Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News:    Thousands of Compromised WordPress Sites Redirect to Tech Support Scams

Featured Deal: Get 96% off a Xamarin Cross Platform Development Bundle Deal

Photo

Random explicit sound playing without acknowledgement

Started by M4rf , Jun 19 2016 04:25 PM

  • Please log in to reply
13 replies to this topic

#1 M4rf

M4rf

  • Members
  • 6 posts
  • OFFLINE
    •  
  • Local time:09:55 PM

Posted 19 June 2016 - 04:25 PM

So, ever since yesterday, i have a sound effect played every 10 or so minutes saying in a light joking voice: "hehe, **** you right in the *******. At first i thought it was someone in Discord, but i closed all apps, and the SFX is still playing every 10 or so minutes. I ran with MB and N360, nothing found. May i get some help?

Oh and also, MB has rootkit check and everything else on.
I also ran ADWCleaner and nothing found.

Edited by M4rf, 19 June 2016 - 04:31 PM.

BC AdBot (Login to Remove)

 

#2 TheTripleDeuce

TheTripleDeuce

  • Members
  • 275 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Canada EH!
  • Local time:05:55 PM

Posted 19 June 2016 - 04:33 PM

sounds like someone just changed a system sound to a audio file

 

try go into control panel and sounds and turn system sounds off see if it still happens


Edited by TheTripleDeuce, 19 June 2016 - 04:34 PM.

#3 M4rf

M4rf
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
    •  
  • Local time:09:55 PM

Posted 19 June 2016 - 04:48 PM

sounds like someone just changed a system sound to a audio file
 
try go into control panel and sounds and turn system sounds off see if it still happens

Alright, will do. But what system sfx would be set for ten minutes and repeat?

#4 TheTripleDeuce

TheTripleDeuce

  • Members
  • 275 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Canada EH!
  • Local time:05:55 PM

Posted 19 June 2016 - 04:50 PM

it could be anything not necessarily scheduled however you can check to see if there is a scheduled event by doing this:

 

Open Task Scheduler by clicking the Start button 4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818, clicking Control Panel, clicking System and Security, clicking Administrative Tools, and then double-clicking Task Scheduler.‌ 18abb370-ac1e-4b6b-b663-e028a75bf05b_48. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

 

if there is anything scheduled in there it could be one of those simply click on what you suspect it to be and see when the next event is scheduled to happen if it is 10ish minutes from when you check you've found the culprit

 

try disabling all start up items (winkey +r, msconfig (windows 7/8/8.1)(windows 10 right click start button go to task manager) and go to start up disable everything, reboot pc see if it continues


Edited by TheTripleDeuce, 19 June 2016 - 04:52 PM.

#5 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
    •  
  • Gender:Male
  • Local time:03:55 PM

Posted 19 June 2016 - 04:52 PM

Adware Cleaner Scan.

 

Please download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

 

JRT Scan.

Please download Junkware Removal Tool and save it on your desktop.

 

  • Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log is saved to your desktop and will automatically open.
  • Please post the JRT log.
  •  

Adware Removal Tool Scan.

 

Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.

 

 

LOr0Gd7.png

 

Hit Ok.

 

sYFsqHx.png

 

Hit next make sure to leave all items checked, for removal.

 

8NcZjGc.png

 

 

The Program will close all open programs to complete the removal, so save any work and hit OK. Then hit OK after the removal process is complete, thenOK again to finish up. Post log generated by tool.

 

ZHP Scan.

Please download Zhp Cleaner  to your desktop.  Right Click the icon and select run as administrator.

http://ccm.net/download/download-24750-zhpcleaner

 

 

2. Once you have started the program, you will need to click the scanner button.

EgsT69u.png

The program will close all open browsers!

3. Once the scan is completed, the you will want to click the Repair button.

6QJjV50.png

At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.

Copy and paste the report here in your next reply.

 Zemana Scan

 

 

Run a full scan with Zemana AntiMalware!

Install and select deep scan.

jdmyscF.jpg

Remove any infections found.

Then click on the icon in the pic below.

DOLGyto.jpg

Double click on the scan log, copy and paste here in your reply


#6 M4rf

M4rf
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
    •  
  • Local time:09:55 PM

Posted 19 June 2016 - 05:07 PM

I actually figured it out myself. I apologize for wasting your time and effort towards my issue. I opened rkill so it could terminate processes. It found one. As that happened, i open adwcleaner, and it found a file which had the little explicit sound effect in it. It was deleted. Thanks for the help though!

Please lock this @mods.

#7 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
    •  
  • Gender:Male
  • Local time:03:55 PM

Posted 19 June 2016 - 05:10 PM

Thanks for letting us know. :)


#8 TheTripleDeuce

TheTripleDeuce

  • Members
  • 275 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Canada EH!
  • Local time:05:55 PM

Posted 19 June 2016 - 05:12 PM

happy its resolved, care to say what it was that was playing the sound? just curious


#9 M4rf

M4rf
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
    •  
  • Local time:09:55 PM

Posted 19 June 2016 - 05:16 PM

It was a process in the task manager. It was a client of some source. Rkill caught this in system32: HPSIsvc.exe (PID: 2296) [WD-HEUR] whatever that means

Not sure it was that but im happy its gone, tbh.

Edited by M4rf, 19 June 2016 - 05:17 PM.

#10 TheTripleDeuce

TheTripleDeuce

  • Members
  • 275 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Canada EH!
  • Local time:05:55 PM

Posted 19 June 2016 - 05:18 PM

its odd that would be the source of the issue:

http://www.file.net/process/hpsisvc.exe.html

 

looks like a smart installer from HP


#11 M4rf

M4rf
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
    •  
  • Local time:09:55 PM

Posted 19 June 2016 - 05:26 PM

its odd that would be the source of the issue:
http://www.file.net/process/hpsisvc.exe.html
Hmmm. Thats very odd. Realy.
 
looks like a smart installer from HP


#12 TheTripleDeuce

TheTripleDeuce

  • Members
  • 275 posts
  • OFFLINE
    •  
  • Gender:Male
  • Location:Canada EH!
  • Local time:05:55 PM

Posted 19 June 2016 - 05:33 PM

you may have a bigger issue, try doing what InadequateInfirmity suggested see if anything else rears its head


#13 M4rf

M4rf
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
    •  
  • Local time:09:55 PM

Posted 19 June 2016 - 07:43 PM

you may have a bigger issue, try doing what InadequateInfirmity suggested see if anything else rears its head

I did what he suggested minus the adwcleaner since that was already done and this is what i got:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 10 Pro x64 
Ran by ([Removed by Poster])(Administrator) on Sun 06/19/2016 at 20:20:34.87
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
File System: 9 
 
Successfully deleted: C:\ProgramData\iobit\driver booster (Folder) 
Successfully deleted: C:\ProgramData\productdata (Folder) 
Successfully deleted: C:\Users\(removed)\AppData\Local\crashrpt (Folder) 
Successfully deleted: C:\Users\(removed)\AppData\Roaming\iobit\driver booster (Folder) 
Successfully deleted: C:\Users\(removed)\AppData\Roaming\productdata (Folder) 
Successfully deleted: C:\Users\(removed)\Documents\add-in express (Folder) 
Successfully deleted: C:\WINDOWS\system32\Tasks\Driver Booster SkipUAC ([removed]) (Task)
Successfully deleted: C:\WINDOWS\system32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 (Task)
Successfully deleted: C:\WINDOWS\prefetch\GOOGLETOOLBARNOTIFIER.EXE-7AE0A20E.pf (File) 
 
 
 
Registry: 0 
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 06/19/2016 at 20:24:48.61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
now with adware removal tool:
PUP.anchorfree ->> Registry Key ->> HKEY_CURRENT_USER\SOFTWARE\ <RegKey:> AnchorFree
PUP.hotspot shield ->> Registry Data ->> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4831abc_0\ <RegValue:>  <RegData:> {0.0.0.00000000}.{2cf3654e-4d08-45cc-959d-c0c22486d140}|\Device\HarddiskVolume2\Program Files (x86)\Hotspot Shield\bin\FBW.exe%b{00000000-0000-0000-0000-000000000000}
PUP.hotspot shield ->> Registry Data ->> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\e4831abc_0\ <RegValue:>  <RegData:> {0.0.0.00000000}.{2cf3654e-4d08-45cc-959d-c0c22486d140}|\Device\HarddiskVolume2\Program Files (x86)\Hotspot Shield\bin\FBW.exe%b{00000000-0000-0000-0000-000000000000}
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
 

I would use zhpcleaner, but it was removed from comp by n360. is it a false positive?


#14 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
    •  
  • Gender:Male
  • Local time:03:55 PM

Posted 19 June 2016 - 07:47 PM

I would use zhpcleaner, but it was removed from comp by n360. is it a false positive?

 

Yes, the file is safe.


Back to Am I infected? What do I do?


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users


  1. BleepingComputer.com
  2. → Security
  3. → Am I infected? What do I do?
  4. Privacy Policy
  5. Rules ·