Drive problems

[Pokey86]

Hello, i left my comp on while i went out & left it on with Ad-aware running when i came back it had 56 minor viruses that i just deleted, but i realised that i had no sound after, i mean not at all, my comp couldn't read any speakers connected.

I messed around with it uninstalling the codecs then restarting but during that i noticed that not only are my speakers not working but my DVD & CD drive are also not working. I don't know what may have caused this, but of course it's not letting me use any installing CD's

Any help would be appreciated, please find a HJT log in case you need it

(I've run Ad aware & Spybot in safe mode before i posted this)

Thanks in advance

[jholland1964]

We need more info about the computer itself, operating system, etc. Plus there is no HJT log showing.
What do you mean EXACTLY when you say

I messed around with it uninstalling the codecs then restarting

EXACTLY what did you do?
AdAwareSE does not find viruses, it finds Adware...Did you quarantine the items found or totally delete them? If you only quarantined them you could restore them via AdAwareSE, but we would need to know what they are first before we would ok that.

[Pokey86]

We need more info about the computer itself, operating system, etc. Plus there is no HJT log showing.
What do you mean EXACTLY when you say
EXACTLY what did you do?
AdAwareSE does not find viruses, it finds Adware...Did you quarantine the items found or totally delete them? If you only quarantined them you could restore them via AdAwareSE, but we would need to know what they are first before we would ok that.

Sorry, i'm using Windows XP, & what i meant was i followed the windows troubleshooter of uninstalling & reinstalling the device, that was when i noticed that the DVD & CD drives were also not working, if it helps this is what it sais in "Device Status." Sadly i've deleted everything that adware found, i didn't think it deleted good things.

Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)

Click Troubleshoot to start the troubleshooter for this device.

& iv'e attached the HJT log now

[jholland1964]

There is NO HiJackThis log.

Go to your Device Manager. Double click on the + sign next to DVD/CDROM drives to open it. Choose one of them, right click and choose UNINSTALL. Click ok. Shut down the computer, reboot the computer, unless you have removed some IMPORTANT files playing with codec's then XP should find a "new" drive and install the drivers
Do the same with the next one.
Then do the same with your speakers.

[Pokey86]

DAMN, i know i uploaded it


OK i did the above step with the with the CD & DVD drive & they work, i've tried it with the sound card device but it's not working, however i have list the disk that came with my speakers... So i might need to get new ones

[PhilliePhan]

You've also got a nasty backdoor SDBot that has likely compromised your machine.
O4 - HKLM\..\Run: [MSWindowsUpdate] C:\WINDOWS\system32\winsecurityxp\mswinup.exe

Suggest you run the AVG Anti-Spyware and Kaspersky Online scan steps linked in the "Read Me First" Sticky Post.

I imagine Judy will have some removal steps for you shortly. I did not look at the complete log.

-- You will need to run SDFix and a rootkit scanner such as GMER or Blacklight to make certain you get any and all accociated baddies.

PP

[Pokey86]

i did an online panda activescan earlier if it helps.

I'll run AVG now

[jholland1964]

PP has asked for a Kaspersky scan, which is EXACTLY what I would have asked for...give us that and the AVG Anti-spy scan and logs as he requested. Kaspersky is the top of the line today for finding nasties on the computer and this is the ONE I always recommend.
Follow the instructions he gave you please.
You know Pokey we tried to deal with much of what showed in the new Panda scan back in November, but you ended the thread by saying the problem fixed itself, obviously it did not. Part of our problems then were the fact that you didn't follow our instructions exactly. If you do not do this then you will not rid your computer of these problems.
Please run what is asked, NOTHING else until requested or else we have no way of knowing what needs to be done. Some problems will not be fixed unless the fixes are applied in a very specific way...you have a badly infected computer and it will remain that way unless you do exactly as told to do. I will tell you right now, the fact that your speakers are not working at the moment is totally imaterial. That is something that can be worked on AFTER the computer is clean. This will take MANY steps.
Part of the problem now is you are not running either an anti-virus program OR a firewall, no wonder the computer is infected, and still infected with some of what we tried to deal with nearly 4 months ago.
Follow PP's instructions EXACTLY.

[Pokey86]

Please find attached the AVG & Kaspersky logs


I know you probably don't care to hear it but i feel the need to justify myself (I know i've made myself out to be an annoying git) I never used to live here & going to & from this house to clean the computer becme extremely awkward, especially due to my dads sheer reluctance towards lengthy scans. (He plays online poker, despite my warnings not to... But obviously addiction breaks logic) Which means he'd basically **** about with the comps during scans unless i was sitting here at all times, even on safe mode & often halt scans because his software is running slow, & personally i got sick of running scans that never got finnished. I'm sorry i made things hard for you.

Either way, to cut all that short i am living here for a while now aso you have my undevided attention, apart from work obviously, but thats about it

[jholland1964]

Ok Pokey, if you stick with me I will stick with you. A suggestion, since you have difficulty, because of your Dad's reluctance to continue all the way through...
Print out the instructions each time I give them. Number them...
Then when he is off the computer and you can have the computer to yourself you can complete each step in the order given.
Your scans are showing numerous Trojans in various locations on the system. If you don't get rid of these they will just bring in more so I would advise...let's rid the system of all of them and then set up the system in the most secure way, maybe so your Dad won't even know, but you will have the peace of mind that you have done all you can...


Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Please post the contents of C:\vundofix.txt with your new HiJackThis log which you will run at the end of these fixes.

Download AVG Free...an anti-virus program which is desparately needed on this system. If you get it loaded and updated your Dad won't even know it is there and it WILL not interfer with his poker.
Download it, install it and update it.

Next;
• ATF-Cleaner.exe by Atribune(Windows XP & 2K ONLY) You can put this on your Desktop for easier access.

Update the AVG Anti-spy program.

Show hidden files and folders.

Disconnect Completely from the Internet and Close ALL Browser Windows!

Now, reboot the computer in SAFE MODE

Using the F8 Method

1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
3. Select the option for Safe Mode using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode.

RUN ATF-Cleaner.exe.
-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK > EXIT
Now, open ATF-Cleaner.exe again. This time Click Firefox at the top.
Click Select Files to Delete.
Check the Select All Option
You should get a message asking if you also wish to delete Firefox saved passwords. You may choose NO if you wish.
-- Click Empty Selected > OK > EXIT

Now, run your NEWLY installed AVG Free Anti-virus program.
Tell it to fix EVERYTHING found.

– Please Launch AVG Anti-Spyware.
-- Click on the Scanner button and choose the Settings Tab.
---> Under How to act?, click on Recommended action and choose Quarantine to set default action for detected malware.
--->Under Reports make sure Automatically generate report after every scan is selected and UNCHECK the Only if threats were found box.
-- Leave everything else at their default settings and Select the Scan tab and CLICK Complete System Scan to scan your machine.
-- Upon completion of the scan, Click Apply all actions to place any detected baddies in Quarantine.
(you did not do this on the last scan and therefore nothing was fixed or quarantined. You must tell it to fix or quarantine anything found)
-- AFTER clicking Apply all actions, Click on Save Report and select Save the report to your Desktop.

Reboot the computer in NORMAL mode.
Run a new online Kaspersky Scan, save the log.
Run a new HJT scan, save the log.
Post back here with the NEW
Vundofix log, the AVG Anti-spy log, the Kaspersky log and the HJT log.
Judy