What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Beeping malware

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Well, like I said I dont see it fully installed but we can remove the remnants of it.

Open OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :processes
killallprocesses

:OTL
SRV - (CLTNetCnService) – File not found

:Services

:Reg

:Files
ipconfig /flushdns /c


:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top. <–Not run Scan
  • Let the program run unhindered, reboot when it is done
  • Then post the results of the log it produces.
Post #17
Ken, I am sorry for giving you hard time. I ran as you instructed the OTL with the above code but wihle resetting the host I had this message: "Cannot create file C:\windows\system32\drivers\etc\hosts" and the machine freezed and when relogged in again, this is what have been produced: —————————————– Files\Folders moved on Reboot… Registry entries deleted on Reboot… ————————–
Post #18
Hi Qamaronn,

My name is Jeff. Ken is unavailable right now and I will continue helping you until his return. I hope that is ok. :) Let's see about getting that hosts file fixed.

Please download ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
———-

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:Processes
killallprocesses

:OTL
O1 HOSTS File: ([2011/10/01 14:58:47 | 000,000,763 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
SRV - (CLTNetCnService) – File not found

:Files
ipconfig flushdns /c

:Reg

:Commands
[resethosts]
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post the results of the log it produces.
Post #19
Hi Jeff, I tried to run ERUNT as Adminstrator but it produced an error about: ——————————————— C:\Program Files\ERUNT\unins000.exe An error occured while trying to rename a file in the destination directory: MoveFile failed; code5. Access is denied. Click Retry to try again, Ignore to skip this file (not recommended), or Abort to cancel installation. With options to Abort, Try, and Ignore ——————————————— Should I try to run OTL in safe mode with Networking? Please let me know.
Post #20
Hi Qamaronn,

Should I try to run OTL in safe mode with Networking?

Sure go ahead. When OTL creates a new log post that into your next reply. :)
Post #21
Here is the produced log from OTL ran in safe mode with networking:
————————————————————————————
All processes killed
========== SERVICES/DRIVERS ==========
========== PROCESSES ==========
========== OTL ==========
Error: No service named CLTNetCnService was found to stop!
Service\Driver key CLTNetCnService not found.
File File not found not found.
========== FILES ==========
< ipconfig flushdns /c >
Error: unrecognized or incomplete command line.
USAGE:
ipconfig [/allcompartments] [/? | /all |
/renew [adapter] | /release [adapter] |
/renew6 [adapter] | /release6 [adapter] |
/flushdns | /displaydns | /registerdns |
/showclassid adapter |
/setclassid adapter [classid] ]
where
adapter Connection name
(wildcard characters * and ? allowed, see examples)
Options:
/? Display this help message
/all Display full configuration information.
/allcompartments Display information for all compartments.
/release Release the IPv4 address for the specified adapter.
/release6 Release the IPv6 address for the specified adapter.
/renew Renew the IPv4 address for the specified adapter.
/renew6 Renew the IPv6 address for the specified adapter.
/flushdns Purges the DNS Resolver cache.
/registerdns Refreshes all DHCP leases and re-registers DNS names
/displaydns Display the contents of the DNS Resolver Cache.
/showclassid Displays all the dhcp class IDs allowed for adapter.
/setclassid Modifies the dhcp class id.
The default is to display only the IP address, subnet mask and
default gateway for each adapter bound to TCP/IP.
For Release and Renew, if no adapter name is specified, then the IP address
leases for all adapters bound to TCP/IP will be released or renewed.
For Setclassid, if no ClassId is specified, then the ClassId is removed.
Examples:
> ipconfig … Show information
> ipconfig /all … Show detailed information
> ipconfig /renew … renew all adapters
> ipconfig /renew EL* … renew any connection that has its
name starting with EL
> ipconfig /release *Con* … release all matching connections,
eg. "Local Area Connection 1" or
"Local Area Connection 2"
> ipconfig /allcompartments … Show information about all
compartments
> ipconfig /allcompartments /all … Show detailed information about all
compartments
C:\Users\Baladi\Desktop\Fix\cmd.bat deleted successfully.
C:\Users\Baladi\Desktop\Fix\cmd.txt deleted successfully.
========== REGISTRY ==========
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Baladi
->Temp folder emptied: 6387546 bytes
->Temporary Internet Files folder emptied: 34720052 bytes
->Flash cache emptied: 1993 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 144684874 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 7925200 bytes

