Mal-ware removed, No Sound,

Hopefully have removed Mal-ware though WTTech's help, (on another WTT forum) After doing many scans etc and removing the Mal-ware i find there is no sound, either in iTunes, Live streaming TV programmes etc, even the customary Windows start up Tune has stopped, would anyone on the team know how i could restore it? have looked at the obvious like the mutes etc but all seems normal, thanks in anticipation

Hi, Sorry to hear of the problem with your sound…. check in Device Manager and see if the sound driver is loaded and working OK ( no yellow or red markers.) Up date/ roll back the driver, see if this helps. Post back if you need further help Regards paws

Hi Paws, Will get back to you and let you know what i find, please be aware that i am a total novice with regards the understanding of computers, so Up-date and roll back the driver i am sorry to say i will have top google it to follow your instructions, Sweet-Tech has been an great as well as being very patient in helping me remove the Mal-ware that i had, will get back to you and let you know what i find.

Hi, Ok, No worries try this: 1 Click on Start 2 Right click on My Computer 3 Click on Properties 4 Click on Hardware 5 Click on Device Manager 6 Scroll down to sound video and game controllers 7 Click on the +sign to the left of the above any yellow or red markers? Right click on your sound device, click on update driver…see if this does the trick, allow the computer to search the Internet for the best driver does this help? You can also roll back the driver by following a similar procedure Regards paws

Hello Paws, RE: Device manager, there are 2 yellow markers in the list, as follows, Network adapters, NVIDIA nForce 10/100/1000 Mbps Ethernet Other devices!, SM Bus controller Would this be the problem?

Hi Paws, I have to go out for an hour or two, will you be on the WTT forum all evening/tonight ?, if so what time will you call it a day? i ask because if you will be working i will try and get back as soon as i can.

Hi, No worries, Make sure you are connected to the Internet. Right click on the NVIDIA nForce 10/100/1000 Mbps Ethernet and select update driver….it should search the Internet for the driver and install it..when its done you can do the other one with a yellow marker, when thats done close down and restart your computer and see if that has done the trick Regards paws Ps I'll be off to kip in about another 10 minutes or so

Hi, Paws. Went to System Properties, opened Device Manager, right clicked on one of the two yellow markers, and it opens up a drop box with 5 options, Update driver, Disable, Uninstall, Scan for changes and Properties, doesn't send you to any update web sites!, when you click on Scan for changes it just closes and does nothing, the only other is Update driver and that just opens the Hardware update Wizard, of which that only gives two options, load/install from disc or search for Software from know location, as i have not seen the NVIDIA disc that came with the PC for a long time i don't know?, even went Nvidia web site to try but i gave up in the end, Network Adapters in the list links the yellow marker to - "Nvidia Nforce 10/100/1000 Mbps Ethernet", the other yellow marker is next to Other device's and links to"SM Bus Controller", whatever they are?, can you suggest anything further? you did say about rolling back but how would you do that?, its never been updated before to my knowledge, so is it possible to Roll Back? Found this after playing around trying things, "Windows cannot load the device driver for this hardware". The driver may be corrupted or missing. (Code 39) Managed to get this when i clicked on device in Wizard., sent me to help centre, says uninstall and reinstall, pressed uninstall and a warning appeared, not able to uninstall due to it being involved in system boot up, crazy, says uninstall/install but wont let you?. I have a Uni-blue programme called Power Suite, one of its uses is to check for out of date drivers, I just ran a scan and it said i had one Nvidia driver out of date, downloaded the new driver and and installed it, checked back in Device manager and both yellow check markers are still showing, Coincidentally, when i ran MSN earlier and used the Web-Cam there was some sound but it sounded like it was coming from out of a tunnel!, the same was for Itunes, when playing sounded just the same as MSN, like it was coming from a tunnel or even like from a live act on stage, youTube and live TV streaming are both still soundless.

