Malware Removal Forums

Spool.exe Annoyance

srcstcbstrd · 2010-12-22T02:39:46+00:00

Hi, I noticed a couple of days ago that my computer was getting really slow. So I used the following to see if I could clean it up - Super AntiSpyware, CCleaner, Advanced System Care, a-Squared Antimalware and they come up with a few tracking cookies. I cleaned up the hard drive with Window Washer and defragged all the drives. Then I started getting this really annoying C:\Windows\System32\Spoolsv.exe message pop up every minute or so. So after Googling the problem, I double checked my printer and couldn't find it. I removed the HP Deskjet 2050 program, restarted and reloaded the program. Rebooted again but still getting the message and it is hanging up my computer. Also still can't find my printer on the Control Panel or Device Manager. I also went into Run > Service.msc and made sure that the Spool was started by right hand clicking on it. It was stopped. Still getting the Runtime alert. Here's what I've got: HP a6110n AMD Athlon dual processor 2.3GHz Windows Vista Home Premium 32 bi

72 min read

turtledove

December 26, 2010, 11:26 AM UTC

Good Day srcstcbstrd,

Please copy to notepad for reference. Read CAREFULLY please the second scan instructions - MBRCheck.
There are a couple files I need examined:

Upload File/Files for testing

Please go to jotti.org or Virustotal

Copy/paste each file separately into the white box at the top:

c:\windows\is-4CR4U.exe
c:\program files\SB2010_setup.msi

Press Submit - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

Or if to busy: try later or the second link Virustotal

When ALL scanners finish, copy to notepad and then paste here.

MBRCheck

MBRCheck.exe

desktop

Right click on MBRCheck.exe and select " Run as administrator " to run it.
A window similar to this should open on your desktop:

If you are prompted with options, enter N at the prompt and press Enter
Press Enter again.
A log will open on your Desktop ...... MBRCheck_mm.dd.yy_hh.mm.ss.txt (where mm.dd.yy_hh.mm.ss are the date and time the scan was run)
Please post the contents of the log in your next reply.

Post
Results of the Jotti or Virustotal scan(s)
Results of MBRCheck

Thank you

turtledove

srcstcbstrd

December 26, 2010, 5:24 PM UTC

Hey turtledove:
Could only do one of the two files with Jotti or VirusTotal. c:\program files\SB2010_setup.msi is 148Mb whereas the two sites have a 20Mb limit. I'm still trying to run it through Jotti but it is not cooperating. VirusTotal is too busy. MBRCheck log is at the bottom.
I sure hope you can find something - this piece of crap is getting slower and slower. Still can't set up the printer either. Still getting the spoolsv alert. I'm almost to the point of chucking it and buying a new system.

c:\windows\is-4CR4U.exe
Filename: isRS-000.tmp
Status:
Scan finished. 0 out of 19 scanners reported malware.
Scan taken on: Sun 14 Nov 2010 05:46:39 (CET) Permalink

Additional info
File size: 711168 bytes
Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5: 296a2fac6a99515a8a57d6af147890e6
SHA1: 44e5e5bedf8527fd15a25ff0fab1cd8cd34b82a8

Scanners
[ArcaVir]
2010-11-14 Found nothing
[G DATA]
2010-11-13 Found nothing
[Avast! antivirus]
2010-11-13 Found nothing
[Ikarus]
2010-11-13 Found nothing
[Grisoft AVG Anti-Virus]
2010-11-13 Found nothing
[Kaspersky Anti-Virus]
2010-11-13 Found nothing
[Avira AntiVir]
2010-11-13 Found nothing
[ESET NOD32]
2010-11-14 Found nothing
[Softwin BitDefender]
2010-11-14 Found nothing
[Panda Antivirus]
2010-11-13 Found nothing
[ClamAV]
2010-11-14 Found nothing
[Quick Heal]
2010-11-12 Found nothing
[CPsecure]
2010-11-14 Found nothing
[Sophos]
2010-11-14 Found nothing
[Dr.Web]
2010-11-14 Found nothing
[VirusBlokAda VBA32]
2010-11-12 Found nothing
[Frisk F-Prot Antivirus]
2010-11-13 Found nothing
[VirusBuster]
2010-11-13 Found nothing
[F-Secure Anti-Virus]
2010-11-14 Found nothing

c:\program files\SB2010_setup.msi

the file limit is 20Mb on each service. This file is 143Mb. They're no cooperating.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: ASUSTek Computer INC.
BIOS Manufacturer: Phoenix Technologies, LTD
System Manufacturer: HP-Pavilion
System Product Name: GG781AA-ABA a6110n
Logical Drives Mask: 0x000005fc

