJT log. Currently I have this computer offline and I am using my laptop until I get the PC straightened out for good and get it protected. I really dont want to go through this a third time. PHillie Phan did a great job the first time and I really appreciate your help with this occurrence.

    One of the programs I noticed in the C drive is:
    C:/Program files/Alwil Software
    It was created on December 3, 2004.
    Is this a good program, I assume it is associated with one of the scanners I downloaded.

    Thanks,

    Shannon

    Below is a list of what is currently running when I pull up Task Manager. I didnt have anything else opened.

    msmsgs.exe
    ashDisp.exe
    jusched.exe
    hpztsb06.exe
    ezSP_Px.exe
    AGRSMMSG.exe
    hkcmd.exe
    mycd.exe
    UPnPFramework.exe
    sv_httpd.exe
    PicAppSrv.exe
    ashserv.exe
    aswUpdSv.exe
    alg.exe
    spoolsv.exe
    explorer.exe
    taskmgr.exe
    svchost.exe
    svchost.exe
    svchost.exe
    lsass.exe
    services.exe
    winlogon.exe
    csrss.exe
    smss.exe
    System
    System Idle Process
     

    Attached Files:

    pace, Dec 8, 2004
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Shannon,

    You log is clean now. Alwil is fr your Avast virus scan application
    As far as the sound is concerned, you could try reinstalling you sound card drivers.
    For the Registry problem, I would suggest downloading Erunt and use it to back up your registry. After backing the registry up, use Erunt to rebuild the registry (hive). Let me know if that helps.
     
    chaslang, Dec 9, 2004
    #21
  22. pace

    pace Private First Class

    Thanks, I will try it when I get home. Does Erunt guide you through the process, or will I have to manipulate it? Also, would a System Works or Mechanics program help with this (or is that what Erunt is). On the Notepad problem, I found the notepad.ex_ file and copied it to the System32 folder but when I try to launch it I get the "what program do you want to use" box and cant get it to open or launch correctly. Do I need to pick one of those programs?

    Thanks for all your help.

    Shannon
     
    pace, Dec 9, 2004
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    notepad.ex_ is a compressed file. You need to expand it using Microsoft's expand program or you could look for another copy on your system that is already expanded to notepad.exe and copy it into the system 32 folder.

    To use expand on the notepad.ex_ that you already put in system32, do the following.
    1) open a command prompt window by click Start, Run and enter cmd in the box and click OK

    2) at the command prompt get to the system32 folder by entering:
    cd c:\windows\system32
    then hit enter

    3) type the following command and hit enter
    expand notepad.ex_ notepad.exe


    Now see how things work for files associated to notepad.

    I'm not familar with the other programs you mentioned. Use Erunt! Let it install and put icons on your Desktop. After install run Erunt to backup thre registry. After that, double click on the NTREGOPT icon on your desktop and let it optimize your registry hive. Then click yes to reboot. Let me know if that helps.
     
    chaslang, Dec 9, 2004
    #23
  24. pace

    pace Private First Class

    Hi, I am just now starting this computer back up. I have been out of town alot since we last talked, I must say it does seem to be running better but I was still getting a couple of pop-ups so I attempted to delete them in program manager. The pop-up I was getting at start-up was the Power Scan thing and I also noticed that Internet optimizer was back in the add/remove programs window. I ran Erunt and it did seem to help the registry error problem on the last reboot, hopefully that is gone. I have attached another HJACKTHIS log on this email, I would appreciate it if you could review it and see if I need to delete anything else. I ran Spybot and did have on issue {Exploit} and ran AdAware and everything was clean on that. Still haveing the sound card issue, I am going to try to work on that next. Can I reinstall the sound if it is a factory installed system and I dont have the original disc for it?
    I am now running Firefox and Zone Alarm with Avast Anti-Virus.

    Thanks,

    Shannon
     

    Attached Files:

    pace, Dec 30, 2004
    #24
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you install this update to Spybot: Spybot - Search and Destroy DSO Exploit Fix
    If not, do so. And then rescan.

    Okay since you were last here HijackThis has changed to version HijackThis 1.99. You need to get the new version and re-scan using it and post a new log (after doing what I give you below). You must always remember that ALL browsers MUST be closed before you use HijackThis. You had this running:
    C:\Program Files\Mozilla Firefox\firefox.exe

    You have a load of malware back on this PC.

    You should re-run the Symantec and TrendMicro Online scans and also re-run Stinger. Then run this online scan too: http://www.windowsecurity.com/trojanscan/

    Also I would suggest downloading and installing Spy Sweeper. It will allow you one update without buying. Update it and then run a full scan on your system and clean what it finds. Run it again in safe mode and clean. Let me know what it finds and cleans (it can generate a log).