Hi, Did you try doing this:

Right click on the NVIDIA nForce 10/100/1000 Mbps Ethernet and select update driver….it should search the Internet for the driver and install it

Make sure you are connected to the net when you do it you may need a wireless connection to do this.
Next follow a similar procedure but this time update /download or install your sound driver.
Let us know if this does the trick…..
if the sound requirement is really urgent then you can buy a USB sound stick for a few pounds and then you wont need to rely on your existing hardware
Regards
paws

Hi, No, when you right click on NVIDIA nForce 10/100/1000 Mbps Ethernet it opens the drop box as previously mentioned with the 5 options, clicking on update driver just opens the "Hardware Update Wizard" where there are 2 options, install manually or install from a known location, i have tried both of which one of them i think maybe what you are referring to?, click on that starts a search but just says after 10 seconds of searching "Can not continue the hardware update wizard", (two further options) "keep the hardware you have installed" or the second, "search in known locations", i would like to get my computer back to how it should be, buying a Audio stick is an idea but i have already paid good money once for decent Audio and graphics cards, there are a few other issues that i can add to the growing list, since doing all the Mal-ware scans and sorting the malware problem out have found that i keep loosing wireless Internet connection and keep having to keep clicking on restore connections, also little red X's on some of the pictures/content on web pages, lastly, regarding process's at start up, when the PC boots up it can sometimes take up to 5 minutes to settle down and able to browse the Internet, in the process list there are nearly 40 process's in the list, all of which are ticked, i have unchecked all the process/programmes that are not needed at start up and follow the prompts on apply and reboot etc etc……, but on reboot they are all re ticking themselves and whatever i try nothing will work, what do you think, or not think lol.

Hi Ok I understand.
In the light of your comments :

there are a few other issues that i can add to the growing list,

and

i would like to get my computer back to how it should be

I have quickly reviewed all the posts in this topic and all the 80 odd posts in your malware topic; these are the things that jump out at me:

1 Your logs indicate that Peer to Peer (P2P) File sharing applications…….Limewire etc. may have been installed at some time on your machine…….Any files on your machine that have been acquired through this type of file sharing and without a known good provenance are likely to be suspect………. It''s not usually possible to identify positively from where an infection emanates ( without a large amount of time consuming and therefore costly forensic investigations) but P2P file sharing is known to be one of the significant and major resource for the propagation and distribution of undesirable elements or malicious code.
For the reasons given above it is recommended that P2P file sharing applications are removed and any files acquired via this medium are deleted.

2 For some time your computer had been running with multiple old and vulnerable versions of Java, and you have experienced some difficulty in downloading/installing the latest more secure version (update20) Hopefully by uninstalling the older more vulnerable versions you have improved the security of your machine………but all the time you had the multiple older versions you were making things easier for the bad guys to get malicious code on to your computer.

2 It is clear that despite all the excellent actions taken so far, your computer still has multiple problems, slow start up, loss of sound and a "shaky" Internet connection, Some drivers are missing from your system including the Nvidea driver for your Network Adapter.
Your AVG may not be installed with 100% effectiveness……you had great problems in disabling it when asked to do so by Sweet Tech and this is often an indication of things not being quite right. You mentioned that you needed your sound back urgently and the quickest way is via the USB "soundcard" However I do appreciate your comments that you don't want to pay out for this and you want your machine "back to how it should be." The fact that you did not feel able to run ComboFix because of the warnings that your damaged system provided, despite Sweet Tech's assurances is disappointing…..as it would be a "tool of choice" to be used at
the appropriate time, on your computer under the supervision of a trained and trusted malware fighter like Sweet Tech

3 My best recommendation to you in view of all the circumstances is in two parts:

4 Part 1
Make sure that your back up copy archive of all that is important to you on this computer is 100% accurate, up to date reproducible and kept safe on removable media. Collect together all your Application installations discs and executable files for downloaded Programs (including the ones for Windows XP itself, with its Service Packs) and all the product serial keys………For Windows itself and also Microsoft Office this will be a 25 alpha-numeric in 5 grops of 5, for other applications the format will vary. It would also be wise to visit the website of your computer manufacturer and or motherboard manufacturer and download to removable media all the up to date drivers for your machine. If you have a manufacturer's restore disc and or drivers disc keep these safe as well.
If you have made a disc image using Ghost, Paragon or Acronis or one of the free disc imaging applications then also make sure this is to hand together with its boot disc.

4 Part 2
It's time now to make a decision….. to reload your operating system preferably formatting your C drive and reinstalling your stuff, so that you machine "is back to how it should be" or to carry on with trying to repair each individual component part.
My own view is that the format and reinstall is the most satisfactory way to go…. if you use a Microsoft XP installation disc then the install (after the format) will take about 45 minutes but to this you will need to add the time to copy across all your stuff from your back up, and reinstall your applications and update everything.

