Drive problems

[Pokey86]

Nope, no luck there, tried everything you asked... I guess i could get a sound card & see if that sorts out the issue, it wouldn't conflict with the integrated one would it?

[pheonix73]

One thing I have noticed,is that if you have something like winamp installed.Check to make sure that the volume level on that is above zero,as it takes over your volume controls.

[Pokey86]

The volume doesn't matter, because MP3.WMA etc etc doesn't play, i get a error message come up... My comp doesn'r read that anything is installed, the only option i have in the dropdown for "Playback" is my modem.

Of course WMV's also have no sound, though they do play, same for mov's etc etc

[TurcoLoco]

The volume doesn't matter, because MP3.WMA etc etc doesn't play, i get a error message come up... My comp doesn'r read that anything is installed, the only option i have in the dropdown for "Playback" is my modem.

Of course WMV's also have no sound, though they do play, same for mov's etc etc

It sounds like you corrupted related parts of your system files, try Start > Run > sfc /scannow > OK (might ask for the XP CD). This might help but not sure, you might need certain .dll re-registered as their association/functionality could have been broken but hard to say which ones to re-register. See if the System File Scanner helps or not first. If this is the same system you had infected the last time you had an infection and came here for help (which I believe it is), a fresh OS install might be a wise move too.

Anyhow the following is the analyzed version of your log.

For all files listed on the log, you would have to google them and make your own call if you do not know what the file is for. I have already researched the entire list and narrowed it down to the following. Also you can locate the file and your system and upload them to this site where over a dozen online scanners take a look at the uploaded file to see if it is infected or not. This is a pretty darn good site for individual online file scanning! Since the files are not on my system, the end users have to do this step themselves:

[==========] AnalyzerXP 3.6 by TL - forum.networktechs.com (www.IamNotaGeek.com) [==========]


22/03/2007
21:45

Some of the files listed could be safe and valid, so before you do anything, research further.


Directory of C:\WINDOWS\Tasks
06/03/2007 15:37 284 AppleSoftwareUpdate.job >> I'd get rid of this silly task but your call.



=====] Looking for suspicious file types in WINDOWS folder:

Directory of C:\WINDOWS
!!! = Very suspicious, possibly a baddie
??? = Unknown or unclear but could be legit, research further

??? c:\windows\system32\bmaker.dat
!!! c:\windows\system32\bpenhan.dll
??? c:\windows\system32\cmdlineext03.pop
??? c:\windows\system32\imake.dll
??? c:\windows\system32\imaker.dat
!!! c:\windows\system32\picformat32.dll
???c:\windows\system32\zport4as.dll


~ Following files left behind by the Online Scanners could be deleted:
c:\windows\downloaded program files\asinst.dll
c:\windows\downloaded program files\bdcore.dll
c:\windows\downloaded program files\bdupd.dll
c:\windows\downloaded program files\ipsupd.dll

Contents of c:\windows\downloaded program files folder that looked suspicious:
inotes6.dll
libfn.dll >> Possible Kazaa related!!
ntlsignup.dll
stproxy.dll
zbuddy.ocx
zintro.ocx



=====] Directory Analysis - PROGRAM FILES:

03/11/2006 01:54 <DIR> Roguescanfix >> Did you use this tool recently, if so do you remember why? If done with it, get rid of it!
01/11/2006 20:38 <DIR> VSAdd-in >> What is this exactly? Did you install it? My online search came up with nothing good on it!
29/10/2006 23:52 <DIR> WH GBP Casino >> Free Online Games like this are often associated with malware one way or another.
22/08/2006 19:22 <DIR> AlphaZIP >> Do you need 2 File Compression utilities?
01/07/2006 16:58 <DIR> 7-Zip >> Do you need 2 File Compression utilities?

21/01/2006 04:36 <DIR> LimeWire >> As long as you have file sharing programs like this, it is a waste of time and I won't be able to help you!


=====] Directory Analysis - WINDOWS folder:

Volume Serial Number is 6851-E07B
Directory of C:\WINDOWS
25/02/2006 00:36 <DIR> BDOSCAN8 >> This folder appears to be a part of Kazaa if you it before or now, get rid of it!!
25/09/2005 14:52 <DIR> LQfix >> Did you use this tool recently, if so do you remember why? If done with it, get rid of it!

Good Luck,

~TL

[Pokey86]

[==========] AnalyzerXP 3.6 by TL - forum.networktechs.com (www.IamNotaGeek.com) [==========]


22/03/2007
21:45

Some of the files listed could be safe and valid, so before you do anything, research further.


Directory of C:\WINDOWS\Tasks
06/03/2007 15:37 284 AppleSoftwareUpdate.job >> I'd get rid of this silly task but your call.