Total Files Cleaned = 185.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 11052011_164101

Files\Folders moved on Reboot…
File\Folder C:\Users\Baladi\AppData\Local\Temp\~DF43BF.tmp not found!
File\Folder C:\Users\Baladi\AppData\Local\Temp\~DF43C4.tmp not found!
File\Folder C:\Users\Baladi\AppData\Local\Temp\~DF440B.tmp not found!
File\Folder C:\Users\Baladi\AppData\Local\Temp\~DF4411.tmp not found!
File\Folder C:\Users\Baladi\AppData\Local\Temp\~DF4436.tmp not found!
File\Folder C:\Users\Baladi\AppData\Local\Temp\~DF443B.tmp not found!
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ESXXLWMA\a0258ec102ffc3a8f0a36bca302726de_1[1].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ESXXLWMA\aclk[1].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ESXXLWMA\data_sync[1].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ESXXLWMA\iframe[2].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ESXXLWMA\pixel_details[1].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1J4YYZIB\ads[2].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1J4YYZIB\ads[3].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1J4YYZIB\ads[4].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1J4YYZIB\index[2].htm moved successfully.
C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0F2V9LN3\ads[2].htm moved successfully.
File move failed. C:\Users\Baladi\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat scheduled to be moved on reboot.

Registry entries deleted on Reboot…

————————————————————————————
Post #22
Hi Qamaronn,

First open an elevated command prompt > Click Start and type cmd in Start Search.
When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.


Copy the contents of the code box > right click in the command window and select paste
ipconfig /flushdns
Press Enter
Close the Command Prompt window.
———-

Please download Malwarebytes' Anti-Malware to your desktop.

  • Right-click and Run as Administrator mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.


The log can also be found here:
C:\Documents and Settings\\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.
  • Do not use this instance of your browser for anything besides doing this scan
  • When the scan is complete and the results saved, close that instance of your browser
  • Open a new one the usual way and post the results in this topic.


  • Right-click and Run as Administartor on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
———-

In your next reply please post the logs created by Malwarebytes and ESET online scanner. :)
Post #23
Hi Jeff, I have been able to run the cmd prompt: Here is the log: ——————————————– Microsoft Windows [Version 6.0.6002] Copyright © 2006 Microsoft Corporation. All rights reserved. C:\Windows\system32>ipconfig /flushdns Windows IP Configuration Successfully flushed the DNS Resolver Cache. C:\Windows\system32> ——————————————– Then I ran mbam-setup.exe as an Adminstrator but I got this error: ——————————————– C:\Program Files\Malwarebytes' Anti-Malware\mbamext-32.dll An error occured while trying to rename a file in the destination directory: MoveFile failed; code5. Access is denied. Click Retry to try again, Ignore to skip this file (not recommended), or Abort to cancel installation. With options to Abort, Try, and Ignore ——————————————– Should I continue with ESET?
Post #24
Hi Qamaronn,

Go ahead and run ESET online scan.
——-

I think that we need to run the Symantec removal tool to remove all leftovers. Please download and run this tool >> Tool
———–

Once you get that complete please try to run Malwarebytes again. :)

In your next reply please let me know if you have any troubles using the Symantec removal tool and post the logs created by Malwarebytes and ESET online scanner.
Post #25
Hi Jeff, I ran ESET and it said “No Threat Found”. Then, I downloaded Norton Removal Tool and rebooted. And I have been able to download and run Malwarebytes. Here is the log: ———————————————————- Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8099 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.19154 06/11/2011 4:47:40 PM mbam-log-2011-11-06 (16-47-39).txt Scan type: Quick scan Objects scanned: 159583 Time elapsed: 9 minute(s), 33 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ———————————————————- The results shows nothing as mal-ware but the beeping is still performing unwanted symphonies.
Post #26
Hi Qamaronn,

I am not finding any evidence of malware.

Download TFC to your desktop
  • Close any open windows.
  • Right-click and Run as Administrator the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
———-

Lets also defragment your system. :)

Go to Start > All Programs > Accessories > System Tools > Disk Defragmenter > Defragment Now

Once Disk Defragmenter starts it may take some time to complete so just let it run.
———-

When you get that completed let me know. :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI