# [SOLVED] xp sound problem



## blago (Nov 9, 2011)

hi friends,i have some strange problem with my sound.mother-intel915,soundchip onboard RTLxxx(680 think).
it's works fine for some years(3-4),but few monhts ago stopped...i leave it , and nowadays need working sound card in this OS.i have started with driver updating,proceed with registry but no effect.the result is that "soundman" of Realtek's newest "r266" recognise mic and headfone when plugged in,but XP does not....and of course-no sound.

any ideas???

maybe i didn't know where to look...
any help,please!

p.s.
all hardware work-i've installed another XP and there all works perfectly.


----------



## GZ (Jan 31, 2010)

*Re: xp sound problem*

Hello blago and welcome to TSF,

If I am reading correctly, you reinstalled XP and the sound functions normally?

How did you install XP and leave the old XP intact?


----------



## blago (Nov 9, 2011)

*Re: xp sound problem*

no.
1.hdd-split. it make c: & d:
c: have his own XP 2002 sp3(old,without sound) installed many years ago with all "kb's"
d: new XP (may be the same 2002) perfectly working.i do this to check soft' or hard'....

during all my attempts of updating driver i saw many "blue screens".started "cleaning" of registry,key by key every time restarting to be sure all is ok. now "realtek" is present on "device manager" & as hardware on "sound,speech....",but not on "audio"-no playback device,no recording device,no midi device...
it seems to be software problem

reinstall...no,thanks.and no copy from "repair",most software will be lost...
i need sound on C:...


----------



## GZ (Jan 31, 2010)

*Re: xp sound problem*

There are a few issues... one of them is "Registry Cleaning". This is an unneccessary task that more often breaks Windows than fixes it. 

If you made registry backups, the first thing I suggest doing is restoring the registry.

I do realize that you said "no" to a repair-install of Windows XP, but that may be the way to do it. If a fresh install of Windows is functioning normally and you are having major issues with the old install (BSODs, instability, loss of functionality), it would be the best option with the least amount of down-time.

I suggest backing up any important documents/data before proceeding with anything.


----------



## blago (Nov 9, 2011)

*Re: xp sound problem*

thank you,Gavinzach!
problem is that no other "major issues".time to time some spy etc.
no blue screens after deleting one wrong key in reg-HKLM\SYSTEM....
it put there "com9" instead "realtek".maybe (pretty sure) i need to edit or add key or two,but don't know where....

after all i have oldest OS here ...more than 5 years :biggrinje


----------



## blago (Nov 9, 2011)

*Re: xp sound problem*









some screen


> .... now "realtek" is present on "device manager" & as hardware on "sound,speech....",but not on "audio"-no playback device,no recording device,no midi device...


----------



## JimE (Apr 16, 2009)

*Re: xp sound problem*

Uninstall the RealTek chipset listed above in Device Manager, reboot, and install the Realtek drivers.