Deleted, so many pointless add ons seem to come with installing software

=====] Looking for suspicious file types in WINDOWS folder:

Directory of C:\WINDOWS
!!! = Very suspicious, possibly a baddie
??? = Unknown or unclear but could be legit, research further

??? c:\windows\system32\bmaker.dat
!!! c:\windows\system32\bpenhan.dll
??? c:\windows\system32\cmdlineext03.pop
??? c:\windows\system32\imake.dll
??? c:\windows\system32\imaker.dat
!!! c:\windows\system32\picformat32.dll
???c:\windows\system32\zport4as.dll

Haven't done anything with these yet, will look in to them later

~ Following files left behind by the Online Scanners could be deleted:
c:\windows\downloaded program files\asinst.dll
c:\windows\downloaded program files\bdcore.dll
c:\windows\downloaded program files\bdupd.dll
c:\windows\downloaded program files\ipsupd.dll

My computer couldn't find them anyway

Contents of c:\windows\downloaded program files folder that looked suspicious:
inotes6.dll <--- Deleted
libfn.dll >> Possible Kazaa related!! <--Deleted
ntlsignup.dll <--- Deleted
stproxy.dll
zbuddy.ocx <--- These 2 are something to do with MSN, so i haven't deleted them, i don't think they're harmful
zintro.ocx



=====] Directory Analysis - PROGRAM FILES:

03/11/2006 01:54 <DIR> Roguescanfix >> Did you use this tool recently, if so do you remember why? If done with it, get rid of it! <--- Deleted
01/11/2006 20:38 <DIR> VSAdd-in >> What is this exactly? Did you install it? My online search came up with nothing good on it! <--- Deleted
29/10/2006 23:52 <DIR> WH GBP Casino >> Free Online Games like this are often associated with malware one way or another. <--- This is the software my dad uses, William Hill (WH) is a huge betting corperation in britain
22/08/2006 19:22 <DIR> AlphaZIP >> Do you need 2 File Compressionutilities? <--- Deleted
01/07/2006 16:58 <DIR> 7-Zip >> Do you need 2 File Compression utilities? <--- Deleted

21/01/2006 04:36 <DIR> LimeWire >> As long as you have file sharing programs like this, it is a waste of time and I won't be able to help you! <--- Deleted gone, i had this software before, i thought i deleted it but never got round to it (I heard they were really bad for your computer)


=====] Directory Analysis - WINDOWS folder:

Volume Serial Number is 6851-E07B
Directory of C:\WINDOWS
25/02/2006 00:36 <DIR> BDOSCAN8 >> This folder appears to be a part of Kazaa if you it before or now, get rid of it!! <--- Deleted
25/09/2005 14:52 <DIR> LQfix >> Did you use this tool recently, if so do you remember why? If done with it, get rid of it! <--- Deleted



i'll get to checking the other stuff later, got some sleep to catch up on hehe

---

It sounds like you corrupted related parts of your system files, try Start > Run > sfc /scannow > OK (might ask for the XP CD). This might help but not sure, you might need certain .dll re-registered as their association/functionality could have been broken but hard to say which ones to re-register. See if the System File Scanner helps or not first. If this is the same system you had infected the last time you had an infection and came here for help (which I believe it is), a fresh OS install might be a wise move too.

The problem here is that i don't have any windows XP CD's & i don't think my version is legitimate. (It did ask for the WinXP CD)

[TurcoLoco]

!!! = Very suspicious, possibly a baddie
??? = Unknown or unclear but could be legit, research further

??? c:\windows\system32\bmaker.dat
!!! c:\windows\system32\bpenhan.dll
??? c:\windows\system32\cmdlineext03.pop
??? c:\windows\system32\imake.dll
??? c:\windows\system32\imaker.dat
!!! c:\windows\system32\picformat32.dll
???c:\windows\system32\zport4as.dll

Haven't done anything with these yet, will look in to them later

Pay extra attention to the ones I bolded in red, my research suggested they were malware related and needs to be deleted.

~ Following files left behind by the Online Scanners could be deleted:
c:\windows\downloaded program files\asinst.dll
c:\windows\downloaded program files\bdcore.dll
c:\windows\downloaded program files\bdupd.dll
c:\windows\downloaded program files\ipsupd.dll

My computer couldn't find them anyway

You might have to use HijackThis (Spybot's Tools > ActiveX & BHOs sections are really good with informing you the bad/good ones and also allowing you to remove the ones you don't want) to get rid of them, if they show up on it if not then leave them be.

zbuddy.ocx <--- These 2 are something to do with MSN, so i haven't deleted them, i don't think they're harmful
zintro.ocx

Yes, my search came up with the similar info, if you know what they are and OK with it then of course leave them alone!