If you have your manufacturer's restore disc handy then the process will be shorter. If you have a good up to date disc image you can use then you can save a lot of time and effort and be up and running again in less time than it takes to walk the dog..
If however on reflection you decide that:
you would prefer to repair your computer by tackling each problem separately then please post back when you are happy that your back up is 100% accurate, complete and reliable and we will set out the next steps for you.

Please note there is no guarantee of success, as its impossible to say what damage has been done to your machine (without costly and time consuming forensic investigations) however we will do our best to help you as far as we can.
Regards
paws

Hello Paws, OK, in regards to P2P sharing i totally agree, they are a nightmare and the damage they can cause is just not worth the trouble, but unfortunately i have a son and daughter who were staying with me back then and i expect "L-wire" was installed then etc,, i soon uninstalled it when i found out!, but as you say the damage was done, i must point out that my PC still has my old hard drive installed, would you not think maybe there are issue's with the other hard drive as i have tried to keep the newer drive, as clean as possible?, i am sure i was using c:\ drive and now it says i am using D:\ could be wrong but i am sure you cannot change drives from c to d and vice versa…….. so not sure whats going on there, regarding your comments about running Combo-fix, i spent ages trying to use it, trying again and again to install and run it, every time i scanned it would start and scan like an English fuel pump clocking up the cost!, after an hour down to 1 searched file a second, after 5 or 6 hours what would you do?, happened on at least 3 attempts, another thing and that's all the apps are running at start up, i am sure that would interfere with scans? tried unchecking the ones not needed but . we can try Conmbo-fix again if you like? am open to any suggestions, From what i know the AVG Version i have installed is impossible to turn of, the only way to disable AVG is to completely uninstall it, an option i could not do as it was a paid version downloaded from AVG direct, so no install disc, i take note of your advice and would jump at the idea to gather up and save everything, and reformat, but i have no XP disc, from day one i argued with the shop/store they had not given it to me and they argued they did, the shop is owned by a friend of the family so had to bite my tongue, it may of got lost on the way back from the store but i doubt it, anyway no XP disc, have some of the disc's that came when new, but i would like to repair it and obviously would like to fix it myself, i am learning everyday, when i first came to WTT i had not a clue about how PCs operate, still don't but am slowly learning, is it possible that somehow the PC has jumped over to using d:/ drive for operating itself. you see when i bought the new PC i asked for my old hard drive to be installed as i had a lot of pictures and whatever on it, i was told no problem, they would put a desk top link so i could visit it and retrieve anything i need etc, i am so sure before i came to WTT for help C:/ hard drive was my main drive, now somehow it says D:/ is the drive, since the old drive came straight out of my old computer maybe this is why you say Java is so old, i remember Java updating regularly, only a week ago the latest Java update was waiting in the utility tray, so if you noticed out of date Java it must be from the old drive, so that doesn't seem right, i am sure something's not right here, as far as i am concerned the old drive can be either removed or made redundant, as i never use it!, what do you think?, Please remember i am a novice with computers so may appear slow especially with terminology. From what i read from your last post and what you say, it may be best to reformat?. but as i say this might now be a bit difficult due to the missing disk/s?, do you think/ is it possible to swap/change drives?, is it possible to change to the other drive to see if that cures these issues?. i wait your reply with anticipation.

Hi, Your c: drive contains Windows and applications……your d: drive has 19GB of stuff on it and its not possible for a Windows installations to "hop across" from a d: drive to a c: drive…this can only be done by actually installing Windows on the c: drive and this would take at least 45 minutes using a Microsoft Windows XP installation disc. As the shop is owned by a friend of the family there should be little difficulty in getting a copy of the Microsoft XP installation disc…… but it may be better to ask them to fix the problem for you, they will be able to do this in about 45 minutes or probably much less. (It's considerably easier fixing a machine when its on the bench and in front of the technician than it is by relaying instructions through another person and relying on their description of what is transpiring at any given time, and then following this up with the next set of instructions. If that plan of attack does not fit comfortably with you, then it would be best to borrow a Microsoft Windows XP installation disc from a chum, just make sure its for the same version. You will need to use your own product licence key (25 alpha-numeric in 5 groups of 5) so write it down now from the Certificate of Authenticity (COA) that is stuck to the outside of the computer's case, or it may be on the green Windows XP book that came with your machine. In the event that you can't find the COA in either of these places then post back and we will advise the next steps Regards paws

Hello Paws, Thank You for your reply, I have just looked, from what i can tell both Drives have "windows" installed on them, (D:/ was the old drive from my previous PC) i have a programme/app called "Power Suite" from Uniblue, In Power Suite there are three different apps, one is a PC Registry booster cleaner app, the second does a scan for windows errors, checks system junk files clears them etc, and supposedly says it speeds the PCs up?, the third is a comprehensive driver scanner that says it checks the whole computer for out of date drivers, coincidentally after i run the last scan it finds the same driver that keeps appearing in Device manager showing the yellow marker, under "Network adapters" the Nvidia 10/100/1000 Mbps Ethernet one previously mentioned, but on clicking it to install the latest driver and running a second driver scan it shows up again as out dated/ancient, i have emailed Uniblue to query the problem, but have not heard back from them yet with a response, anyway back to power suite, there is a section in Driver Scanner called settings, in settings there is one section that shows either C:/ DRIVE OR D:/ DRIVE it shows everything that's installed on each drive, in the list at the bottom of each drive it shows both as having "windows" i opened them both and there is a long list of windows programmes, system, java, etc etc about 50 or so listed, many are things i don't know about, as my system used c:/ before and now has reverted to d:/ drive, (since malware removal) would that not suggest why you noticed old versions of Java, lime-wire etc? i know Java was right up to date because i have updates set to ask permission first before install, the latest Java update was waiting in Utility tray on the day i first came on the forum about a week ago, When i queered this Java Update with SweetTech he said to ignore it and go to programmes Add/Remove and remove all Java manually, there were at least 6 different Java programmes there, mostly updates etc, anyway, one further thing, when i open the windows folders i notice they are different, d:/ has windows 7 IE only the other C:/ has WIN 7IE and 8IE, + there updates, re your last sentence about returning the PC back to the shop, although that would be possible it would mean at least a week without the PC as well as a 120 mile round trip, both of which would be a pain, also my copy of XP from memory they used my original version for the new PC, as to where the copy would be now i just don't know, i have asked a couple of friends and am waiting to hear back from them. i have the COA number you mention on a label on the back, so i have that, Is there anyway we can swap over back to C:/ drive and use that version of windows? or is that not how things work and am missing the point? as before there were no issue's with the things currently wrong today, sound, all processes running at start up, etc To date apart from device manager reporting 2 yellow check marks, the msconfig / process's in start up not letting me keep unchecked items unchecked after a restart, plus D:/ drive i think is running things, and sound not working on live streamed TV the PC is running as good as the first day i first turned it on, even with all 30 or so process's running at boot UP the PC is as quick to boot-up as it has ever been!, about 2 to 3 minutes. I would really like to sort it out myself with your help, i appreciate it is time consuming but i would be happy to pay a contribution to both yourself and to the forum, at least let me offer a beer or two towards your time?. i have learned a great deal since approaching WTT for help, understandably if you feel you can't help further i will have to book it in, never the less i would like to try and resolve these faults. With regards,

Hi, I will try to dela with each of the issues you raise:

I have just looked, from what i can tell both Drives have "windows" installed on them, (D:/ was the old drive from my previous PC) i have a programme/app called "Power Suite" from Uniblue, In Power Suite there are three different apps, one is a PC Registry booster cleaner app, the second does a scan for windows errors, checks system junk files clears them etc, and supposedly says it speeds the PCs up?, the third is a comprehensive driver scanner that says it checks the whole computer for out of date drivers, coincidentally after i run the last scan it finds the same driver that keeps appearing in Device manager showing the yellow marker, under "Network adapters" the Nvidia 10/100/1000 Mbps Ethernet one previously mentioned, but on clicking it to install the latest driver and running a second driver scan it shows up again as out dated/ancient, i have emailed Uniblue to query the problem, but have not heard back from them yet with a response

1 Forget the Nvidea driver for the time being, the fact that you are able to connect to the Internet at the moment means that its not at the top of our priority list (The nvidea driver is a network adapter driver (for connecting to the Internet) the fact that its' showing as "driveless" indicates just one more error/fault in your system)

anyway back to power suite, there is a section in Driver Scanner called settings, in settings there is one section that shows either C:/ DRIVE OR D:/ DRIVE it shows everything that's installed on each drive, in the list at the bottom of each drive it shows both as having "windows" i opened them both and there is a long list of windows programmes, system, java, etc etc about 50 or so listed, many are things i don't know about, as my system used c:/ before and now has reverted to d:/ drive, (since malware removal)

2 No that is not correct…you have 2 hard drives, C: and D:
C: is the active or boot drive and your operating system is working from this drive, using the Windows XP that is set up on it, Your D: drive has an older copy of Windows on it, (+some other things) and this older copy of Windows is not being used to run your machine. The malware removal supervised by Sweet Tech has not changed or reverted your system to D:

3 I suggest you Ignore the Java issues for the time being this is a bit of a "Red herring"

when i open the windows folders i notice they are different, d:/ has windows 7 IE only the other C:/ has WIN 7IE and 8IE, + there updates, re your last sentence about returning the PC back to the shop, although that would be possible it would mean at least a week without the PC as well as a 120 mile round trip, both of which would be a pain, also my copy of XP from memory they used my original version for the new PC, as to where the copy would be now i just don't know, i have asked a couple of friends and am waiting to hear back from them. i have the COA number you mention on a label on the back, so i have that,

4 Yes your comments about the C: drive and D:drive and the Internet Explorer versions make sense ….and that is the normal situation that one would expect.

Your computer seems to working effectively at the moment apart from your sound…if you really want to get your machine back to how it should be, then the trip back to the shop as its only 150 miles round trip and a week of time makes a lot of sense and is undoubtably the best course of action to take. It will have your machine back in running order in less time than it could take via the forum, and may well be less of a pain to you, and without the chances of causing further damage.
Opening the Windows folders is not recommended unless supervised by a tecnician or the user has a comprehensive understanding of what can be altered and what cannot (with safety)
The shop will have access to copies of the Microsoft Windows XP installations disc, so there is no problem there. The fact that you have a licensed copy of Windows, evidenced by the COA and its 25 alpha-numeric (5 groups of 5) licence key, for your machine means that there are unlikely to be any licensing problems. Your licence is evidenced by the COA….so even if you borrowed an identical installation disc from a chum this would be unlikely to produce a licensing problem (I hope this helps put your mind at rest)

Is there anyway we can swap over back to C:/ drive and use that version of windows? or is that not how things work and am missing the point? as before there were no issue's with the things currently wrong today, sound, all processes running at start up, etc

5 You are already using the C drive for your active boot drive………..YES the sound issue is unconnected with the D: drive…..( it may have worked OK in the past but its the C drive that is now running things and was running things well before Sweet Tech came on the scene……. I hope I have made this clear.

To date apart from device manager reporting 2 yellow check marks, the msconfig / process's in start up not letting me keep unchecked items unchecked after a restart, plus D:/ drive i think is running things, and sound not working on live streamed TV the PC is running as good as the first day i first turned it on, even with all 30 or so process's running at boot UP the PC is as quick to boot-up as it has ever been!, about 2 to 3 minutes.

6 That's good to hear…but remember its not the D :drive that's running things……. its the C: drive thats in charge!

I would really like to sort it out myself with your help, i appreciate it is time consuming but i would be happy to pay a contribution to both yourself and to the forum, at least let me offer a beer or two towards your time?. i have learned a great deal since approaching WTT for help, understandably if you feel you can't help further i will have to book it in, never the less i would like to try and resolve these faults.

7 I can appreciate your desire to get this sorted out and we will do as much as we can to help you……there is no problem with the time it will take from the WhatTheTech perspective, and I'm happy to stick with you until you have a resolution of the issues, there is no need to donate or even buy a beer (but the thought is good..and thanks) as we will help irrespective.(Having said that there is a link in my sig if you want to make a donation to WTT but this is entirely up to you and I would not want in any way to solicit a donation….)

My only reason for suggesting you go visit the shop is that I believe its truly in your best interests, and would provide the easiest, quickest and less painful resolution to the issues. However as always the choice is yours….it's your machine….. I must make you aware there is a reasonable to good chance that by operating at long range (using your eyes and fingers on the keyboard) as we are…… your machine could suffer even further damage and leave you worse off than you are now….I.E with a non working machine.

As long as you truly appreciate the risks, have a complete 100% accurate back up copy/archive of all your important files kept safe on removable media and your Microsoft XP installation disc readily to hand and all your application installation discs and serial numbers with dowloaded executables as appropriate, then I'm happy to proceed with helping you fix things manually.
However be aware that we may be in for a long haul and the trip to the shop is your best bet and my strong recommendation by far!
Regards
paws