jbclem
Topic Starter
Yesterday I wanted to install a different sound card, Turtle Beach Santa Cruz. But everytime I tried to install it the drivers would disappear and the sound card would never show up in Device Manager, even though Plug and Play was recognizing it, and the drivers were being installed from the CD that came with it. In Device Manager (Win2000 btw) I found another sound card listed, but it was not one I had installed previously. I had a Sound Blaster 16 installed, but here was this Yamaha DS1 device listed. I tried to uninstall it's drivers, I tried to uninstall the deviceā¦but every time it reappeared after a reboot, even when I re-installed the Turtle Beach sound card. I then went after the Yamaha drivers, and found and deleted two main ones, gameenum.sys and ds1wdm.sys. But surprisingly, they would reappear about 5 seconds after I deleted them. And I deleted them(or renamed them) from every place I could find in my hard drives. They were located in system32\drivers, system32\dllcache, and in a couple of other places.
Then I went through the registry and deleted every key value or key with the word Yamaha. There were a couple hundred of these, and I found there were about about 10-20 Yamaha keys that would not allow the deletion, showing a message "unable to delete all specified values".
Running Rootkit Revealer found some key names with embedded nuls, and their names (SAC and SAI) matched some of the many many(up to 34 at a time) registry subfolders(keys?) that I deleted that contained the Yamaha name. They were in HKLM|\Security\PlolicySecrets\SAC or \SAI. Also found an access denied key, another embedded nuls key(also under PolicySecrets). And a couple of data mismatch ones.
I'm new at this Rootkit game and not sure what to do. And really not sure how to delete a registry key that wouldn't allow me to. I need to ask for some help and especially some direction in this. I'm using Win2000, FAT32.
And I forgot to mention, for months I've been noticing on bootup that two copies of Wnmgmt.exe run, and one of them uses up to 90% cpu precessing power and then disappears after 1-2 minutes. I can hardly do anything during this 1-2 minutes because this file is dominating. Perhaps there's a connection.
Regards, jc