Mini Spy

Loading...

Latest Threads

Loading...
 
  1. Before you start!
    All given instructions in this forum are customized for each help request, the tools used may cause damage if used on a computer with different infections. If you think you have similar issues, please post the appropriate logs in our Malware Removal Assistance forum and wait for help.

    Please be aware that removing Malware is a potentially hazardous undertaking. We will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for us to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and we cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
    We strongly advise you to backup any personal files and folders before you start.

CD Drive Noise and LED Light after Malware Removal

Discussion in 'Malware Removal Assistance' started by alysenet, Jul 11, 2013.

Thread Status:
Not open for further replies.
  1. alysenet

    alysenet New Member

    Reputation:
    0
    Joined:
    Jul 11, 2013
    Messages:
    5
    Likes Received:
    0
    Right after the various whitesmoke/malware scan/deletion steps, I am noticing that when I first open Google (not new tabs afterward, I believe), my RW CD drive does a quick crunch and LED lightup. Any insights about its cause and resolution welcome!
     

    Attached Files:

  2. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Hi and welcome to the MalwareTips.com forums!

    I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
    • I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
    • The fixes are specific to your problem and should only be used for this issue on this machine!
    • The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
    • If you don't know, stop and ask! Don't keep going on.
    • Please reply to this thread. Do not start a new topic.
    • Refrain from running self fixes as this will hinder the malware removal process.
    • It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
    Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


    Before we start:
    Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

    Because of this, I advise you to backup any personal files and folders before you start.
    <hr />

    STEP 1: Run the below OTL fix
    <ol><li>Start <>OTL.exe</></li>
    <li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
    Code:
    
    :OTL
    IE - HKCU\..\SearchScopes\{2B76E9A2-EED3-496C-984F-CE83945CD605}: "URL" = http://search.conduit.com/ResultsExt.asp...14100&UM=2
    IE - HKCU\..\SearchScopes\{74B96FED-03C2-4706-9CEB-23BAC316775C}: "URL" = http://websearch.ask.com/redirect?client...0460C152EA
    FF - prefs.js..browser.startup.homepage: "https://webmail.earthlink.net/wam/login.jsp?redirect=%2Fwam%2Fwamrss.jsp%3Fredirect%3D%252Fwam%252Findex.jsp%26x%3​D1600218644&x=1101674120&x=-894727308"
    FF - prefs.js..extensions.enabledItems: {e1170235-2845-420c-acc3-42261a29dd46}:3.5.1
    FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.1
    FF - prefs.js..extensions.enabledItems: foxsaver@www.foxsaver.com:2.2.7.4
    FF - prefs.js..extensions.enabledItems: {3EC9C995-8072-4fc0-953E-4F30620D17F3}:2.0.0.4
    FF - prefs.js..network.proxy.no_proxies_on: "*.local"
    FF - prefs.js..network.proxy.type: 4
    FF - user.js - File not found
    [2012/07/07 15:08:49 | 000,193,494 | ---- | M] () (No name found) -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\extensions\foxsaver@www.foxsaver.​com.xpi
    [2013/07/03 10:19:46 | 000,001,174 | ---- | M] () -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\searchplugins\whitesmoke-new-customized-web-search.xml
    [2013/06/06 06:19:36 | 000,293,757 | ---- | M] () (No name found) -- C:\PROGRAM FILES\CONSUMER INPUT\FIREFOX\CIFF-3.1.0-11730.XPI
    O2 - BHO: (eBay Toolbar Helper) - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
    O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
    O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
    O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
    O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
    O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
    [2013/07/09 14:34:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
    [2012/07/24 17:29:40 | 001,593,848 | ---- | C] (Amazon.com, Inc.) -- C:\Program Files\npAmazonMP3DownloaderPlugin10171.dll
    [2012/07/24 17:29:30 | 004,775,344 | ---- | C] (Amazon.com) -- C:\Program Files\AmazonMP3Downloader.exe
    [2012/03/02 23:18:00 | 487,666,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\AcrobatPro_10_Web_WWEFD.exe
    [2009/04/10 03:29:48 | 001,228,288 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\Framemaker9_WWEFGJ.exe
    [2013/07/09 11:15:43 | 000,125,440 | ---- | M] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2012/12/12 04:27:00 | 000,513,183 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-3920999773-3276252584-3882007349-1005-0.dat
    [2012/09/05 17:13:17 | 000,392,194 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    [2006/08/05 16:38:40 | 000,125,440 | ---- | C] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    
    :commands
    [emptytemp]
    [reboot]
    
    
    <>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
    <li>Then click the <>Run Fix</> button at the top</li>
    <li>Let the program run unhindered, reboot when it is done</li>
    <li>Attach the new log produced by OTL (C:\_OTL)</li>
    </ol>

    <hr />
     
    Last edited by a moderator: Mar 13, 2014
  3. alysenet

    alysenet New Member

    Reputation:
    0
    Joined:
    Jul 11, 2013
    Messages:
    5
    Likes Received:
    0
    Hi, Sorry, I just now realized that it's my *floppy drive,* not my RW CD Drive, that makes the quick crunch sound and LED light when I first open Google Chrome. Does that matter in terms of the code you sent me? I'm so sorry if this causes you extra work! Also, can you tell me if you've seen this crunch/LED thing happen after removing Whitesmoke or other annoying malware/whatever? Can you explain the purpose of each step that you'll be supplying? I'm nervous about this. I think I may leave well enough alone, especially if this is some basically benign symptom.

    • I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
    • The fixes are specific to your problem and should only be used for this issue on this machine!
    • The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
    • If you don't know, stop and ask! Don't keep going on.
    • Please reply to this thread. Do not start a new topic.
    • Refrain from running self fixes as this will hinder the malware removal process.
    • It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
    Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.