----------



## blago (Nov 9, 2011)

*Re: xp sound problem*

done....and nothing...malwarebyte's found nothing....
but combofix... :


```
[FONT=Lucida Console]
ComboFix 11-11-09.02 - hristo 10/11/2011   1:35.1.2 - FAT32x86
Microsoft Windows XP Professional  5.1.2600.3.1252.44.1033.18.2015.1592 [GMT 2:00]
Running from: c:\documents and settings\hristo\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP
c:\documents and settings\All Users.WINDOWS\Application Data\TEMP\DFC5A2B2.TMP
c:\documents and settings\hristo\WINDOWS
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\iis6.log
c:\windows\iun6002.exe
c:\windows\system32\6153715641.dll
c:\windows\system32\9255537541.dll
c:\windows\system32\ctfmon .exe
c:\windows\system32\drivers\hwinterface.sys
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\service
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\wiaservim.log
c:\windows\WindowsUpdate.log
G:\uninstall.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ASC3550P
-------\Legacy_BOONTY_GAMES
-------\Legacy_ICF
-------\Legacy_MSUPDATE
-------\Legacy_NPF
-------\Legacy_WINDOWS_LOG
-------\Service_Boonty Games
-------\Service_NPF
-------\Service_usnjsvc
-------\Legacy_hwinterface
-------\Service_hwinterface
.
.
(((((((((((((((((((((((((   Files Created from 2011-10-09 to 2011-11-09  )))))))))))))))))))))))))))))))
.
.
2011-11-09 15:46 . 2011-11-09 15:46 -------- d-----w- c:\windows\system32\RTCOM
2011-11-09 15:34 . 2011-11-09 15:34 -------- d-----w- c:\windows\Logs
2011-11-09 12:21 . 2011-11-09 12:21 -------- d-----w- c:\program files\SystemRequirementsLab
2011-11-09 12:03 . 2011-11-09 12:03 3218 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2011-11-08 14:51 . 2008-04-13 19:45 10624 ----a-w- c:\windows\system32\drivers\gameenum.sys
2011-11-08 14:51 . 2008-04-13 19:45 10624 ----a-w- c:\windows\system32\dllcache\gameenum.sys
2011-11-08 14:38 . 2004-08-03 20:32 231552 ----a-w- c:\windows\system32\drivers\ac97ali.sys
2011-11-08 14:38 . 2004-08-03 20:32 231552 ----a-w- c:\windows\system32\dllcache\ac97ali.sys
2011-11-08 14:34 . 2011-11-08 14:34 -------- d-----w- C:\FOUND.006
2011-11-08 14:01 . 2011-11-08 14:01 -------- d-----w- C:\FOUND.005
2011-11-08 13:52 . 2011-11-08 13:52 16138240 ----a-w- c:\windows\SET30.tmp
2011-11-08 13:36 . 2011-11-08 13:36 -------- d-----w- C:\FOUND.004
2011-11-08 13:08 . 2011-11-08 13:08 -------- d-----w- c:\program files\Eusing Free Registry Defrag
2011-11-08 12:53 . 2011-11-08 12:53 -------- d-----w- c:\program files\Eusing Free Registry Cleaner
2011-11-07 19:15 . 2011-11-07 19:15 -------- d-----w- C:\FOUND.003
2011-10-18 17:53 . 2011-11-09 14:43 6439528 ----a-w- c:\windows\system32\drivers\RtkHDAud.sys
2011-10-14 16:58 . 2011-11-09 14:43 20064872 ----a-w- c:\windows\RTHDCPL.EXE
2011-10-13 18:03 . 2011-11-09 14:43 16836 ----a-w- c:\windows\system32\drivers\RTAIODAT.DAT
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-09 14:43 . 2011-08-29 14:20 1493608 ----a-w- c:\windows\RtlUpd.exe
2011-11-09 14:43 . 2011-06-30 14:15 891496 ----a-w- c:\windows\system32\RTSndMgr.CPL
2011-11-09 14:43 . 2010-11-03 16:15 84584 ----a-w- c:\windows\SOUNDMAN.EXE
2011-11-09 14:43 . 2010-11-03 16:15 9721960 ----a-w- c:\windows\RTLCPL.EXE
2011-11-09 14:43 . 2010-11-03 16:14 2180712 ----a-w- c:\windows\MicCal.exe
2011-11-09 14:43 . 2010-11-03 16:13 285288 ----a-w- c:\windows\system32\ALSNDMGR.CPL
2011-11-09 14:43 . 2010-11-03 16:13 2815592 ----a-w- c:\windows\ALCWZRD.EXE
2011-11-09 14:43 . 2010-11-03 16:13 64104 ----a-w- c:\windows\ALCMTR.EXE
2011-11-09 13:35 . 2010-09-07 12:20 7296 ----a-w- c:\windows\system32\drivers\osaio.sys
