Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

taskbar, start menu & volumne control unresponsive in XP


  • This topic is locked This topic is locked
7 replies to this topic

#1 gspto52

gspto52

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 18 April 2010 - 04:06 PM

Hi! Hope someone can offer some insight on this for my son & me......

He had no issues until yesterday when he turned on his computer. Everything seemed to boot up just fine but within 30 seconds of desktop loading, he noticed that his speaker volumne icon was not present on lower right of taskbar. Then he noticed when he opened any program or file, it, too, was not showing on taskbar. Start menu would open but can't click on anything to open - all were totally unresponsive.

Not sure if it is hardware, software or viral related. Knowing he does a lot of peer-to-peer sites, I booted up in "safe mode with networking" today and downloaded free Malwarebytes as I have had success with this program in the past on my daughter's computer. Running full scan uncovered 10 infected files and/or registry keys (can supply a copy of log if requested). All entries were quarantined & removed

Did recommended restart & still had same issues.. Ran a quick scan this time that showed no infections. Then son decided to run a full scan again and told me that shortly after starting full scan, volumne control appeared, task bar showed open program (malwarebytes) and start menu was clickable/openable. At the end of this full scan, it only found one infected file - C: volumne control. I clicked ok to remove, which it did. Then I was prompted to restart computer. Viola! Same thing all over again!!!

Have run full scan for a THIRD time today, it found the same one issue with volumne. I have clicked to remove, but have ignored restarted the system! Everything appears to be working just fine at the moment ----- as long as we don't do a restart & keep the computer running!

The pc is not that old less than a year o very little over - it's an iBuyPower custom build. He primarily uses Mozilla Firefox as his browser. Can give more info (hopefully) if needed.....

Anyone have any other suggestions or input? Like I said, not sure if we are looking at infection or system failure.

Your help will be GREATLY appreciated!

Thanx/

BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 55,248 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:30 PM

Posted 18 April 2010 - 04:31 PM

I guess I'd like to know...are you using just Malwarebytes to do scans?

No installed/updated AV program?

No antispyware program, such as SUPERAntiSpyware?

Run chkdsk /r on the system partition afterward, attempting to overcome any damaged files which may have occurred during removal efforts?

There is nothing that removes all forms of malware...other than possibly a clean install, IMO. No one product does it all.

At the minimum...I'd run chkdsk /r and sfc /scannow...to assure myself these are not cases of damaged/missing system files. I'd try to take the O/S out of the list of suspects.

Louis

#3 gspto52

gspto52
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 18 April 2010 - 04:58 PM

Louis:

Sorry- I did forget to mention that he was running AVG on computer. It's scan found nothing infected which is why I downloaded & ran Malwarebytes, as I realize also that no one program is capable of finding everything.

Will run the other two scans you mentioned & advise of results.

#4 gspto52

gspto52
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 18 April 2010 - 05:43 PM

have tried running chkdsk/r under "safe mode with command prompt" and also going "my computer - "C" check for errors" in normal mode. Both times I get error message that it can't be run because processes are running, would I like to have it run on restart. I indicate yes & restart computer but not noticing anything happening that would indicate a scan of any kind is in process. I have also tried through normal mode, start menu/run with same results.

What am I doing wrong? I have never attempted this command before and may not be understanding how to execute it or what I should be looking for to know that it is actually doing anything.

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,248 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:30 PM

Posted 18 April 2010 - 06:02 PM

This is an easy way to start it, just follow the directions for 1 under Starting Check Disk, http://www.hard-drive-help.com/chkdsk.html. No need to go to 2. Put check marks in both options (Automatically fix and Scan for).

More info on function, http://vlaurie.com/computers2/Articles/chkdsk.htm.

Info on sfc /scannow command: How To Use Sfc.exe To Repair System Files - http://www.bleepingcomputer.com/forums/t/43051/how-to-use-sfcexe-to-repair-system-files/.

You will need to reboot the system for the command to execute. It will run before the system boots into XP...system will automatically boot into XP when command has completed its work.

If any error messages come up and it's prevented from running or completing...please write such down and post them here.

Louis

#6 gspto52

gspto52
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:09:30 PM

Posted 18 April 2010 - 11:00 PM

After a long evening of trying to figure all this out - this is what I know (which ain't much!)

1. ran another scan with Malwarebytes and it found nothing, but problem persisted.

2. downloaded SUPERAntispyware, ran it & it found the following:
Trojan Agent/Gen-FakeAlert(Client Notify)
found it in the following: Files - C:\\Windows\System 32\Autocnfg.DLL
Programs - C:\\Windows\system32\Autocnf.DLL

I had it removed & quarantined. Did a restart, same results - no speaker icon on taskbar, within 30 secs of Windows loading - taskbar totally unresponsive. However, after about 20 minuites, everything unlocked itself, speaker icon reappeared, had sound could access Start Menu and open programs appeared in taskbar.

3. Went to My Computer/C:/properties/tools and ran chkdsk after checking both boxes. Only window to pop up was the one saying disk check utility needed exclusive access, need to restart. After restarting, chkdsk did scan. After 1-1/2 hours, it completed all 5 stages and found nothing. When Windows booted up after scan, same problem.

4. Tried to get into Start Menu/run/msconfg but taskbar froze up before I could complete. Waited 45 minutes & it still did not correct itself, so restarted pc. On resart, still no access to taskbar, speaker icon, etc. but it unlocked itself after about 10 minutes so I could check startup under MSCONFG. Most everything there was as it should be, but found 3 entries son was not familiar with:

Rwiz
urofoqiw.dll
monxga32

did an internet search and only found info on the last one and not much on that. Seems it started appearing around the 10th of this month and general feeling is that it is spyware. I unchecked all 3 items from startup, hit apply and did requested re-start. Still the same problem........(this is getting old). Waited about 10 minutes, it unlocked itself - I accessed startup under MSCONFG - Rwiz was not running but other two had duplicated themselves and were running again.

That's where I am right now. Told son no more tonight.....

#7 keyboardNinja

keyboardNinja

    Bleepin' Ninja


  • BC Advisor
  • 4,815 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:teh interwebz
  • Local time:08:30 PM

Posted 18 April 2010 - 11:02 PM

Please post a Posted Image in the Am I infected? What do I do? sub-forum with a description of your problem, the steps taken so far, and a link back to this topic (they will want to know why you suspect malware).

Please note: the Malware Response team are always overwhelmed, and it could take a few days to get your first reply. Just be patient and don't "bump" your topic by replying to it, as that will only further delay a response (MRT members are looking for topics with 0 replies...if you reply to your own first, it will appear that you are already receiving help and thus delay receiving actual help).

If you still have problems after being declared clean, they'll send you back here.

Good luck. :thumbsup:
PICNIC - Problem In Chair, Not In Computer

Posted Image Posted Image

20 Things I Learned About Browsers and the Web

#8 hamluis

hamluis

    Moderator


  • Moderator
  • 55,248 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:09:30 PM

Posted 19 April 2010 - 07:07 AM

Now that you have posted in the Am I Infected Forum, Here, I am closing this thread to prevent possible confusion and conflicting suggestions.

Please take all instructions from the appropriate personnel in the AII forum, as we attempt to resolve suspected malware issues.

This thread is now closed.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users