Vesh Wolf

Ok, I've started the scan, but it's going very slow. I just wanted to post in here so you know I'm working on what you asked, just in case it doesn't finish before the 24 hour mark.

Vesh Wolf

Ok, here is the result of that scan.

10980281.FIL.OLD;C:\$VAULT$.AVG;Trojan.MulDrop.8705;Deleted.;
42192468.FIL.OLD;C:\$VAULT$.AVG;Trojan.PWS.LDPinch.3651;Deleted.;
ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe/data002;Program.PsExec.171;;
data002;C:\Documents and Settings\HP_Administrator\Desktop;Archive contains infected objects;;
ComboFix.exe;C:\Documents and Settings\HP_Administrator\Desktop;Container contains infected objects;Moved.;
xampp-win32-1.6.7-installer.exe\data220;C:\Documents and Settings\HP_Administrator\Desktop\SHORTCUTS\Utilities\xampp-win32-1.6.7-installer.exe;Program.PrcView.3725;;
xampp-win32-1.6.7-installer.exe;C:\Documents and Settings\HP_Administrator\Desktop\SHORTCUTS\Utilities;Archive contains infected objects;Moved.;
aolcinst.exe\core.cab\GTDOWNAO_106.ocx;C:\Program Files\Online Services\Aol\United States\AOL90\comps\coach\aolcinst.exe;Adware.Gdown;;
aolcinst.exe;C:\Program Files\Online Services\Aol\United States\AOL90\comps\coach;Archive contains infected objects;Moved.;
aolcinst.exe\core.cab\GTDOWNAO_106.ocx;C:\Program Files\Online Services\Aol\United States\AOL90E\comps\coach\aolcinst.exe;Adware.Gdown;;
aolcinst.exe;C:\Program Files\Online Services\Aol\United States\AOL90E\comps\coach;Archive contains infected objects;Moved.;
A0333759.OLD;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008;Trojan.MulDrop.8705;Deleted.;
A0333760.OLD;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008;Trojan.PWS.LDPinch.3651;Deleted.;
A0333762.exe\data220;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008\A0333762.exe;Program.PrcView.3725;;
A0333762.exe;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008;Archive contains infected objects;Moved.;
A0333763.exe\core.cab\GTDOWNAO_106.ocx;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008\A0333763.exe;Adware.Gdown;;
A0333763.exe;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008;Archive contains infected objects;Moved.;
A0333764.exe\core.cab\GTDOWNAO_106.ocx;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008\A0333764.exe;Adware.Gdown;;
A0333764.exe;C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1008;Archive contains infected objects;Moved.;
pv.exe;C:\xampp\apache\bin;Program.PrcView.3725;;
xampp-win32-1.6.5-installer(2).exe\data207;F:\My Downloads\DOWNLOADS\Installation Proggies\Utility Programs\xampp-win32-1.6.5-installer(2).exe;Program.PrcView.3725;;
xampp-win32-1.6.5-installer(2).exe;F:\My Downloads\DOWNLOADS\Installation Proggies\Utility Programs;Archive contains infected objects;Moved.;
keygen1.exe;F:\My Downloads\DOWNLOADS\Installation Proggies\Games\ElfBowlingInsult\Reflexive Arcade Games Universal Keygen;Trojan.DownLoad.25562;Deleted.;
1Click DVD Copy 5.0.2.1 Patch.exe;F:\My Downloads\DOWNLOADS\Installation Proggies\Audio-Video\1Click DVD Copy 5.0.2.1;Tool.ASEye.2;;


I hope this is all you needed. :)

Billy O'Neal

Still getting spoolsv errors?

Billy3

Vesh Wolf

Unfortunately yes. It occurs 3 times during startup; that's the only time though
and now my PowerArchiver program isn't working. I did a clean uninstall and reinstall and it won't come up. It shows up in the task manager under services that's it's running but it never comes up when i click open

Billy O'Neal

What scan program is running in the background here -> http://www.techsupportforum.com/2028632-post19.html ?

Billy3

Vesh Wolf

It's a rootkiller program called Partizan always runs at the very start of my pc booting up; however I have deleted that program since the screencap was taken and I have rebooted twice and so far (eyes, fingers and toes crossed here) I have not encountered the spoolsv error messages but am still unable to access my Powerarchiver program.

