help please? (computer help) (Resolved)

[littlebottom]

i turned on my computer, and it started playing some music, then after the music it said something like "runes of prophesy the elven legacy" i can only assume that this is some form of virus designed to advertise something, but my scans say its clean. my computer has not been harmed in any other way. im rather bemused by this one, and im not exactly someone who usually needs help with computers but im stumped, what the hell is going on, and what should i do?

[Seffbasilisk]

Could be a friend messing with you with a remote access or an Ice-9...

What have you installed recently? Check downloads, especially .exe files.

[littlebottom]

ive not downloaded anything recently, but ill give it a check. back in 10.

EDIT: right, ive sweeped through alot of files, and deleted a few odds and ends i didnt need, some old downloads that were of little use anymore, that sort of thing, but i highly doubt that will make any difference. i found nothing directly suspicous and i havnt downloaded anything new for a couple of weeks and this started today.

[Hazkali]

Well a Google search brings up Runes of Magic: The Elven Prophecy (http://en.wikipedia.org/wiki/Runes_of_Magic#Chapters), which appears to be an MMO.

[littlebottom]

hmm i had suspected it would be some sort of online game... but ive never heard of it before. and am highly annoyed at this thing evading all virus detection.

wait, ive found something... its a text document called "autorun_dll" but ive no idea what that is, ive got no games that fit dll, but its only a small file... im hesitant to delete it now:smalleek:

[Boo]

What does the .txt say?

As in: what does the text inside the document say?

[littlebottom]

this, with it repeating from the dis = 1 line to the bottom a few times over...
BOOL CAutoRunApp::InitInstance()
BOOL CAutoRunApp::Init()
Create m_pIDiscMaster instance
BOOL CAutoRunApp::DetectWriters()
void CAutoRunApp::ClearBurner()
V_pIDiscRecorderID.clear()
IDiscRecorder2 instance created
imapi2Dev.lpDiscRecord2->InitializeDiscRecorder succeeded
DisableAutorun
BOOL CAutoRunApp::DoOPs(BOOL dis = 1)
Release previews...
re-initialisation
re-init success
DisableMcn
succeeded
DisableAutorun

[littlebottom]

well currently its still doing it, any other ideas? id rather not format my entire computer...

[2xMachina]

I have experience with flashdrive viruses. Just plug into a PC, and the drive gets infected. The drive then infects any PC it plugs into. (Seems to be very popular in my Uni computers. Always have to delete the virus at home after plugging into the school computers)

Virus scans generally only look for known viruses. So, non-popular ones tend to slip by. You can try Heuristics. Or look in Task Manager for which unknown process that is on, while the ad runs.

Also, there are websites/forums where you can ask for help. They'll ask you to post a log, and they'll look it through for viruses.

The autorun is the most suspect. Usually useless (except on CDs/DVDs). I'd delete it. It tells your comp to run something on access. You can save a copy if you like (with a different name to prevent autorun).

Or rollback though system restore. I used this way to solve a particularly stubborn virus. (Not the most pleasant method though, since ALL changes are reverted. Hope you've a recent restore point/not changed much stuff).

[littlebottom]

well i tried task manager when it was running, but i couldnt pin it down, there were too many processes going on.

ive since messed about a bit with the computer, and i seem to have stopped it playing during start up, but that might not mean ive got rid of the darn thing, and hopefully it doesnt mess anything else up. the otherday i was on the internet on a harmless site, (it wasnt giant, but about as likely as giant to give you a virus. not at all) and the screen resolution suddenly changed and everything was difficult to access due to it. some parts were extremely zoomed in.

all of a sudden, shortly after that, a notice popped up that said "your computer has new updates ready" as it does from time to time. but as it was after that little incident, i decided id rather just turn the computer straight off instead of shutdown, reloaded it in safe mode and all was fine, so i loaded it again normally, and the advert played again, but that was the last time i heard it... so ive no idea if that was it, or me afterwards.. either way, i suppose this issue is resolved up untill something else goes wrong or tells me otherwise.