Original forum post
Hi! I was directed to re-post this in this forum. Hope someone can offer some insight on this for my son & me......
He had no issues until yesterday when he turned on his computer. Everything seemed to boot up just fine but within 30 seconds of desktop loading, he noticed that his speaker volumne icon was not present on lower right of taskbar. Then he noticed when he opened any program or file, it, too, was not showing on taskbar. Start menu would open but can't click on anything to open - all were totally unresponsive.
Not sure if it is hardware, software or viral related. Knowing he does a lot of peer-to-peer sites, I booted up in "safe mode with networking" today and downloaded free Malwarebytes as I have had success with this program in the past on my daughter's computer. Running full scan uncovered 10 infected files and/or registry keys (can supply a copy of log if requested). All entries were quarantined & removed
Did recommended restart & still had same issues.. Ran a quick scan this time that showed no infections. Then son decided to run a full scan again and told me that shortly after starting full scan, volumne control appeared, task bar showed open program (malwarebytes) and start menu was clickable/openable. At the end of this full scan, it only found one infected file - C: volumne control. I clicked ok to remove, which it did. Then I was prompted to restart computer. Viola! Same thing all over again!!!
Have run full scan for a THIRD time today, it found the same one issue with volumne. I have clicked to remove, but have ignored restarted the system! Everything appears to be working just fine at the moment ----- as long as we don't do a restart & keep the computer running!
The pc is not that old less than a year o very little over - it's an iBuyPower custom build. He primarily uses Mozilla Firefox as his browser. He is running Avast, which has been updated. Can give more info (hopefully) if needed.....
I was told by one of the moderators to run CHKDSK.
After a long evening of trying to figure all this out - this is what I know (which ain't much!)
1. ran another scan with Malwarebytes and it found nothing, but problem persisted.
2. downloaded SUPERAntispyware, ran it & it found the following:
Trojan Agent/Gen-FakeAlert(Client Notify)
found it in the following: Files - C:\\Windows\System 32\Autocnfg.DLL
Programs - C:\\Windows\system32\Autocnf.DLL
I had it removed & quarantined. Did a restart, same results - no speaker icon on taskbar, within 30 secs of Windows loading - taskbar totally unresponsive. However, after about 20 minuites, everything unlocked itself, speaker icon reappeared, had sound could access Start Menu and open programs appeared in taskbar.
3. Went to My Computer/C:/properties/tools and ran chkdsk after checking both boxes. Only window to pop up was the one saying disk check utility needed exclusive access, need to restart. After restarting, chkdsk did scan. After 1-1/2 hours, it completed all 5 stages and found nothing. When Windows booted up after scan, same problem.
4. Tried to get into Start Menu/run/msconfg but taskbar froze up before I could complete. Waited 45 minutes & it still did not correct itself, so restarted pc. On resart, still no access to taskbar, speaker icon, etc. but it unlocked itself after about 10 minutes so I could check startup under MSCONFG. Most everything there was as it should be, but found 3 entries son was not familiar with:
did an internet search and only found info on the last one and not much on that. Seems it started appearing around the 10th of this month and general feeling is that it is spyware. I unchecked all 3 items from startup, hit apply and did requested re-start. Still the same problem........(this is getting old). Waited about 10 minutes, it unlocked itself - I accessed startup under MSCONFG - Rwiz was not running but other two had duplicated themselves and were running again.
That's where I am right now. Told son no more tonight.....
Anyone have any other suggestions or input? Like I said, not sure if we are looking at infection or system failure.
Your help will be GREATLY appreciated!