Sign in with
Sign up | Sign in
Your question
Solved

Random audio ads playing

Last response: in Windows 7
Share
June 18, 2012 11:28:30 PM

Hello,

I am having a problem with my computer randomly playing audio ads even when there are no programs running. I have Malwarebytes installed and it consistantly shows that it is blocking a svchost.exe program, but the audio still plays. I have tried reinstalling windows 7 but that didnt help. Any ideas what might be causing this issue and how to stop it?

Imdy
a b 8 Security
a b $ Windows 7
June 19, 2012 12:02:54 AM

Hi :) 

WHICH anti virus are you using ?

All the best Brett :) 
m
0
l
June 19, 2012 1:25:26 AM

I am using MacAfee Total Protection. I have noticed through some research that there is a svchost.exe process with a *32 after it. When I end that process the audio stops. Comes back after a while though. Ran a total scan with malwarebytes which found a trojan virus. Tried to delete it with the software but it comes back. Have done this twice so far.

Persistant little bugger.
m
0
l
Related resources

Best solution

June 20, 2012 8:01:32 PM

Download & run Kaspersky's TDSSKILLER. You will most likely find a rootkit (Rootkit.Boot.Pihar.c). It is what keeps creating the fake svchost.exe file.

You mileage may vary, of course. This allowed me to properly remove the rogue svchost file.
Share
June 20, 2012 8:28:38 PM

Thanks, I will give it a go and report back.
m
0
l
June 20, 2012 10:53:04 PM

Worked like a charm! Thanks.
m
0
l
June 20, 2012 10:53:13 PM

Best answer selected by imdyinhere.
m
0
l
June 21, 2012 7:41:40 PM

imdyinhere said:
Worked like a charm! Thanks.


You are welcome. I am glad to help.
m
0
l
July 7, 2012 3:52:32 PM

sundrytech said:
Download & run Kaspersky's TDSSKILLER. You will most likely find a rootkit (Rootkit.Boot.Pihar.c). It is what keeps creating the fake svchost.exe file.

You mileage may vary, of course. This allowed me to properly remove the rogue svchost file.


had the same issues and your help locating TDSSKILLER cleared up what 8 different programs running in safe mode couldn't find...thanks
m
0
l
March 28, 2013 6:56:43 PM

sundrytech said:
imdyinhere said:
Worked like a charm! Thanks.


You are welcome. I am glad to help.


Root Killer totally worked for me, too! SO frustrating that other programs could not! THANK YOU.
m
0
l
March 28, 2013 6:56:43 PM

sundrytech said:
imdyinhere said:
Worked like a charm! Thanks.


You are welcome. I am glad to help.


Root Killer totally worked for me, too! SO frustrating that other programs could not! THANK YOU.
m
0
l
March 28, 2013 6:56:43 PM

sundrytech said:
imdyinhere said:
Worked like a charm! Thanks.


You are welcome. I am glad to help.


Root Killer totally worked for me, too! SO frustrating that other programs could not! THANK YOU.
m
0
l
April 11, 2013 7:49:21 AM

I had this problem too and Kaspersky's TDSSKILLER found and fixed it very quickly. Thanks so much for the suggestion!

Bill
m
0
l
April 11, 2013 7:49:21 AM

I had this problem too and Kaspersky's TDSSKILLER found and fixed it very quickly. Thanks so much for the suggestion!

Bill
m
0
l
April 25, 2013 6:23:13 AM

TDSSKiLLER is the answer!
m
0
l
April 29, 2013 10:47:33 PM

Yep tdsskiller solved my problem....took me awhile because you need to restore and not just quarantine the file. This is probably the first time for me that malwarebyte didn't detect the file, even after a full scan.
m
0
l
June 2, 2013 10:03:09 AM

sundrytech said:
Download & run Kaspersky's TDSSKILLER. You will most likely find a rootkit (Rootkit.Boot.Pihar.c). It is what keeps creating the fake svchost.exe file.

You mileage may vary, of course. This allowed me to properly remove the rogue svchost file.


m
0
l
June 2, 2013 10:04:23 AM

This worked for me too. Any idea if this 'rootkit' can acquire personal data from my PC? ...and how likely?

