Right after the various whitesmoke/malware scan/deletion steps, I am noticing that when I first open Google (not new tabs afterward, I believe), my RW CD drive does a quick crunch and LED lightup. Any insights about its cause and resolution welcome!
CD Drive Noise and LED Light after Malware Removal
- Thread starter alysenet
- Start date
- Status
- Oct 5, 2012
- 2,697
Hi and welcome to the malwaretips.com forums!
I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
Because of this, I advise you to backup any personal files and folders before you start.
<hr />
STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>
<hr />
I'm Kuttus and I am going to try to assist you with your problem. Please take note of the below:
- I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for this issue on this machine!
- The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
- If you don't know, stop and ask! Don't keep going on.
- Please reply to this thread. Do not start a new topic.
- Refrain from running self fixes as this will hinder the malware removal process.
- It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
Because of this, I advise you to backup any personal files and folders before you start.
<hr />
STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
Code:
:OTL
IE - HKCU\..\SearchScopes\{2B76E9A2-EED3-496C-984F-CE83945CD605}: "URL" = http://search.conduit.com/ResultsExt.asp...14100&UM=2
IE - HKCU\..\SearchScopes\{74B96FED-03C2-4706-9CEB-23BAC316775C}: "URL" = http://websearch.ask.com/redirect?client...0460C152EA
FF - prefs.js..browser.startup.homepage: "https://webmail.earthlink.net/wam/login.jsp?redirect=%2Fwam%2Fwamrss.jsp%3Fredirect%3D%252Fwam%252Findex.jsp%26x%3D1600218644&x=1101674120&x=-894727308"
FF - prefs.js..extensions.enabledItems: {e1170235-2845-420c-acc3-42261a29dd46}:3.5.1
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.1
FF - prefs.js..extensions.enabledItems: foxsaver@www.foxsaver.com:2.2.7.4
FF - prefs.js..extensions.enabledItems: {3EC9C995-8072-4fc0-953E-4F30620D17F3}:2.0.0.4
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
[2012/07/07 15:08:49 | 000,193,494 | ---- | M] () (No name found) -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\extensions\foxsaver@www.foxsaver.com.xpi
[2013/07/03 10:19:46 | 000,001,174 | ---- | M] () -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\searchplugins\whitesmoke-new-customized-web-search.xml
[2013/06/06 06:19:36 | 000,293,757 | ---- | M] () (No name found) -- C:\PROGRAM FILES\CONSUMER INPUT\FIREFOX\CIFF-3.1.0-11730.XPI
O2 - BHO: (eBay Toolbar Helper) - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
[2013/07/09 14:34:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/07/24 17:29:40 | 001,593,848 | ---- | C] (Amazon.com, Inc.) -- C:\Program Files\npAmazonMP3DownloaderPlugin10171.dll
[2012/07/24 17:29:30 | 004,775,344 | ---- | C] (Amazon.com) -- C:\Program Files\AmazonMP3Downloader.exe
[2012/03/02 23:18:00 | 487,666,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\AcrobatPro_10_Web_WWEFD.exe
[2009/04/10 03:29:48 | 001,228,288 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\Framemaker9_WWEFGJ.exe
[2013/07/09 11:15:43 | 000,125,440 | ---- | M] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/12 04:27:00 | 000,513,183 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-3920999773-3276252584-3882007349-1005-0.dat
[2012/09/05 17:13:17 | 000,392,194 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2006/08/05 16:38:40 | 000,125,440 | ---- | C] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
:commands
[emptytemp]
[reboot]<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>
<hr />
Last edited by a moderator:
Hi, Sorry, I just now realized that it's my *floppy drive,* not my RW CD Drive, that makes the quick crunch sound and LED light when I first open Google Chrome. Does that matter in terms of the code you sent me? I'm so sorry if this causes you extra work! Also, can you tell me if you've seen this crunch/LED thing happen after removing Whitesmoke or other annoying malware/whatever? Can you explain the purpose of each step that you'll be supplying? I'm nervous about this. I think I may leave well enough alone, especially if this is some basically benign symptom.
Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
Because of this, I advise you to backup any personal files and folders before you start.
<hr />
STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
<>NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system</></li>
<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>
<hr />
[/quote]
- I will start working on your malware issues, this may or may not, solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for this issue on this machine!
- The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
- If you don't know, stop and ask! Don't keep going on.
- Please reply to this thread. Do not start a new topic.
- Refrain from running self fixes as this will hinder the malware removal process.
- It may prove beneficial if you print of the following instructions or save them to notepad as I post them.
Before we start:
Please be aware that removing malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.
Because of this, I advise you to backup any personal files and folders before you start.
<hr />
STEP 1: Run the below OTL fix
<ol><li>Start <>OTL.exe</></li>
<li>Copy/paste the following text written <>inside of the code box</> into the <>Custom Scans/Fixes</> box located at the bottom of OTL
Code:
:OTL
IE - HKCU\..\SearchScopes\{2B76E9A2-EED3-496C-984F-CE83945CD605}: "URL" = http://search.conduit.com/ResultsExt.asp...14100&UM=2
IE - HKCU\..\SearchScopes\{74B96FED-03C2-4706-9CEB-23BAC316775C}: "URL" = http://websearch.ask.com/redirect?client...0460C152EA
FF - prefs.js..browser.startup.homepage: "https://webmail.earthlink.net/wam/login.jsp?redirect=%2Fwam%2Fwamrss.jsp%3Fredirect%3D%252Fwam%252Findex.jsp%26x%3D1600218644&x=1101674120&x=-894727308"
FF - prefs.js..extensions.enabledItems: {e1170235-2845-420c-acc3-42261a29dd46}:3.5.1
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.1
FF - prefs.js..extensions.enabledItems: foxsaver@www.foxsaver.com:2.2.7.4
FF - prefs.js..extensions.enabledItems: {3EC9C995-8072-4fc0-953E-4F30620D17F3}:2.0.0.4
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found
[2012/07/07 15:08:49 | 000,193,494 | ---- | M] () (No name found) -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\extensions\foxsaver@www.foxsaver.com.xpi
[2013/07/03 10:19:46 | 000,001,174 | ---- | M] () -- C:\Documents and Settings\Alyse\Application Data\Mozilla\Firefox\Profiles\7zxqaf00.default\searchplugins\whitesmoke-new-customized-web-search.xml
[2013/06/06 06:19:36 | 000,293,757 | ---- | M] () (No name found) -- C:\PROGRAM FILES\CONSUMER INPUT\FIREFOX\CIFF-3.1.0-11730.XPI
O2 - BHO: (eBay Toolbar Helper) - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll (eBay Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
[2013/07/09 14:34:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/07/24 17:29:40 | 001,593,848 | ---- | C] (Amazon.com, Inc.) -- C:\Program Files\npAmazonMP3DownloaderPlugin10171.dll
[2012/07/24 17:29:30 | 004,775,344 | ---- | C] (Amazon.com) -- C:\Program Files\AmazonMP3Downloader.exe
[2012/03/02 23:18:00 | 487,666,616 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\AcrobatPro_10_Web_WWEFD.exe
[2009/04/10 03:29:48 | 001,228,288 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files\Framemaker9_WWEFGJ.exe
[2013/07/09 11:15:43 | 000,125,440 | ---- | M] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/12 04:27:00 | 000,513,183 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-3920999773-3276252584-3882007349-1005-0.dat
[2012/09/05 17:13:17 | 000,392,194 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2006/08/05 16:38:40 | 000,125,440 | ---- | C] () -- C:\Documents and Settings\Alyse\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
:commands
[emptytemp]
[reboot]<li>Then click the <>Run Fix</> button at the top</li>
<li>Let the program run unhindered, reboot when it is done</li>
<li>Attach the new log produced by OTL (C:\_OTL)</li>
</ol>
<hr />
[/quote]
Last edited by a moderator:
I just now (10:18 pm PST July 11) saw on a google forum that another person has the same *exact* symptom -- his floppy drive being accessed as soon as he opens Chrome. He said it started with his having updated Chrome to v 28 something. I just recently updated to the latest 28-something version, too, when I was doing all that malware-survey-popup removal stuff. The symptom might be a Chrome *bug* as opposed to a malware existence or removal issue. Yay!!! Hopefully Google will solve the bug!
[/quote]
alysenet said:
[/quote]
Last edited by a moderator:
Yes, my floppy drive crunches and lights up briefly only when I first open Chrome. I have done a search on google's forum and found that *many* people are experiencing this same exact issue ever since doing a recent upgrade to 28-something version. I now have disabled my floppy drive in the My Computer > Properties > Hardware tab > Device Manager and no longer get the crunch/light-up. Good enough for me -- avoids any code stuff, though I did appreciate your offer. Hopefully Google will come up with a patch at some point. Thanks, anyway.
- Oct 5, 2012
- 2,697
This thread is now closed.
Reason: <span style="color: #ff0000;">Issue Resolved. 3rd party Software issue. Not a Virus issue.</span>
<span style="color: #ff0000;"><>The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. </></span>
<span style="color: #ff0000;"><>DO NOT use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.</></span>
All members requesting Malware Removal Assistance are required to follow all procedures in the thread
My virus removal help is always free. Should you wish to show your appreciation via a donation, it will be much appreciated.
Last edited by a moderator:
- Status