Billy O'Neal

Hello, Vesh Wolf
That explains the broken BootExecute keys we had earlier :P

How are you starting it? Double clicking on an archive, or by going to it on the start menu? How long has the issue occured?

Billy3

Vesh Wolf

I double-click on the powerarchiver program and wait, and wait, and wait..lol it never comes up, but as I stated earlier, the program shows up in the task manager it's memory useage.

Billy O'Neal

Hmm.. without an error message or something of the kind it's difficult to know what's going on.

What happens if you double click on a ZIP?

What version of power archiver are you using?

Billy3

Vesh Wolf

When I click on a zip file, I get the same thing, shows up in task manager, but file never opens up. I am using PowerArchiver 2009

Billy O'Neal

Please try downloading the 2010 version from here and see if that helps-> http://dl.powerarchiver.com/2010/powarc1150b1.exe

Billy3

Vesh Wolf

I have the newest version, and I also have paid for it. I am not sure why, but it still will not let me open the program, nor will it open a file by double clicking on it.

Billy O'Neal

Alright... please download a brand new copy of ComboFix and try that once more please.

Billy O'Neal

Hello, Vesh Wolf
Are you still here?

Billy3

Vesh Wolf

Sorry for the delay, real life situation. Ok, I downloaded the Powerarchiver2010, did the same thing. so did a complete uninstall of the 2010 and re-installed the 2009 version and still the same thing; shows up in the taskmanager as running under processes, yet never comes up. i double click on the program itself nothing; I double click on a zippef folder; once again nothing. any ideas?

Billy O'Neal

Hello, Vesh Wolf
Alright.. either I missed something or there's something hiding -- or -- this isn't a malware issue. I want to get a set of new logs to check once more as the other ones are out of date by now.

We need to create an OTListIt2 Report

1. Please download OTListIt2 from one of the following mirrors:
   • This is THE Mirror
2. Save it to your desktop.
3. Double click on the icon on your desktop.
4. Click the "Scan All Users" checkbox.
5. Push the button.
6. Two reports will open, copy and paste them in a reply here:
   • OTListIt.txt <-- Will be opened
   • Extra.txt <-- Will be minimized

We need to scan for Rootkits with GMER

1. Please download GMER from one of the following mirrors:
   • This is the Primary mirror
   • This is a Secondary mirror
   • This is a Secondary mirror
2. Close any and all open programs, as this process may crash your computer.
3. Unzip the downloaded file to your desktop.
4. Double click on your desktop.
5. Allow the gmer.sys driver to load if asked.
6. You may see this window. If you do, click No.
   
7. Click on and wait for the scan to finish.
8. If you see a rootkit warning window, click OK.
9. Push and save the logfile to your desktop.
10. Copy and Paste the contents of that file in your next post.

In your next reply, please include the following:

• OTListIt.txt
• Extra.txt
• GMER's Log

Billy3

Vesh Wolf

Just as an update... I've attempted to run the GMER several times, and it's always interrupted by one crash or another which disables Me from saving. I'm attempting to run it in safe mode, although I'm not sure that will actually help or not. Also, I never got an extras report to open with the OTListit. As soon as I get the GMER scan finished, I'll post what I do have.

Billy O'Neal

Hello, Vesh Wolf
Please try running RootRepeal instead of GMER :)

We Need to check for Rootkits with RootRepeal

1. Download RootRepeal from the following location and save it to your desktop:
   • RootRepeal
2. Extract RootRepeal.exe from the zip archive.
3. Open on your desktop.
4. Click the tab.
5. Click the button.
6. Check all six boxes:
7. Push Ok
8. Check the box for your main system drive (Usually C:), and press Ok.
9. Allow RootRepeal to run a scan of your system. This may take some time.
10. Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

In your next reply, please include the following:

• RootRepeal Log

Billy3

Vesh Wolf

Log is attatched

Also, the power archiver has started working, and I have no idea why, but I dont trust it after it stopping just as suddenly as it started.

Attached Files

RootRepeal.txt (4.4 KB, 1 views)

Billy O'Neal

Hello :)

Appears to be a Sygate component -> http://www.file.net/process/wpsdrvnt.sys.html

Please uninstall Sygate Personal Firewall. Then see if GMER and PowerArchiver work :)

Thanks and good luck!

Billy3