BTW, MANY THANKS!!!
m
0
l
July 13, 2013 6:36:50 AM

TDSSKILLER worked after all other scans did not. Thank you!
m
0
l
August 7, 2013 8:41:37 AM

sctadlock said:
sundrytech said:
Download & run Kaspersky's TDSSKILLER. You will most likely find a rootkit (Rootkit.Boot.Pihar.c). It is what keeps creating the fake svchost.exe file.

You mileage may vary, of course. This allowed me to properly remove the rogue svchost file.


had the same issues and your help locating TDSSKILLER cleared up what 8 different programs running in safe mode couldn't find...thanks


m
0
l
August 7, 2013 8:46:09 AM

I have Norton on my PC (Windows 7) as well as Microsoft Security Essentials; neither will stop the constant ads from playing or detect the virus. When I went to install Kaspersky's I could not connect to their site. Also at the same time the ads stopped. I think the virus is hiding. I went through Kaspersky's support site and was able to get to the download. I have it on my desktop but it will not open. I think the virus is keeping it from opening. Does this sound feasible? Any suggestions?
m
0
l
August 7, 2013 8:46:15 AM

I have Norton on my PC (Windows 7) as well as Microsoft Security Essentials; neither will stop the constant ads from playing or detect the virus. When I went to install Kaspersky's I could not connect to their site. Also at the same time the ads stopped. I think the virus is hiding. I went through Kaspersky's support site and was able to get to the download. I have it on my desktop but it will not open. I think the virus is keeping it from opening. Does this sound feasible? Any suggestions? Tech 101, shut down - reboot. Did this it found and removed 2 viruses right away that the others could not find. Thanks.
m
0
l
August 13, 2013 8:35:38 PM

i HAD THE SAME PROBLEM AND DOWNLOADED and ran Kaspersky's TDSSKILLE. It worked great!!! Thanks!!
m
0
l
August 28, 2013 8:52:06 PM

I reccomend from having the same problem that you restore your system to an earlier time using windows system restore. search it up in your start menu. Hope this helps you
m
0
l
September 6, 2013 9:01:53 PM

I just wanted to that the poster who suggested kaspersky tdsskiller as the solution because I had this problem too and it got rid of it. I'm so happy I found this thread. Thanks!!
m
0
l
September 7, 2013 11:35:55 AM

Thank you again and again! What a lifesaver it worked for me.
m
0
l
September 22, 2013 12:23:21 PM

My wife picked this trojan browsing a query to movie trivia on her laptop. I've spent three nights (after work) trying to get rid of this thing. First, MS Security Essentials, then AdAware, SpyBot and finally Norton's security suite via Comcast. None of them picked it up.

After downloading the tdsskiller.exe, it ran in less than one minute, asked for a reboot, and voila, the bot is gone. In the future I guess i'm going to google bot/virus behavior before spending nights trusting that these commercial virus scanners will do what they're supposed to do.

Thanks for the suggestion!
m
0
l
October 1, 2013 5:50:07 PM

sundrytech said:
Download & run Kaspersky's TDSSKILLER. You will most likely find a rootkit (Rootkit.Boot.Pihar.c). It is what keeps creating the fake svchost.exe file.

You mileage may vary, of course. This allowed me to properly remove the rogue svchost file.


m
0
l
October 1, 2013 5:51:01 PM

Is this a free download. If so, can you give me a link to the download. Having trouble finding and actual download.
m
0
l
October 1, 2013 7:41:52 PM

i tried the TDSSKILLER, found zero threats and still have random audio ads playing every once in a while. i go into services and shut down everything and then monitor it. nothing new comes up, no programs running, no windows for internet open... nothing. i can see when it starts to load with my data meter (bitmeter) but it doesn't have anything to source what's using the data.
m
0
l
November 1, 2013 10:18:44 PM

This solved my problem too, thanks so much. So annoying and very frustrating trying to find a solution...so thankful for your help!
BTW, I found the free download on CNET by Google searching TDSSKILLER
m
0
l
November 12, 2013 7:45:02 AM

Wow! TDSSKILLER worked! After having so many other things not work is great to have a quick solution!
m
0
l
January 2, 2014 3:30:14 PM

Hi guys, I have this exact problem! I tried Kapersky's Tdss killer but it found nothing. Is there something I should try in the settings? Or did it work for everyone in the standard scan? Is everyone doing this in safe mode?
m
0
l
January 8, 2014 4:16:25 PM

