wdmaud. sys (computer virus?)

[moosepie]

Well, I was searching in the forums for reasons why my search engines were being redirected to random links, and I found out the problem was the wdmaud. sys. 
However, I'm having trouble deleting it---

When I try to, a window pops up saying Cannot delete wdmaud: Access is denied. make sure the disk is not full or write protected and that the file is currently not in use.   

I renamed the wdmaud as well, tried to copy and paste it into recycling bin, but nothing has worked.

Also, I'm not sure if this is the same virus or not, but random exe. files pop up before I log on to the computer.  It keeps telling me to terminate the program, which I don't since it looks fishy.   I keep pressing the X button on the corner, but it keeps popping up as the same file or a new random one. Is this also caused by the wdmaud or am I dealing with something else?

I can post logs, but it will be my first time doing so.  (I'm a computer challenged person..)

Any help will do! Thanks in advance!

[evilfantasy]

@ IntegrityCompuTech I'm just going to remove your posts from now on.

wdmaud is a system file and can not be deleted.

[moosepie]

Wait! I even read it on another site!

It says here:
Important: Some malware camouflage themselves as wdmaud.sys, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the wdmaud.sys process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.

http://www.file.net/process/wdmaud.sys.html

Bad WDMAUD.SYS and hijacked google search...
Also: http://www.symantec.com/connect/forums/bad-wdmaudsys-and-hijacked-google-search

Please don't delete it! I need help. I'm sorry for sounding dumb.

[moosepie]

Also, I found out how to delete it too. But it didn't work.   

[evilfantasy]

Can you get any of the scans to run from here? http://www.computerhope.com/forum/index.php/topic,46313.msg290095.html#msg290095

Skip down and start with the CCleaner step and go from there.

[moosepie]

I'm going to start now!

Please check back though--just in case it doesn't work.

Thank you very much!

[moosepie]

I can't install the SUPERAntiSpyware...

It says:

Installation ended prematurely because of an error.

Can I move on still?

[evilfantasy]

Try Malwarebytes.

[moosepie]

okay. I did malware, but I lost my internet connection on the infected computer. 
It says on my firefox page--  Proxy Server Refused Connection.
Firefox ix configured to use a proxy server that is refusing connections. 

What can I do now?

Thanks!

I have the malwarebytes log on the infected comp, I can transfer it into my flashdrive onto this computer. But, will my flashdrive get infected and transfer the trojans onto the working comp?

[evilfantasy]

Go to Start > Control Panel - If you are using Windows XP's Category View, select the Network and Internet Connections category. If you are in Classic View, go to the next step.

* Double-click the Network Connections icon.
* Right-click the Local Area Connection icon and select Properties.
* Highlight Internet Protocol (TCP/IP) and click the Properties button.
* Be sure Obtain DNS server address automatically is selected.
* OK your way out.

Go to Start > Run and type in cmd
Click OK

* This will open a command prompt.
* Type the following line in the command window:
 
 ipconfig /flushdns (note the space between ipconfig and /)

* Press Enter on the keyboard.
* Exit the command window

Now restart your computer.

Post the Malwarebytes log.

[moosepie]

Well, the internet connection isn't back.. but.

I have the malwarebytes log on the infected comp, I can transfer it into my flashdrive onto this computer. But, will my flashdrive get infected and transfer the trojans onto the working comp?

[evilfantasy]

You need to try and repair the connection.

Are you using IE7?

• Open Internet Explorer, click the Tools button, and then click Internet Options.
  
• Click the Connections tab.
  
• Click the first entry in the Dialup and Virtual Private Networks list, and then click Settings.
  
• Select the Automatically detect settings check box, and then click OK.
  
• Repeat the previous two steps for each entry in the Dialup and Virtual Private Networks list.
  
• Click the Lan Settings button in the Connections tab, and repeat steps 4-6. Click OK on the Connections tab.
  
• Close Internet Explorer, and then restart it.

[moosepie]

I have it, but I don't use IE7 at all.   I use Mozilla Firefox. 

[evilfantasy]

Use IE to try the repair.

[moosepie]

I tried, but it didn't work.  Should I call the service provider?

[evilfantasy]

Your online posting here so it isn't your service.

o Start > Run (Start search in Vista) then type in: cmd

Click OK (in Vista, while holding CTRL, and SHIFT, press Enter).

At the Command Prompt, type in:

netsh winsock reset catalog

On the keyboard press Enter.

Do that again and type in:

netsh int ip reset reset.log

Press Enter.

Restart the computer.

Note: Resetting the Winsock using netsh winsock reset catalog command in SP2 removes all  the third-party LSPs and restores Winsock to factory default setting. Existing programs that uses their own LSPs need to be reinstalled again. Example: Google Desktop Search.

----------

Go Start > Run (Start search in Vista) and type in: cmd

Click OK (in Vista, while holding CTRL, and SHIFT, press Enter).

In the Command Prompt window type in following commands, and press Enter after each one:

ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew

Note the space before the forward slash /

Restart the computer.

Is it connecting now?

[moosepie]

It isn't, but thanks for all your help!

I'm going to take it to a repair shop on Monday.. since I'm probably doing something wrong. 

[evilfantasy]

Have you tried resetting your router? If you can't find the reset button (hold it in for 10 seconds) then just unplug it for 10 seconds then plug it back in.

[Infested]

I have the same file, except it's named wdmaud.drv.

I tried straight deleting it with malwarebytes fiile assassin, then the computer won't start normally and will crash before loading windows. If I move it, then the google searches work normally but then the file comes back after a minute or two. So I'm sure there's another file regenerating it. I somehow revived the computer, but the file keeps coming up.

I ran Malwarebyes and nothing really comes up.

[evilfantasy]

Never delete a file unless you are 100% sure you know what it is.

Wdmaud.drv is a WDM Audio driver mapper.
wdmaud.drv is a part of Microsoft® Windows® Operating System.
Manufacturer: Microsoft Corp.
www.microsoft.com

Also please start a new topic for your computer.