How do I get rid of "Sonic Activation Module?"

[farmerjohn1324]

I have this thing called "Sonic Activation Module" that always comes up. I deleted it from Control Panel (Add/Remove Programs), but it still comes up and tries to reinstall every time I restart the machine. It comes up saying "Windows Installer...."

I don't know what it even is, but I'm pretty sure I don't need it.

It asks me for an installation disk every time, which I don't have, or want.

 

[voyagerfan99]

Open MSCONFIG and disable it from starting up on startup.

 

[Agent Smith]

Install autoruns, save the ARN file and upload to a file uploding site like drop box and save here.

 

[farmerjohn1324]

How do I get autoruns?

 

[C4C]

Here http://download.cnet.com/Autoruns/3000-2094_4-10744886.html

Or any other link on Google.

 

[johnb35]

If you can, just reinstall the program and then use revo to uninstall it cleanly. The problem is that there are leftover files somewhere on the system causing this. Autoruns most likely won't help with this.

 

[farmerjohn1324]

I can't reinstall because it asks me for a disc which I don't have. I don't even know what this program is in the first place.

 

[Agent Smith]

Install Autoruns, save the ARN file and upload here. https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

It should show what is starting up and I can tell you what to nuke.

 

[farmerjohn1324]

How do I upload the .arn file to that wesbite? I couldn't see where to do that.

I uploaded it here if that would help...

https://www.dropbox.com/s/5tt1lob1uzm624q/arn.arn?dl=0

 

[Agent Smith]

Did you go into Autoruns and click save? The arn file you uploaded is blank. When you save it should be named AutoRuns.arn

When I said upload here I meant to this forum. The link I provided was to Autoruns.

 

[farmerjohn1324]

Autoruns

By default, they called it TONYLAPTOP.arn

https://www.dropbox.com/s/ajau7gzlrl2f195/TONYLAPTOP.arn?dl=0

I couldn't upload it to this forum. It failed when I tried.

Does this one work?

 

[Agent Smith]

I noticed you have Vosteran installed. Follow this guide to remove it. http://www.vosteransearch.com/how-to-remove/


To remove the autostart of the Sonic activation module type in sonic in the autoruns search box and untick PxHelp20. See image.

If after you restart your computer and the Sonic activation module still shows up, run hijackthis and post your log. The Sonic activation module is a service which is an O23 entry in Hijackthis.

Better yet, unregister the .DLL and remove the service. The above process is just not activating (for lack of a better word) the .DLL when you start your computer.

To remove the service go into command and enter: sc delete pxhelp20. Notice the spaces. To unregister the .DLL go to command and enter regsvr32 /u PxHelp20.sys in the command prompt. Note the spaces between /u and PxHelp20.sys

Make sure you remove the service before you unregister the .DLL.

If you are not running Windows XP, (which I think you are), then you need to run command with an elevated command prompt by right clicking CMD and select Run as administrator.

 

[farmerjohn1324]

Sonic

Thanks.

The service was deleted successfully, but when I try the regsvr32, I get a box that says

"RegSvr32

LoadLibrary("PxHelp20.sys") failed - The specified module could not be found."

Maybe that's a good thing and means that it's not there in the first place?

 

[Agent Smith]

Does the Sonic activation module still show up on restarting the computer?

Go into Autoruns and in the search box type in sonic and see if that .DLL shows up.

 

[farmerjohn1324]

PxHelp20

Sonic no longer shows up on startup, and PxHelp20 does not show up in AutoRuns.

These sound like good things.

 

[Agent Smith]

Told you I could nuke this. LOL! It's odd the .DLL is gone because you just removed the service.

Did you take care of that Vosteran I talked about in post #12?

You may want to also run Adwcleaner and Superantispyware for good measure.

 

[farmerjohn1324]

Vosteran didn't show up when I looked for it.

 

[Agent Smith]

Type in vosteran in the search box of Auto Runs. If you see At2.job uncheck it or just delete it would be better.

Actually, looking at your Auto Runs log again go to the Scheduled Tasks tab and you will see At1.job and At2.job. Delete both if present.

http://www.exterminate-it.com/malpedia/file/at1.job

It must be an old entry.

 

[farmerjohn1324]

At1 and At2

They were both present and I deleted them.

Is it then necessary to go to the file like you said to delete it that way, too?

 

[Agent Smith]

Is it then necessary to go to the file like you said to delete it that way, too?

I don't understand?

In Autoruns? Or are you referring to the commands you use in CMD? That was just for the activation module.