I forgot to tell you to close each and every open program, etc prior to running AnalyzerXP, similar to running HijackThis or any other scanner, you need to close all open programs so all unnecessary items won't get listed and it also helps us notice the things that are running in the background.

Also, I suggest using the system cleaner I created called CleanupXP+. It also initiates Windows Cleanup Manager at the end. The tool is very aggressive yet safe, it also offer file/folder removal option that is generally more efficient than doing it manually...if you do not have any specific files to delete then skip this step.

Remember: CLOSE ALL PROGRAMS prior to running this tool!! Using the tool in Safe mode would be ideal too.

[Pokey86]

??? c:\windows\system32\bmaker.dat
!!! c:\windows\system32\bpenhan.dll <-Gone
??? c:\windows\system32\cmdlineext03.pop <-Gone
??? c:\windows\system32\imake.dll
??? c:\windows\system32\imaker.dat
!!! c:\windows\system32\picformat32.dll <-Gone
???c:\windows\system32\zport4as.dll

The top 3 that i haven't deleted appear to be part of Nero showtime, i haven't touched them just yet. & i can't find the last one

You might have to use HijackThis (Spybot's Tools > ActiveX & BHOs sections are really good with informing you the bad/good ones and also allowing you to remove the ones you don't want) to get rid of them, if they show up on it if not then leave them be.

No they haven't seemed to show up

I forgot to tell you to close each and every open program, etc prior to running AnalyzerXP, similar to running HijackThis or any other scanner, you need to close all open programs so all unnecessary items won't get listed and it also helps us notice the things that are running in the background.

Would you like me to re-run it, soprry i didn't realise i shoulda kept everything closed, i'll re-run it now. as well as the cleaner thing below ^_^

Also, I suggest using the system cleaner I created called CleanupXP+. It also initiates Windows Cleanup Manager at the end. The tool is very aggressive yet safe, it also offer file/folder removal option that is generally more efficient than doing it manually...if you do not have any specific files to delete then skip this step.

Remember: CLOSE ALL PROGRAMS prior to running this tool!! Using the tool in Safe mode would be ideal too.

OK

EDIt, ok ran the cleaner & the analyzer again.

[TurcoLoco]

Well, the log looks clean now, I couldn't see anything other than the LimeWire program folder still being on the list. I thought you said you deleted it?

Anyhow, there is not much more I can suggest since the log looks ok now.
How are things running?

[Pokey86]

Well, the log looks clean now, I couldn't see anything other than the LimeWire program folder still being on the list. I thought you said you deleted it?

Anyhow, there is not much more I can suggest since the log looks ok now.
How are things running?

Well there are 2 minor things (Besides the sound, but like i said i'm getting my brother to have a better look at that one)

The start up software you got me, well it works for the most part. But sometimes certain things like MSN & a few others are still starting on start up, when i check the Start up folder it shows that these files have duplicates (One ticked & 2 unticked) Is this normal?

& lastly, i have a few programmes on add/remove that i have been trying to remove for quite a long time now but i get certain error messages come up. Is there an alternate method to uninstall softwares from your comp?

thank for all the help of course, i couldn't have done it without you

I couldn't see anything other than the LimeWire program folder still being on the list.

Hmmm, i did get rid of it via add/remove programmes

[TurcoLoco]

The start up software you got me, well it works for the most part. But sometimes certain things like MSN & a few others are still starting on start up, when i check the Start up folder it shows that these files have duplicates (One ticked & 2 unticked) Is this normal?

Unfortunately certain programs do re-spawn their startup entries, though this is generally a characteristic of malware related programs in the case of QuickTime, Real Player, Sun Java and Yahoo/MSN Messenger, you will have to configure the related settings within the program itself. For example: MSN Messenger should have the related check box on the General Preferences tab of the Options window which could be accessed from Tools > Options or Preferences (one or the other if I am not mistaken). Just uncheck the box next to the related option and that should do the trick. Otherwise they will continue to create a new startup entry and you will see multiple entries in whatever startup manager program you use. I know, this is quite a stupid and annoying thing but don't get me started on computing annoyances, I won't be able to stop ranting until I am a grandpa!

& lastly, i have a few programmes on add/remove that i have been trying to remove for quite a long time now but i get certain error messages come up. Is there an alternate method to uninstall softwares from your comp?

thank for all the help of course, i couldn't have done it without you


Hmmm, i did get rid of it via add/remove programmes

Click on the link in my signature and then under SYSTEM section you will see the link for the awesome freebie called MyUninstaller. This standalone freebie is a great Windows' own Add-Remove Programs applet alternative. It does give you the option to delete the entry if removing(uninstalling) it fails for some reason. It also shows you the details on the programs location, vendor, etc whatever is available so you can search your registry and also the file system to manually remove the leftovers using the vendor and/or program name as the keyword(s).

~TL