SigmaTel file in my control panel

Question

I've got this new file called Sigma Tel that indicates that it is supposed to have something to do with making my laptop battery run more efficiently.  Every time I open control panel, I get an error message, and then find the file has duplicated itself.  I did a system restore, but it's happening again.  I've run MacAfee virus scan, and it did not find any virus.  I think this thing has messed up my printserver, also; I can't use the printer any more.   Help?

Midnight Star · Answer

KenandAustin, We need the specific error messages your getting. Have you tried running an online virus scan, AdAware or Spybot just to see what turns up? Mike.

Midnight Star · Answer

KenandAustin,

Ok, let's see what you've got running on that system:

Download HiJackThis, unzip and run it. Click"Scan" then "Save log" (it'll be the same button). when Notepad pops-up, select-all text, then copy and paste it back as a reply to this post. Don't fix anything with it just yet, as most of what it reports is good. Close both HiJackThis and Notepad.

Mike.

KenandAustin · Answer

I ran the adware scan, and still nothing showed up.  I do have a stinger.opt icon on my desktop, but can't find the link that told me what to do with it.  The error message that I get when I open the control panel is 'An error occurred while Windows was working with the Control Panle file C:\WINDOWS\system32
etsetup.cpl'  After I click okay to get into the control panel page, I get multiple copies of the SigmaTel icon.  Right now, there are four, but I've had up to 400+ copies showing up.

Midnight Star · Answer

Ken,

Try this:

http://67.19.72.100/download.php?det=3155

http://www.softpedia.com/get/Internet/Popup-Ad-Spyware-Blockers/HijackThis.shtml

http://www.net-integration.net/tools/hijackthis.html

-----

Also, look for, and paste back the contents of the following file:

c:\windows\system32\drivers\etc\hosts

-----

Mike.

KenandAustin · Answer

Every time I try to go to the Hijackthis page, and try to download the program, I get directed to different spyware removal programs.  I went to AlertSpy and downloaded their free download; there are six infected files, but is this the program you suggested I use?   Ken

KenandAustin · Answer

Okay, I think I've got this log copied correctly.  And no, I did not try to fix anything yet..... thanks for your help with this.  Logfile of HijackThis v1.99.0Scan saved at 12:51:58 AM, on 12/29/2004Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exec:\PROGRA~1\mcafee.com\vso\mcvsrte.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exec:\PROGRA~1\mcafee.com\vso\mcshield.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\igfxtray.exeC:\WINDOWS\System32\hkcmd.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Dell\AccessDirect\dadapp.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\WINDOWS\System32\DSentry.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\WINDOWS\system32\wfxsnt40.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeC:\Program Files\Verizon Online\Visual IP InSight\IPClient.exeC:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXEC:\WINDOWS\system32\ctfmon.exec:\progra~1\mcafee.com\vso\mcvsftsn.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\System32\wbem\wmiapsrv.exeC:\Program Files\MSN\MSNCoreFiles\MSN.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\AlertSpy\AlertSpy.exeC:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXEC:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEC:\DOCUME~1\Ken\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://smbusiness.dellnet.com/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smbusiness.dellnet.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon OnlineR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dllO2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dllO3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dllO3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dllO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exeO4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe'O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exeO4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exeO4 - HKLM\..\Run: [IPInSightLAN 01] 'C:\Program Files\Verizon Online\Visual IP InSight\IPClient.exe' -lO4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\Program Files\Verizon Online\Visual IP InSight\IPMon32.exe'O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [msnappau] 'C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe'O4 - HKLM\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P24 'EPSON Stylus Photo RX600' /O6 'USB001' /M 'Stylus Photo RX600'O4 - HKLM\..\Run: [SupportAnyPC] 'C:\DOCUME~1\Ken\LOCALS~1\Temp\winvnc.exe' -servicehelperO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /backgroundO4 - HKCU\..\Run: [EPSON Stylus Photo RX600] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2M1.EXE /P24 'EPSON Stylus Photo RX600' /M 'Stylus Photo RX600' /EF 'HKCU'O4 - Startup: PowerReg Scheduler V3.exeO4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dllO9 - Extra button: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.ExeO9 - Extra 'Tools' menuitem: Control Pad - {28D44DAD-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:\Program Files\Verizon Online\Verizon Online Control Pad\VerizonControlPad.ExeO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dllO16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://usercenter.cox.net/rsuite/sdccommon/asp/cx_tgctlcm.jspO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cabO16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exeO16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://webchat.dell.com/Media/VisitorChat/TLIEFlash.CABO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dllO16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4416/mcfscan.cabO23 - Service: EPSON V3 Service2(03) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP1.EXEO23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exeO23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exeO23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

KenandAustin · Answer

What program do I use to open the hosts file? Ken

Texruss · Answer

Delete this file:  C:\WINDOWS\system32
etsetup.cpl   Windows will recreate it upon reboot. It's a wireless network Control Panel Extension and is probably corrupt.   You have a few malware entries in HJT, but nothing terribly bad. Write back tomorrow and Mike or myself will give you final cleanup.   Cheers,   Texruss

zbestwun2001 · Answer

Try deleteing the file in Safe Mode.
Tap the F8 key when the Dell logo appears when you power up.
Arrow up to Safe Mode and hit Enter.
Things will appear different but you can find the file and try deleteing it that way.

Steve

KenandAustin · Answer

I found the file through Window's Explorer, but it won't let me delet it. The message says that it's either write protected or in use. I closed all other programs, and removed the wireless card, but it still wouldn't let me delete the file. Can I get to it going thru another direction?

Thanks,
Ken

Texruss · Answer

Yes, try Steve's suggestion for Safe Mode and if it still resists right button click and left on Properties. Remove check for Read Only. HTH, Texruss

KenandAustin · Answer

Okay, I went into safe mode, found the file and deleted it.  Then I restarted the computer, checked the control panel, and there was only 1 SigmaTel icon.  I closed control panel, re-opened it, and now there are four icons.  I can print okay now, but I'm concerned about logging onto my office network....I don't want this to spread anywhere.....  are there other items to clean up in the log?

Midnight Star · Answer

KenAndAustin,   Have your tried any online scans, just for a second set of 'eyes'?   Mike.

KenandAustin · Answer

Sorry, no I haven't tried anything like that.  Suggestions?   Ken

Texruss · Answer

Download the Sysclean Package (the 2.3 MB file for non-TrendMicro customers).

http://www.trendmicro.com/download/dcs.asp

Readme file: http://www.trendmicro.com/ftp/products/tsc/readme.txt

Download this file to the same folder you download the Sysclean program to and unzip it into the Sysclean folder.

http://www.trendmicro.com/ftp/products/pattern/lpt327.zip

Run Sysclean in Safe Mode.

Report back with a fresh log.

Virus & Spyware

SigmaTel file in my control panel

Was this post helpful?