I've been having an extremely odd problem. Whenever I'm playing music the volume bar goes down and when I try to hold it down and bring it up it goes back down automatically. My log is attached. Thanks for the help

Attached Files

hijackthis.log (13.1 KB, 4 views)

any help?

Hi.Not sure if your problem is related to this but you do have a trojan that needs to be removed....

Boot into safe mode under your normal user name. See how HERE (How to start Windows in Safe Mode)

Next turn on "Show all files and folders, including hidden and system". See how HERE (How to see hidden files in Windows)

Go to start > run and type services.msc. Press the enter key.
Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

ALCMTR
anhao

Open your task manager by pressing holding ctrl, alt and pressing del. Alternatively, use ctrl + shift + esc. Go to the processes tab, and end the following processes, if found:

ALCMTR.EXE

After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [anhao] C:\WINDOWS\system32\config\svchost.exe
Close HJT.

Navigate in Windows Explorer and delete the following files and folders in bold.

C:\WINDOWS\ALCMTR.EXE
C:\WINDOWS\system32\config\svchost.exe

Reboot into normal mode and rehide your protected OS files.

Post a new HJT log when done...

First off, I want to thank you for your help. Here is the newest log after I completed the tasks you indicated in your post. Oh and I forgot to mention that when i went into run and services.msc i did not find ALCMTR or Anhao but i did use hijack this to end alcmtr.exe and [anhao] svchost.exe. I did go through Windows explorer and succesfully delete alcmtr.exe and the svchost in safe mode. Here is the log

Attached Files

hijackthis3.txt (13.1 KB, 1 views)

O4 - HKLM\..\Run: [My App] a

Is this entry in hijack this significant?

Your log now looks fine.....as for the O4 - HKLM\..\Run: [My App] a I cant find out anything about it so there should be no problem in removing it from the log.