    After that boot in normal mode and post a new HJT Version 1.99 log. Let me know how things are working too. If you still see this C:\Program Files\ISTsvc\istsvc.exe in your HJT log process list, run the below tool.

    http://securityresponse.symantec.com/avcenter/FxIstbar.exe
     
    Last edited: Dec 30, 2004
    chaslang, Dec 30, 2004
    #25
  26. pace

    pace Private First Class

    I ran the scans, here is the latest HiJack This log. The Spy Sweeper found a ton of stuff during the scan.

    Thanks,

    Shannon
     

    Attached Files:

    pace, Dec 31, 2004
    #26
  27. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Spy Sweeper cleanup up a bunch of the items I had seen in your first log. You have fewere problems now.

    If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
    For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side.
    Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.

    C:\WINDOWS\System32\smsss.exe

    After killing all the above processes, click "Back".

    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    O4 - HKLM\..\Run: [start uploading] smsss.exe
    O4 - HKLM\..\RunServices: [start uploading] smsss.exe
    O4 - HKCU\..\Run: [start uploading] smsss.exe
    O4 - HKCU\..\RunServices: [start uploading] smsss.exe
    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)


    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\System32\smsss.exe

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.

    Note: From the below list of services, I would guess you may need to uninstall and the reinstall Avast4. Also, you appear to have a service related to your Realtek hardware (is that a sound card) that is missing a file.

    O23 - Service: Alerter - Realtek Semiconductor Corp. - (no file)
    O23 - Service: Background Intelligent Transfer Service - ALWIL Software - (no file)
    O23 - Service: Computer Browser - ALWIL Software - (no file)
     
    chaslang, Dec 31, 2004
    #27
  28. pace

    pace Private First Class

    I deleted the files in HJT, and also ended the process in End Processes but couldn't find [C:\WINDOWS\System32\smsss.exe] in the systems32 folder, I found smss.exe but I assume that is a good file. Also, the Realtek is my sound card, how can I restore that file, I dont have the CD's since it was installed from the factory on my computer. Thanks for the help, the latest HJT log is attached.

    Everything is running better on the computer, except the sound card still dont work.

    Shannon
     

    Attached Files:

    pace, Jan 2, 2005
    #28
  29. pace

    pace Private First Class

    Attached is the latest HJT log after I uninstalled Avast and Re-installed it. I also looked in Systems32 in Safe Mode again and still cant find the smsss.exe file, but the smss.exe file is there, I still assume that is the good one. Also, I found the RealTek website and they have a download for my sound card driver (realTek AC'97 Audio Driver). Is it safe to download this file now, and do you think it may fix the problem?

    Thanks for your help.

    Shannon
     

    Attached Files:

    pace, Jan 3, 2005
    #29
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It should be safe to download now.

    It's funny that Avast still seems to have services missing:
    O23 - Service: Background Intelligent Transfer Service - ALWIL Software - (no file)
    O23 - Service: Computer Browser - ALWIL Software - (no file)

    Try uninstalling. Have HJT fix those two line above if still there. Then REBOOT.
    Now reinstall Avast and get all updates.
     
    chaslang, Jan 3, 2005
    #30
  31. pace

    pace Private First Class


    I uninstalled the Avast, checked the HJT log and the two files you are referring to were gone. I rebooted and reinstalled Avast and checked for updates and ran the HJT log again (Attached to this post) and noticed the files are back. Do I need to do anything to correct this? Avast shows that 5 of 6 providers are running, but Zone Alarm says it doesn't recognize any anti-virus software on my computer. Also, is there anything else to be alarmed about on the HJT log?

    Thanks for you help.

    Shannon
     

    Attached Files:

    pace, Jan 4, 2005
    #31
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well I'm not sure why it is doing that? I'll keep checking around but how is everything working because other than that you look okay.
     
    chaslang, Jan 5, 2005
    #32
  33. pace

    pace Private First Class


    Everything is working great, I just need to figure out this sound card issue now. Thanks for your help with this.

    Shannon
     
    pace, Jan 5, 2005
    #33
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Could it have anything to do with the missing file for the RealTek Service:

    O23 - Service: Alerter - Realtek Semiconductor Corp. - (no file)
     
    chaslang, Jan 5, 2005
    #34
  35. pace

    pace Private First Class

    I assume that is the problem, but I tried to download an update from the Realtek website and it still didn't work. I also found an update on the Sony website for that driver ( my computer is a Sony) but I cannot download it. I get an error message from Sony saying it cannot recognize my computer. Still trying to figure something out, if you have any ideas I would appreciate it.

    Thanks

    Shannon
     
    pace, Jan 6, 2005
    #35
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is your sound card on board (built-in) or a separate installable card?

    Have you tried removing it from the hardware devices in Device Manager, reboot, and then let the system reinstall drivers for the hardware that it will find?

    Did you drop a message over in the Hardware or Software Forums for this?
     
    chaslang, Jan 6, 2005
    #36
  37. pace

    pace Private First Class

    It is a built in soundcard and I did try remvoving it from device manager and rebooting but it didn't work.
    I did make a post in the hardware section to see it they had any ideas.