Hi all, I have this same issue. Like VoodooChild81, I have run Tdss killer and it found nothing. More background: I have run MBAM, SuperAntiSpyware, and a full sacwith my Virus protection (AVG free). I have run these in Safe mode and normal mode. Only tracking issues were found and I had all results removed. My investigation has found that the resource playing the ads is "SVCHOST.exe (DCOM Launch)". When I go into "Resource Monitor" and end this SVCHOST process the ad stops and will not start again until I reboot my PC. Also Note - when I end this process I get a error popup stating "Windows must be restarted, DCOM has an unexpected error" (the exact error message is slightly different). I have read that a utility called Far Bar Recovery Scan Tool will resolve this problem. I have been unable to download it, probably due to all the programs I have removed trying to clean up my issues.

So if anyone has a suggestion on how I can resolve my problem.. I would appreciate it...

Thanks

John
m
0
l
January 10, 2014 8:08:12 PM

My computer has the same problem that Jshep mentioned right above me...TDSS killer doesn't work and we are getting the dcom launch thing too. Also tried AVG full scan and MBAM
m
0
l
January 11, 2014 6:03:25 AM

Update on my issue: I was able to download Far Bar Scan tool and I went through the process to run the fix in recovery mode (command prompt) but the scan did not find any problems to correct. Ultimately (and should have been my first step) I just restored my PC to a 12/31/13 restore point and my problem is resolved. I will monitor this forum in case other fixes for this are recommended for my future reference. Hopefully someone can post solutions to help others who still have this issue. Thanks for reading!
m
0
l
January 14, 2014 1:03:48 PM

None of these utilities worked until I ran rkill. You can get it from bleepingcomputer.com (http://www.bleepingcomputer.com/download/rkill/). It seems to deactivate any running malware to allow the scanners to work. After I ran it, tdsskiller found all kinds of goodies to attack. I'm now enjoying the sound of silence (S&G song reference) - qlol - quietly laughing out loud... shhhhh...

UPDATE: I couldn't get rid of rpcss.dll but the scans kept pointing to this file. I renamed it but the pc hung on reboots. HitmanPro finally got it right.
m
0
l
January 20, 2014 6:39:44 PM

You can't just rename or delete rpcss.dll as your system needs it to boot all the way in to windows. If you delete it, you will get the black screen of death. (You'll have to do a system restore to boot your computer to windows again.)

Replace rpcss.dll in the c:\windows\system32 folder. Note that if you're putting it on a Win 7 Pro 32 bit machine, it needs to come from a 32 bit machine, the file is different for 64 bit.

m
0
l
February 8, 2014 6:49:29 PM

I just installed TDSSKILLER. And no more stupid radio playing. I love this silence.. ahhhhh!
I will post if in case the radio comes back! I really hope not :( 
m
0
l
March 8, 2014 4:19:09 PM

imdyinhere said:
Hello,

I am having a problem with my computer randomly playing audio ads even when there are no programs running. I have Malwarebytes installed and it consistantly shows that it is blocking a svchost.exe program, but the audio still plays. I have tried reinstalling windows 7 but that didnt help. Any ideas what might be causing this issue and how to stop it?

Imdy
m
0
l
March 8, 2014 4:20:19 PM

Do you have WiFi if so click it off
m
0
l
April 7, 2014 3:38:42 PM

ExtraMike said:
You can't just rename or delete rpcss.dll as your system needs it to boot all the way in to windows. If you delete it, you will get the black screen of death. (You'll have to do a system restore to boot your computer to windows again.)

Replace rpcss.dll in the c:\windows\system32 folder. Note that if you're putting it on a Win 7 Pro 32 bit machine, it needs to come from a 32 bit machine, the file is different for 64 bit.



So I ran this as directed above and when tdsskiller asked about that rpcss file I marked skip, ran it and now I'm getting that black screen. Am I screwed and have I lost everything on my harddrive? Help?




m
0
l
less than a minute ago

sundrytech said:
Download & run Kaspersky's TDSSKILLER. You will most likely find a rootkit (Rootkit.Boot.Pihar.c). It is what keeps creating the fake svchost.exe file.

You mileage may vary, of course. This allowed me to properly remove the rogue svchost file.


TDSSKILLER didn't find anything for me, any suggestions?
m
0
l
!