Solved Windows update and speakers fail

[sdms96825]

I was traveling for several weeks when (i) all of a sudden no sound came out of my laptop speakers. Also, (ii) my windows updates failed. I hooked up some external speakers and still no sound. I went to device manager and did not find any problems. I also tried a system restore but could not find a date prior to the problem. I copied down something called a cbs log but I don't understand it (it is supposed to tell me where the windows update problem is).

Any suggestions on these two issues (I am assuming that they are related).

Thank you.

 

[LookinAround]

i wonder if you might have a virus! As i've seen malware cause both the problems you describe (i.e. stop windows update and interfere with sound)

Start here for Virus/Malware removal Instructions Attach your logs for review in Malware removal forum

 

[filimarcus]

are you using Windows xp?, DID you Press F9 for safemode upon booting of the PC, if pressing the key brings you to safemode...choose safe mode options then it will ask YES to proceed on safe mode or NO to restore your system to an erlier time..choose NO rather to bring you in system restore

 

[sdms96825]

Thanks lookinaround. I have avst professional, but I will follow the 8 (or 6) steps just in case.

filimarcus, I am using vista ultimate, not XP

 

[LookinAround]

yes, i think would be wise.. In fact, i just looked at computer for someone who said
> Their sound stopped working
> When i looked at their machine i also noticed Windows update was failing. (They were running McAffee).
> Also, in their case, i noticed Windows started to hang on shutdown

And guess what? It was malware causing all the problems!

The malware pro's here helped me clean it all up
https://www.techspot.com/vb/topic151413.html#post920523

 

[sdms96825]

1. My avast! virus scan was clean.

2. I ran TFC.

3. I have attached the Malwarebytes log.

4. I had problems running the GMER and then ran it in safe mode. Then it crashed. I have attached a copy of the crash log. I did not proceed any further.

What do I do next?

Thank you.

 

[LookinAround]

Normally, the malware logs and stuff should be posted in the Malware Forum where the Malware experts "hang out".. but i'll ask one of the mods to move the thread there. So hang tight for now.

 

[Broni]

Hi
I'll surely make sure, your computer is clean, but regarding your sound issues, you may need to create new topic (later) in appropriate forum.

I still need DDS logs.

 

[sdms96825]

Broni,

Should I just skip the GMER scan and proceed with obtaining the DDS logs?

Can you tell why the GMER scan is failing?

Thank you.

 

[Broni]

Yes, skip GMER.
It's a very aggressive scanner and sometimes will fail to run.
No reason for any concern. We have plenty of tools to go around it.

 

[sdms96825]

Broni,

Please see the attached logs from DDS.

 

[Broni]

Please, never zip any logs.

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

====================================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
   NOTE1. If Combofix asks you to install Recovery Console, please allow it.
   NOTE 2. If Combofix asks you to update the program, always do so.
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

 

[sdms96825]

Broni,

I ran the MBR Check and it says it found a non-standard or infected MBR. It then asks me if I want to enter Y for more options or N to exit. What do you want me to do?

 

[Broni]

As my instructions say, I need to see the log.

 

[sdms96825]

Here is the MBR log.

 

[Broni]

Run MBRCheck again.

When it's done you'll see the following line:
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Press the Y key and then press Enter

When the program asks you to Enter your choice, enter 2 and press the Enter key.

Next the program will ask you to Enter the physical disk number to fix (0-99, -1 to cancel):
Enter 0 (zero) and press the Enter key.

Next the program will show Available MBR codes:, followed by a list of operating systems.
Please enter 3 for Windows Vista, and then press Enter.

Next the program will prompt for confirmation.
Type YES and hit Enter.

When it's done there should be a text file with the results on your desktop.
Please copy and paste it back here.

Then reboot, run MBRCheck again and post new log.

 

[sdms96825]

Broni,

I was running the ComboFix as you recommended in the previous post, but it gives me a warning that avast antivirus and antispyware 4.8.1229 are running. I don't know why since I right clicked on the avast icon and turned it off. Also, my current version is 4.8.1338.

1. How do I remove the 4.8.1229 which are running?
2. How do I stop the ComboFix from scanning once I have clicked on it?

Thanks.

 

[Broni]

1. If you did, what you could, disregard warnings.
2. Let's finish the scan.

 

[sdms96825]

Hi Bironi,

Here is the combofix.txt and the two latest MBRcheck logs -- one following the instructions and the second one after the reboot.

I tried to run the GMER scan overnight -- after 16 hours it had only made it just past the IAT/EAT (whatever that is).

I am also starting to notice several "desktop.ini" icons appearing on my desktop. This is something new and I notice on my readyboost flash drive that there is such an icon in the "Files ready to be written to the disk" Is this related to anything we have been doing?

Thank you.

 

[Broni]

Our MBR fix didn't work....
We have to use another way to do it...

Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)

• Place a blank CD in your CD drive.
• Double click on NTBR_CD.exe file and a folder of the same name will appear.
• Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
• Follow the prompts to burn the CD.

• Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
• If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.

• Insert the newly created CD into your infected PC and reboot your computer.
• Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
• Read the warning and then continue as prompted.
• You first need to select your keyboard layout - press Enter for English.
• Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
• On the following screen enter 5 to select Install Standard MBR code.
• Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
• When asked to confirm please do so.
• Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
• Eject the disc and then press ctrl+alt+del to reboot the PC.

Once rebooted run MBRCheck one more time and let me have the log produced.

 

[Broni]

I am also starting to notice several "desktop.ini" icons appearing on my desktop

Make sure, system file view (Windows Explorer>Tools>Folder options>View tab) is disabled.

 

[sdms96825]

Bironi,

Thank you for taking the time to work with me on this.

"If you have any questions about this step, ask before you proceed."

1. I put a CD-RW disk in the drive, but it asks me if I want to format it as "mastered" or "live file system". Which should I choose?

2. I do not know how to make the CD as a first boot device. I read the link, but I got lost on the first section where it said "check the boot screen for setup key" To my knowledge, I have never seen a boot screen. How do I find this?

3. I notice that if I click on the windows thing in the bottom left corner, it no longer gives me an option to "Run". Somehow I have lost it.

 

[Broni]

I put a CD-RW disk in the drive

It must be CD-R, not CD-RW.

I got lost on the first section where it said "check the boot screen for setup key" To my knowledge, I have never seen a boot screen. How do I find this?

Turn the computer on and watch the bottom of the screen closely.
You'll see something like:
"Press <some key> to enter setup"
or
<some key> - setup

When you press that <some key>, you'll enter BIOS.

it no longer gives me an option to "Run". Somehow I have lost it.

We'll try to fix it later. For now, you can get "Run" command by pressing Windows logo key + R

 

[sdms96825]

Hi Bironi,

I obtained a CD-R disk but it asks me the same question to prepare the disk -- should the format be "mastered" or "live file system"?

 

[Broni]

At what point out of this initial steps does it happen?

Place a blank CD in your CD drive.
Double click on NTBR_CD.exe file and a folder of the same name will appear.
Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
Follow the prompts to burn the CD.