[linspro]

Hi, tonight i have started hearing voices or ads on my pc. Now as i am writing this there are bleeps. Something is wrong. Iam not that great figuring this out . I need help please. My computer is new. Thank you.

[mich2212001]

Do u have antivirus installed?
do u have a third party firewall?
what windows version does your system has?
install malwrebytes & run a quick scan from http://download.cnet.com/3001-8022_4...rt=dl-10804572
install spybot & run from http://download.cnet.com/3001-8022_4...40d0f973429a26
install & run hijackthis from http://download.cnet.com/3001-20_4-1...4a4312d5dd799b
attach hijackthis, & malwarebytes logs with your next reply ( you have to click the go advanced button to do attachments)

[vivekair]

In Vista, when one closes Windows Media player 11 window, sometimes it hides and runs as a background process, still running the sound track.

all you have to do is open task manager and end the process named "wmplayer.exe".

if the problem still persists, you may need a firewall. I recommend kaspersky antivirus 8. it is highly efficient in removing any virus/ adware/ malware/ trojan activity.

[mich2212001]

Originally Posted by vivekair

In Vista, when one closes Windows Media player 11 window, sometimes it hides and runs as a background process, still running the sound track.

all you have to do is open task manager and end the process named "wmplayer.exe".

if the problem still persists, you may need a firewall. I recommend kaspersky antivirus 8. it is highly efficient in removing any virus/ adware/ malware/ trojan activity.

you couldn't be more off point than this i guess. the user talking about ads as advertisments sound the once you get from a website running pal ads.
if you have that Windows media player issue happening at your computer vivekair, then u need to check it out. but it's not the norm to do task manager to close WMP.

[linspro]

i hope i did this right. Im not that good at this. thank you

[mich2212001]

you forgot to attach malwarebytes logs.
was there anything found with scans from both malwarebytes & spybot

[linspro]

I did the spybot, and there were things and i deleted them. The malware said i had a 62 bit and would not scan all.

[mich2212001]

did u reboot after scan was done?

[mich2212001]

you mean Vista 64bit OS!!!
go ahead & reboot
also delete all temp files from systems by typing %temp%. that should open a folder with some files, please delete all
also delete internet temporary files from tools, internet options, browsing history delete, delete all, select the radio option for deleting offline files & click OK.

[mich2212001]

I'm looking at your log, u have too many tool bars installed, please remove all (maybe leave the google tool bar)
do u use AOL? if not please uninstall all AOL versions.
remove Advanced Registry Optimizer
reinstall the latest audio drivers (it seems like missing a .dll processing file

I'm investigating the following entries in your log

O4 - HKLM\..\Run: [qbuzwadleavrkfn] C:\Windows\System32\regsvr32.exe /s "C:\Windows\system32\gfgxnenzab.dll"

[linspro]

hi, thank you for all your help by the way. ok i think i deleted all temp files. i tryed to delete the ask toolbar. it will not let me. it says i have ie open but i dont. i scanned spybot again and all that came up was RIGHT MEDIA TRACKING COOKIE. i deleted it but scanned again and it was there. also i dont know how to reinstall audio drivers. thanks, lin oh by the way i do use aol.

[mich2212001]

right clikc your taskbar,select task manager, end process iexplorer (if there more than one, end all)
then try to remove all toolbars

[linspro]

thank you, that worked. still hearing background ads.

[linspro]

Malwarebytes' Anti-Malware 1.35
Database version: 1904
Windows 6.0.6001 Service Pack 1

3/26/2009 6:21:28 PM
mbam-log-2009-03-26 (18-21-28).txt

Scan type: Quick Scan
Objects scanned: 55940
Time elapsed: 1 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4d b7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{9e7c11a5-902b-d7af-ad58-66974e3d9c61} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9e7c11a5-902b-d7af-ad58-66974e3d9c61} (Adware.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbuzwadlea vrkfn (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explo rer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\SysWOW64\gfgxnenzab.dll (Trojan.Agent) -> Delete on reboot.

[Darknezz22]

To update the drivers open the Device Manager look for your "Sound, video and game controllers" double click it, than right click on your audio device and click on the "Update Driver Software" if there is more than one audio device update them all.