    Thanks,

    Shannon
     
    pace, Jan 7, 2005
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you look in Device Manger, do any yellow ? or ! show by the sound card hardware?

    Is this a digital output interface? Sometimes turning off the speakers and physically unplugging the power cable to your speakers for about 10 seconds and then plugging them back in helps. It resets an overload and allows them to work again (you may not have those types of speakers).

    Did you check the obvious, are you sure your sound is not muted?
     
    chaslang, Jan 8, 2005
    #38
  39. pace

    pace Private First Class

    Hi, One of the first things I looked for was the yellow sign or ! point by the sound card hardware, but there wasn't anything there. If I go to sound and audio devices and click on the hardware tab it shows every device as functioning properly, but if I click on the volume tab it says no audio device available, also under the audio and voice tabs under the default it shows no playback device. Before I was attacked by the hijack thing the audio played great and I never had a problem.

    Thanks,

    Shannon
     
    pace, Jan 8, 2005
    #39
  40. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you open up Control Panel and select the Sounds and Audio Devices icon, the Volume tab says no audio device is available? Hmmm?

    If you go thru the list of Hardware items, are any of them enabled? For example is you select any of them and click Properties, do any of them come up and show in the Device usage: box "Use this device (enable)"

    Does it have a Volume tab? Can you set the volume?
    On the Audio tab, what is chosen for Sound playback? Are there any choices?
     
    chaslang, Jan 8, 2005
    #40
  41. pace

    pace Private First Class

    If I go through the hardware items the realtek says it is enabled and working properly. Both CD drives show enabled and working properly, which I am not having any problems with. The Realtek says it is not digitally signed, but so do the cd drives. I can also play DVD's but still have no sound. I have a spot to adjust the volume but it will not let me do it, it is "grayed" out. Also, in the box labeled sound schemes the drop down is empty, should anything be in there? It is under the sounds tab.

    Thanks,

    Shannon
     
    pace, Jan 8, 2005
    #41
  42. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What is on the Audio tab for Sound Playback - Default device:

    Also on the Audio tab, click the Volume button. Then on the Play Control that comes up (make sure nothing is muted and the volume is up) then click the Advanced button. Now try switching between Digital Output Only checked and then unchecked. See if it makes a difference.

    Still sounds like you have a drivers problem though because earlier you said selections were missing.
     
    chaslang, Jan 9, 2005
    #42
  43. pace

    pace Private First Class

    I cant click on anything in the audio tab, it is all "grayed" out and I cannot select anything. I can click on the hardware tab, click on realtek ac97 and check the drivers and they say they are enabled and functioning properly. I hit one page that said drivers enabled but not started, but when I went back the message was gone. Is there a way to go in and start a driver? When I go to play control I cannot adjust anything, but I can see the volume tab and it is turned up all the way.

    Thanks,

    Shannon
     
    pace, Jan 9, 2005
    #43
  44. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Click Start, Run, and enter the following in the Open box: "services.msc" (without the quotes). Then click OK. Now in the Services window that pops up look for things related to your RealTek card. Maybe it will look something like the O23 line from HJT:

    O23 - Service: Alerter - Realtek Semiconductor Corp. - (no file)

    When you find that service, right click on it and selecting Properties. Then in the General tab see the area that says "Startup type: "? What does it say? All make note of the information in the "Path to executable" box. Tell me what that say!
     
    chaslang, Jan 9, 2005
    #44
  45. pace

    pace Private First Class

    I didn't see anything to do with realtek but there are a few selections I did noticed that wasn't started. One is Windows Audio, three are Vaio Music Media Server (application), Vaio Music Media Server (HTTP). Vaio Music Media Server (UPnP). Should the WIndows Audio be started? If I highlight it, it gives me the option to start it.

    Thanks,

    Shannon
     
    pace, Jan 9, 2005
    #45
  46. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Windows Auto should be Started and the Startup type should be automatic.
    You may need to start those other services too if they are stopped.
     
    chaslang, Jan 9, 2005
    #46
  47. pace

    pace Private First Class

    Thanks, I will try it tonight when I get home.

    Shannon
     
    pace, Jan 10, 2005
    #47
  48. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    OK! I cannot wait to hear the results.
     
    chaslang, Jan 10, 2005
    #48
  49. pace

    pace Private First Class

    I tried to start it up, but I received an error message saying:

    "Could not start windows audio on local computer.
    Error 3, the system could not find the path specified."

    I also tried starting the Vaio music applications and received similar messages.

    Thanks,

    Shannon
     
    pace, Jan 10, 2005
    #49
  50. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Remember earlier I when I had you look for the services, I mentioned a Path to Executable. Each service should have that. What are they for each of these services we are trying to restart?
     
    chaslang, Jan 10, 2005
    #50
Page 1 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds