Problem with Changing System Sounds and Screensavers

[rag3r0]

Hi,

When I try to change the screensaver, a box pops up saying that rundll32.exe can't be found. When I try to change the system sounds, a box pops up saying that control.exe can't be found. I looked through my folders and I did find them. I might have a virus because other problems are also popping up, like "this copy of windows is not genuine" and "no audio output device is installed", but I'm not sure. Help!

 

[Layback Bear]

You could be infected, that's true.
Your not giving us much information to work with.
Many things won't work if Microsoft indicates the system is not genuine.
How long have you had this computer?
How long have you had this problem?
What security programs do you have installed?
Did Window 7 come install on the computer or did you install Windows 7?
For infection you could start with this.
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html
When you are done let us know if and what was discovered.
Solving all problems starts with a clean, (no infection) computer.

 

[boohbah]

perhaps the op had some other business to attend to layback (hes only made 2 posts its not like he does it all the time.)

 

[Layback Bear]

Well you could be right. I need to relax a little bit. Thanks I needed that.
Thanks boohbah.

 

[rag3r0]

I ran the Windows Defender Offline and nothing was found.

 

[Golden]

Hi,

Lets check the genuine notification problem first. Please follow the steps in this tutorial, and then post the results here in your next reply:

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

Regards,
Golden

 

[rag3r0]

My results are:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-4F8HK-M4P73-W8DQG
Windows Product Key Hash: Xs1iQgVeo0C+sObJxS7eu+FuBPQ=
Windows Product ID: 00359-OEM-8992687-00057
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {A120A49F-A5D0-4168-B06F-C835B1EC05FC}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Kyle\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{A120A49F-A5D0-4168-B06F-C835B1EC05FC}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-W8DQG</PKey><PID>00359-OEM-8992687-00057</PID><PIDType>2</PIDType><SID>S-1-5-21-3572244364-3722053017-2461882483</SID><SYSTEM><Manufacturer>TOSHIBA</Manufacturer><Model>Satellite C655D</Model></SYSTEM><BIOS><Manufacturer>Insyde Corp.</Manufacturer><Version>1.60</Version><SMBIOSVersion major="2" minor="6"/><Date>20100902000000.000000+000</Date></BIOS><HWID>5E263207018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>TOSINV</OEMID><OEMTableID>TOSINV00</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>11330F8888A6586</Val><Hash>lhJQvKgFt2k2LelKjUZC0dFJ6IQ=</Hash><Pid>89388-707-8184403-65938</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004F012' to display the error text.
Error: 0xC004F012 

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000300000003EFF6
Event Time Stamp: 5:19:2012 20:27
ActiveX: Not Registered - 0x80070003
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\wat\watweb.dll
Tampered File: %systemroot%\system32\wat\npwatweb.dll
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
Tampered File: %systemroot%\system32\drivers\spldr.sys
Tampered Service: sppsvc
Tampered Service: sppuinotify


HWID Data-->
HWID Hash Current: MgAAAAEAAgABAAEAAAABAAAABAABAAEAeqhWWBKJVPnusrg3qArw8PxRRCQwAAq5GHk=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            TOSINV        TOSINV00
  FACP            TOSINV        TOSINV00
  HPET            TOSINV        TOSINV00
  BOOT            TOSINV        TOSINV00
  MCFG            TOSINV        TOSINV00
  SLIC            TOSINV        TOSINV00
  SSDT            AMD           POWERNOW

 

[Golden]

Hi,

From an elevated command prompt, please run sfc /scannow and post back the results.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Regards,
Golden

 

[NoelDP]

You have two tampered services, in addition to tampers on all files monitored by the SPPSVC - I suspect that one is the result of the other.

I am currently dealing with another case of this exact issue elsewhere - so I wonder if there is a common cause?

Please run the following command in a Command Prompt window.
It will put a file on your desktop called ENUS.TXT - attach the file to your reply

DIR C:\Windows\System32\en-US >%userprofile%\Desktop\ENUS.TXT

Please also tell us what you have been doing on the system over the past 3 days or so - details not needed, but have you had any Virus warnings, or other problems, or have you had any odd emails that you've opened?

You should update your Anti-Virus, and download and install Malwarebytes Anti-malware (free version) from www.malwarebytes.org - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[rag3r0]

Here is my ENUS.txt attached.

 

[NoelDP]

All that looks normal to me - so well have to start from first principles....



Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.

You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.
The chkdsk will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) - then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.
Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

Post a new MGADiag report with details of any error messages encountered.

 

[rag3r0]

I believe I have fixed the problem myself, thanks guys (not sarcasm). I just *messed* up the registry and had to restore it.

 

[rag3r0]

I'll keep this up for one week in case I run into anything again.

 

[NoelDP]

You posted over a month ago - are you saying that you did nothing about it for a month after posting, and then did Syatem restore?