[Resolved] Major Problem

Yes, but it doesn't work. (None of the function keys work.)

I also can't update IE or WMP.

Nevermind, I got it to update IE, but still not WMP.

Hi Please bear with me as I research some files to see which, if any programs will need to be reinstalled. Thanks

Well, I'm missing the "Toshiba Power Saver" and "Pointer" programs, so I know I'll have to (re)install those, plus the problem with WMP. Other than that, though, I don't know. Thank you for all of your help.

Hi Snowflake343, I think the audio problem lies with one of the missing Toshiba programs. You mentioned you no longer had access to items such as Power Management and other things that you could usually access from your keyboard. Did you used to get an onscreen disply when using these buttons? It's possible that the audio may have muted from the keyboard. We'll see iif we can get some of the items re-enabled and go from there. Sorry if I'm asking you to repeat things that you have already done, I'm trying to get up to speed. We'll check the usuall suspects first. Open the sound panel in Windows. In the lower right hand corner, look for a round icon that looks like an uncovered speaker. Double click on this. Turn the sound all the way up and ensure that the Mute box is unchecked. Check the sound and see if it works. Try this Click "Start." Click "Control Panel." Double click "System." Click "Hardware." Open the device manager, then double click on "Sound, Video and Game Controllers." Right click "Audio Codecs," and click "Properties." If working properly, it will say so. Let me know how you make out and which of the Toshiba features you know longer have access to and we'll try to find suitable replacement files. Thanks

The codecs are working fine. The only programs that I know are missing are the "Power Saver" (a Toshiba program) and "Pointer" (not sure if this is Toshiba or not - it's used to turn on/off the different mice (the blue circle one in the middle of the keyboard – which is currently turned on contrary my turning it off before the program disappeared – and the touchpad)). They both used to be accessible via the taskbar and the control panel. I don't know if there are others missing or not, those two are the only ones I've noticed. I also can't update Windows Media Player. I've downloaded MS Silverlight on my computer, but it doesn't work in IE. It works just fine in Firefox, but when I try to go to a page using it in IE, it says I don't have it installed, but if I go try to install it, it tells me that it's already installed and doesn't need to install again. The function keys aren't working at all. (The mute one, for example, usually displays a picture of a speaker that is either yellow (on) or grey (off). It isn't displaying anything, it is also not affecting the sound controls (monitored via the speaker in the task bar). I'm assuming that's connected to the volume control wheel on the front, which also isn't working. (It may not be connected, but either way, it's not working.) Another example is the screen brightness keys (one for up/bright, one for down/dim). They usually display a picture of a sun that fills up like a pie depending on how dim/bright the screen is. They also should actually dim/brighten the screen. Right now they aren't doing either.) When I hold down the "FN" key to activate them, the light comes on idicating the computer knows I'm pushing the key, but when I push one of the F keys to perform said function, nothing happens. Aside from that, I think it's just the sound that's not working. There could be other problems I haven't encountered, but that's all I've noticed. I tried headphones, and they didn't work either; there wasn't even any background "the speakers are on" static noise. In short, my computer just really doesn't like me. It's rather unfortunate.

Hi Snowflake343,

Let's see if we can find a clean copy of the files reported missing by OTL. We'll use a couple of searches. Please be patient, they may take a few minutes to conplete.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield
• Do not copy the word CODE , please note the script starts with the :
  

  :filefind
  *000StTHK*
  *00thotkey*
  *NDSTray*
  *CFSServ*
  *TFNF5*
  *TFncKy*
  *TOSDCR*
  *TPSODDCtl*
  *TPSMain*

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt




Plase locate combofix.exe on your Desktop, right click it an select delete.

Please download a new copy of ComboFix from Link 1or Link 2 to your Desktop. Do not run it, we will run it differently. We aren't removing anything with combofix, just looking for files.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

SRPeek::
c:\windows\system32\tfnf5.exe
c:\windows\system32\tosdcr.exe
c:\windows\system32\tpsmain.exe
c:\windows\system32\tpsoddctl.exe
c:\windows\system32\000stthk.exe
c:\windows\system32\00thotkey.exe
c:\program files\Toshiba\TOSCDSPD\toscdspd.exe
C:\Windows\System32\NDSTray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe

SkipFix:: 

Registry::

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

Please post back with

• SystemLook log
• combofix log

Combofix's log was over 600 KB so I'm posting it in two separate uploads.