    Before we start:
    Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

    Because of this, I advise you to backup any personal files and folders before you start.
    <hr />

    STEP 1: Run the below OTL fix
    <ol><li>Start <>OTL.exe</></li>
    <li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
    Code:
    
    :OTL
    IE - HKCU\..\SearchScopes\{2B76E9A2-EED3-496C-984F-CE83945CD605}: "URL" = http://search.conduit.com/ResultsExt.asp...14100&UM=2
    IE - HKCU\..\SearchScopes\{74B96FED-03C2-4706-9CEB-23BAC316775C}: "URL" = http://websearch.ask.com/redirect?client...0460C152EA
    FF - prefs.js..browser.startup.homepage: "https://webmail.earthlink.net/wam/login.jsp?redirect=%2Fwam%2Fwamrss.jsp%3Fredirect%3D%252Fwam%252Findex.jsp%26x%3​D1600218644&x=1101674120&x=-894727308"
    FF - prefs.js..extensions.enabledItems: {e1170235-2845-420c-acc3-42261a29dd46}:3.5.1
    FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.1
    FF - prefs.js..extensions.enabledItems: foxsaver@www.foxsaver.com:2.2.7.4
    FF - prefs.js..extensions.enabledItems: {3EC9C995-8072-4fc0-953E-4F30620D17F3}:2.0.0.4
    FF - prefs.js..network.proxy.no_proxies_on: "*.local"
    FF - prefs.js..network.proxy.type: 4
    FF - user.js - File not found
    [2012/07/07 15:08:49 | 000,193,494 | ---- | M] () (No name found) -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\extensions\foxsaver@www.foxsaver.​com.xpi
    [2013/07/03 10:19:46 | 000,001,174 | ---- | M] () -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\searchplugins\whitesmoke-new-customized-web-search.xml
    [2013/06/06 06:19:36 | 000,293,757 | ---- | M] () (No name found) -- C:\PROGRAM FILES\CONSUMER INPUT\FIREFOX\CIFF-3.1.0-11730.XPI
    O2 - BHO: (eBay Toolbar Helper) - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
    O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
    O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
    O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
    O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
    O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
    [2013/07/09 14:34:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
    [2012/07/24 17:29:40 | 001,593,848 | ---- | C] (Amazon.com, Inc.) -- C:\Program Files\npAmazonMP3DownloaderPlugin10171.dll
    [2012/07/24 17:29:30 | 004,775,344 | ---- | C] (Amazon.com) -- C:\Program Files\AmazonMP3Downloader.exe
    [2012/03/02 23:18:00 | 487,666,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\AcrobatPro_10_Web_WWEFD.exe
    [2009/04/10 03:29:48 | 001,228,288 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\Framemaker9_WWEFGJ.exe
    [2013/07/09 11:15:43 | 000,125,440 | ---- | M] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2012/12/12 04:27:00 | 000,513,183 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-3920999773-3276252584-3882007349-1005-0.dat
    [2012/09/05 17:13:17 | 000,392,194 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
    [2006/08/05 16:38:40 | 000,125,440 | ---- | C] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    
    :commands
    [emptytemp]
    [reboot]
    
    
    <>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
    <li>Then click the <>Run Fix</> button at the top</li>
    <li>Let the program run unhindered, reboot when it is done</li>
    <li>Attach the new log produced by OTL (C:\_OTL)</li>
    </ol>

    <hr />
    [/quote]
     
    Last edited by a moderator: Mar 13, 2014
  4. alysenet

    alysenet New Member

    Reputation:
    0
    Joined:
    Jul 11, 2013
    Messages:
    5
    Likes Received:
    0
    I just now (10:18 pm PST July 11) saw on a google forum that another person has the same *exact* symptom -- his floppy drive being accessed as soon as he opens Chrome. He said it started with his having updated Chrome to v 28 something. I just recently updated to the latest 28-something version, too, when I was doing all that malware-survey-popup removal stuff. The symptom might be a Chrome *bug* as opposed to a malware existence or removal issue. Yay!!! Hopefully Google will solve the bug!


    [/quote]
     
    Last edited by a moderator: Mar 13, 2014
  5. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    Okay.. So are you facing this issue only if you are using Chrome?
     
  6. alysenet

    alysenet New Member

    Reputation:
    0
    Joined:
    Jul 11, 2013
    Messages:
    5
    Likes Received:
    0
    Yes, my floppy drive crunches and lights up briefly only when I first open Chrome. I have done a search on google's forum and found that *many* people are experiencing this same exact issue ever since doing a recent upgrade to 28-something version. I now have disabled my floppy drive in the My Computer > Properties > Hardware tab > Device Manager and no longer get the crunch/light-up. Good enough for me -- avoids any code stuff, though I did appreciate your offer. Hopefully Google will come up with a patch at some point. Thanks, anyway.
     
  7. kuttus

    kuttus Active Member

    Reputation:
    0
    Joined:
    Oct 5, 2012
    Messages:
    2,767
    Likes Received:
    81
    This thread is now closed.​

    Reason:&nbsp;<span style="color: #ff0000;">Issue Resolved. 3rd party Software issue. Not a Virus issue.</span>

    <span style="color: #ff0000;"><>The procedures contained in this thread are for this user and this user only.&nbsp;&nbsp;Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair.&nbsp;&nbsp;</></span>

    <span style="color: #ff0000;"><>DO NOT use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.</></span>

    All members requesting Malware Removal Assistance are required to follow all procedures in the thread

    [​IMG] [​IMG]
    My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.
     
    Last edited by a moderator: Mar 13, 2014

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Loading...
Thread Status:
Not open for further replies.
MalwareTips.com is an independent website.All trademarks mentioned on this page are the property of their respective owners.