2011-09-28 23:11 . 2011-09-28 23:11 438976 ----a-r- c:\windows\system32\MSHFLXGD.OCX
2011-09-28 23:11 . 2011-09-28 23:11 431888 ----a-r- c:\program files\Common Files\riched20.dll
2011-09-03 16:25 . 2011-09-03 16:25 9709568 ----a-w- c:\windows\SET3A.tmp
2011-08-31 15:00 . 2011-05-28 16:13 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-05-01 22:02 . 2009-05-01 22:02 1044480 ----a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-05-01 22:02 . 2009-05-01 22:02 200704 ----a-w- c:\program files\opera\program\plugins\ssldivx.dll
.
[code]<pre>
c:\program files\Java\jre6\bin\jusched .exe
c:\windows\pchealth\helpctr\binaries\msconfig .exe
</pre>
```
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 4662776]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-04-20 118784]
"ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344]
"Domino"="c:\windows\Domino.exe" [2006-08-18 49152]
"SkyTel"="SkyTel.EXE" [N/A]
"ipTray.exe"="D:\iptray.exe" [2005-12-02 1687552]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [N/A]
"SoundMan"="SOUNDMAN.EXE" [2011-11-09 84584]
"AlcWzrd"="ALCWZRD.EXE" [2011-11-09 2815592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3 (0x3)
"wfxsvc"=2 (0x2)
"pctspk"=2 (0x2)
"idsvc"=3 (0x3)
"ICF"=2 (0x2)
"msupdate"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\DAP\\DAP.EXE"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\PCHEALTH\\HELPCTR\\BINARIES\\HelpCtr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\ICQ6.5\\ICQ.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\WINDOWS\\System32\\tlntsvr.exe"=
"g:\\hristo\\Desktop\\ftpserver2\\FTPServer.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*isabledxpsp2res.dll,-22009
"25197:TCP"= 25197:TCP:BitComet 25197 TCP
"25197:UDP"= 25197:UDP:BitComet 25197 UDP
"9999:UDP"= 9999:UDP:IDU Service UDP Port
"2804:TCP"= 2804:TCP:IDU Service TCP Port
.
R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPortIO.SYS [1/22/2008 7:35 PM 3584]
R2 pctcom;Vpctcom;c:\windows\system32\drivers\vpctcom.sys [10/27/2008 8:25 PM 397502]
S2 gupdate1c99e558774b030;Google Update Service (gupdate1c99e558774b030);c:\program files\Google\Update\GoogleUpdate.exe [3/6/2009 2:17 PM 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [8/5/2008 8:10 PM 1684736]
S3 CCCP106;CIF USB Camera (2110A);c:\windows\system32\DRIVERS\cccp106.sys --> c:\windows\system32\DRIVERS\cccp106.sys [?]
S3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\DRIVERS\COMFiltr.sys --> c:\windows\system32\DRIVERS\COMFiltr.sys [?]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 11:58 AM 11336]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/6/2009 2:17 PM 133104]
S3 vvftav211;vvftav211;c:\windows\system32\drivers\vvftav211.sys [3/12/2009 3:53 PM 480128]
S3 Yeastar_SkyCable;Yeastar Skype Cable (Multiple Channels) (WDM);c:\windows\system32\drivers\SkyCable.sys [6/8/2007 12:04 PM 69248]
S3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\drivers\ZS211.sys [3/12/2009 3:53 PM 1537024]
.
Contents of the 'Scheduled Tasks' folder
.
2011-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 12:17]
.
2011-11-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-06 12:17]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = about:blank
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 192.168.1.1
DPF: {3855FC6A-13C5-4C2A-A701-67D03A4E83EC} - hxxp://www.bezeqint.net/Media/friendly/FEMail.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37930.cab
DPF: {D6898769-98CE-4E2B-9DCD-D73895E6A27C} - hxxp://www.bobarega.co.il/bobarega.CAB
DPF: {E4456C1D-ECE7-4C05-996A-3958091C6F55} - hxxp://www.bezeqint.net/Media/fwTechTool2.cab
DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} - hxxps://plugins.valueactive.eu/flashax/iefax.cab
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{10d73171-25eb-4d80-ad30-1cb8824e76c2} - (no file)
BHO-{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - (no file)
WebBrowser-{B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - (no file)
Notify-dbgmgr - ifcmgr32.dll
Notify-shdosbei - (no file)
AddRemove-Workshop DeskManager2.5.4 - c:\windows\iun6002.exe
AddRemove-Yenka - G:\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-11-10 01:46
Windows 5.1.2600 Service Pack 3 FAT NTAPI
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1614895754-2111687655-725345543-1003\RemoteAccess\Profile\xÞt`Þt*]
"EnableAutodisconnect"=dword:00000001
"EnableExitDisconnect"=dword:00000001
"DisconnectIdleTime"=dword:00000014
.
[HKEY_USERS\S-1-5-21-1614895754-2111687655-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{76075D0A-5877-3148-F15B-6C01A7447186}*]
"iaejobhgakeoicigfe"=hex:6a,61,68,6b,62,62,61,61,6b,68,69,67,6c,6f,6a,61,70,62,
6a,6d,00,40
"hacjacihbfjmibfg"=hex:6b,61,68,6b,68,62,6f,70,65,66,62,67,6c,66,6e,6c,61,63,
6b,6d,61,6f,00,00
"haiomhnadfalecpo"=hex:61,61,00,00
"haiomhnanfknpink"=hex:61,61,00,00
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{76075D0A-5877-3148-F15B-6C01A7447186}\InProcServer32*]
"jaohjlkgpifihjhfgidf"=hex:6a,61,68,6b,62,62,61,61,6b,68,69,67,6c,6f,6a,61,70,
62,6a,6d,00,40
"iaohhmilinnihhcppm"=hex:6b,61,68,6b,68,62,6f,70,65,66,62,67,6c,66,6e,6c,61,63,
6b,6d,61,6f,00,00
"iaohfpbcbnopegemad"=hex:61,61,00,00
"iaohfpbcbnmpknecfd"=hex:61,61,00,00
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Hardware Profiles\0001\System\CurrentControlSet\Enum\¬ Å*"*\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3012)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\program files\Common Files\Microsoft Shared\Ink\SKCHUI.DLL
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\wdfmgr.exe
c:\windows\SOUNDMAN.EXE
c:\windows\ALCWZRD.EXE
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2011-11-10 01:50:00 - machine was rebooted
ComboFix-quarantined-files.txt 2011-11-09 23:50
.
Pre-Run: 3,460,710,400 bytes free
Post-Run: 4,255,105,024 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
.
- - End Of File - - 1EFC8C8906ABAEBD1975CE28EF21DE85[/FONT][/CODE]


----------



## reventon (Oct 16, 2009)

*Re: xp sound problem*

Hi,

You should post in the Virus/Trojan/Spyware Help Forum for assistance by a trained analyst.

Make sure you follow THESE STEPS carefully before posting in the Security Forum.


----------



## blago (Nov 9, 2011)

*Re: xp sound problem*

thank you,Reventon! if i should post in another location i think it must be in the "Microsoft support".
anyway if must be moved-please.i'll be happy to resolve my problem.


----------



## reventon (Oct 16, 2009)

*Re: xp sound problem*

I've created the thread in the Malware help forum for you, I believe you had already posted most of the information needed. You can find it here - http://www.techsupportforum.com/forums/f50/xp-sound-problem-virus-611629.html#post3506630

A trained malware analyst should assist you within 72 hours. This thread is now closed for the time being, if you wish to have it re-opened (when the malware analyst has cleared your system) please PM me.


----------



## blago (Nov 9, 2011)

*Re: xp sound problem*

hello friends!after long manual search in both OS's regisry i found the missing key.now i have 2 perfectly function OS-one 5-5,5 y.o. second few days.


*THANKS EVERYONE*,PROBLEM SOLVED!
solution:
export from good reg. and merge to "broken" one


----------