Combofix part 2

Hi Snowflake343,

I will take me a bit to sort this out but let's start with the samples we found with SystemLook. We'll test them first to make sure they are clean.

Please note the file paths may look strange and appear to be 2 paths squashed together. They are indeed 1 path and are correct.They appear odd because of the location.

Also it is very important that if the file is reported as having been already scanned, you use the Rescan option.

We need some file informantion

• Make sure to use Internet Explorer for this
• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path, one at a time if more than file is listed, into the "Suspicious files to scan" box on the top of the page:
  
  
  C:\Qoobox\Quarantine\C\WINDOWS\system32\000stthk .exe.vir
  C:\Qoobox\Quarantine\C\WINDOWS\system32\00thotkey .exe.vir
  C:\Qoobox\Quarantine\C\WINDOWS\system32\tfnf5 .exe.vir
  C:\Qoobox\Quarantine\C\WINDOWS\system32\tosdcr .exe.vir
  C:\Qoobox\Quarantine\C\WINDOWS\system32\tpsoddctl .exe.vir
  C:\Qoobox\Quarantine\C\WINDOWS\system32\tpsmain .exe.vir
  
  
• Click on the Upload button
• Please ensure the scan is complete and the results saved before submitting the next.
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

Thanks

Here're the links:

http://virscan.org/report/165ee53a47b964e4…fe1f05d620.html
http://virscan.org/report/bb28b8a84ef82a22…26f1bb22d1.html
http://virscan.org/report/86621e46e49afef1…b867329739.html
http://virscan.org/report/cfbad6ad0b1c6e88…0652023db0.html
http://virscan.org/report/fd99b56e69659e20…9fe8a6e0da.html
http://virscan.org/report/60f9f9ab13347f76…0038ab493e.html

Hi Snowflake343,

I need you to create two fixes. First create a registry fix.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TFNF5"="TFNF5.exe"
"000StTHK"="000StTHK.exe"
"TOSDCR"="TOSDCR.EXE"
"TPSODDCt"="TPSODDCtl.exe"
"TPSMain"="TPSMain.exe"

• Ensure there is no space above the REGEDIT4.
• ensure the text matches
• in notepad go to FILE > SAVE AS and in the dropdown box, set the top box SAVE IN to DESKTOP
• in the FILE NAME box type (including the " " marks), "fix.reg"

Click save.

This will create a fix.reg file on your desktop [external image: Posted Image]

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.


Next, create this batch file.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad.

Do Not copy the word CODE

copy "C:\Qoobox\Quarantine\C\WINDOWS\system32\000stthk .exe.vir" "c:\windows\system32\000stthk.exe"
copy "C:\Qoobox\Quarantine\C\WINDOWS\system32\00thotkey .exe.vir" "c:\windows\system32\00thotkey.exe"
copy "C:\Qoobox\Quarantine\C\WINDOWS\system32\tfnf5 .exe.vir" "c:\windows\system32\tfnf5.exe"
copy "C:\Qoobox\Quarantine\C\WINDOWS\system32\tosdcr .exe.vir" "c:\windows\system32\tosdcr.exe"
copy "C:\Qoobox\Quarantine\C\WINDOWS\system32\tpsoddctl .exe.vir" "c:\windows\system32\tpsoddctl.exe"
copy "C:\Qoobox\Quarantine\C\WINDOWS\system32\tpsmain .exe.vir" "c:\windows\system32\tpsmain.exe"

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "myfix.bat"
• Click save

You will have a new file on your desktop called myfix.bat with an icon that looks like this
📎bat.PNG

Double click myfix.bat to run it.


Reboot your computer and obtain a new OTL scan log. There will only be a OTL.txt this time. Please post it's contents in you next reply.


Have any of the issues been resolved?

Thanks

New OTL Log: And no, the function keys still don't work, and the sound is still off.

Hi Snowflake343,

We seem to be still missing a file.

In windows explorer, please go to C:\Qoobox . In the right hand panel locate combofix-quarantined-file.txt and post it's contents.

Thanks