Kernel Drivers (total 145):
0x81C1C000 \SystemRoot\system32\ntkrnlpa.exe
0x81FD5000 \SystemRoot\system32\hal.dll
0x80600000 \SystemRoot\system32\kdcom.dll
0x80607000 \SystemRoot\system32\PSHED.dll
0x80618000 \SystemRoot\system32\BOOTVID.dll
0x80620000 \SystemRoot\system32\CLFS.SYS
0x80661000 \SystemRoot\system32\CI.dll
0x80741000 \SystemRoot\system32\drivers\Wdf01000.sys
0x807BD000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x82206000 \SystemRoot\System32\Drivers\spkh.sys
0x82306000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x8230F000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x82335000 \SystemRoot\system32\drivers\acpi.sys
0x8237B000 \SystemRoot\system32\drivers\msisadrv.sys
0x82383000 \SystemRoot\system32\drivers\pci.sys
0x823AA000 \SystemRoot\System32\drivers\partmgr.sys
0x823B9000 \SystemRoot\system32\drivers\volmgr.sys
0x87607000 \SystemRoot\System32\drivers\volmgrx.sys
0x87651000 \SystemRoot\system32\drivers\pciide.sys
0x87658000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x87666000 \SystemRoot\System32\drivers\mountmgr.sys
0x87676000 \SystemRoot\system32\drivers\atapi.sys
0x8767E000 \SystemRoot\system32\drivers\ataport.SYS
0x8769C000 \SystemRoot\system32\drivers\nvstor32.sys
0x876B9000 \SystemRoot\system32\drivers\storport.sys
0x876FA000 \SystemRoot\system32\drivers\fltmgr.sys
0x8772C000 \SystemRoot\system32\drivers\NIS\1108000.005\SYMDS.SYS
0x87782000 \SystemRoot\system32\drivers\fileinfo.sys
0x87792000 \SystemRoot\system32\drivers\NIS\1108000.005\SYMEFA.SYS
0x877BF000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x877C8000 \SystemRoot\system32\DRIVERS\symsnap.sys
0x8780C000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8787D000 \SystemRoot\system32\drivers\ndis.sys
0x87988000 \SystemRoot\system32\drivers\msrpc.sys
0x879B3000 \SystemRoot\system32\drivers\NETIO.SYS
0x87A09000 \SystemRoot\System32\drivers\tcpip.sys
0x87AF3000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x87C00000 \SystemRoot\System32\Drivers\Ntfs.sys
0x87D10000 \SystemRoot\system32\drivers\volsnap.sys
0x87D49000 \SystemRoot\System32\Drivers\spldr.sys
0x87D51000 \SystemRoot\System32\Drivers\mup.sys
0x87D60000 \SystemRoot\System32\drivers\ecache.sys
0x87D87000 \SystemRoot\system32\drivers\disk.sys
0x87D98000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x87DB9000 \SystemRoot\system32\drivers\crcdisk.sys
0x87DCF000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x87DDA000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x87DE3000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x87B0E000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x87DF3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x87DC2000 \SystemRoot\system32\DRIVERS\PS2.sys
0x87B21000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x87B2C000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x87B36000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x87B74000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x87B83000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x87B93000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x87BA1000 \SystemRoot\system32\DRIVERS\dlkfet5b.sys
0x87BAC000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C602000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8C78F000 \SystemRoot\System32\Drivers\AnyDVD.sys
0x8C7A8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8C7C0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8CE03000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8D522000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8D5C3000 \SystemRoot\System32\drivers\watchdog.sys
0x8D5CF000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C7C3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C7CE000 \SystemRoot\system32\drivers\nchssvad.sys
0x8C68F000 \SystemRoot\system32\drivers\portcls.sys
0x8C6BC000 \SystemRoot\system32\drivers\drmk.sys
0x8C6E1000 \SystemRoot\system32\drivers\ks.sys
0x8C70B000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C722000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8C750000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8C773000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C7DA000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8C72D000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8C7EE000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8D5FE000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8C742000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C782000 \SystemRoot\system32\DRIVERS\umbus.sys
0x87BB7000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x87BEC000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8E007000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8E23E000 \SystemRoot\System32\Drivers\NIS\1108000.005\SRTSP.SYS
0x8E295000 \SystemRoot\system32\drivers\NIS\1108000.005\Ironx86.SYS
0x8E2B4000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x8E2C9000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8E2CB000 \SystemRoot\system32\drivers\NIS\1108000.005\SRTSPX.SYS
0x9554C000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x95563000 \??\C:\Windows\system32\Drivers\SYMEVENT.SYS
0x95588000 \SystemRoot\system32\drivers\usbaudio.sys
0x955AE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x955B7000 \SystemRoot\System32\Drivers\Null.SYS
0x955BE000 \SystemRoot\System32\Drivers\Beep.SYS
0x955C5000 \SystemRoot\System32\drivers\vga.sys
0x955D1000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x955F2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8E2D5000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8E2DD000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8E2E8000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8E2F6000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8E2FF000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8E315000 \SystemRoot\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS
0x8E36E000 \SystemRoot\system32\DRIVERS\smb.sys
0x8E382000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8E3B4000 \SystemRoot\system32\drivers\afd.sys
0x877E9000 \SystemRoot\system32\DRIVERS\pacer.sys
0x879EE000 \SystemRoot\system32\DRIVERS\netbios.sys
0x823C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x823DB000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
0x955FA000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0x9F201000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x9F23D000 \SystemRoot\system32\drivers\nsiproxy.sys
0x9F247000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20101224.001\IDSvix86.sys
0x9F2A2000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x9F2AC000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0x9F30A000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0x9F327000 \SystemRoot\System32\Drivers\dfsc.sys
0x9F33E000 \SystemRoot\system32\drivers\NIS\1108000.005\ccHPx86.sys
0xA4609000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20101123.003\BHDrvx86.sys
0xA46B5000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x80EA0000 \SystemRoot\System32\win32k.sys
0xA46D8000 \SystemRoot\System32\drivers\Dxapi.sys
0xA46E2000 \SystemRoot\system32\DRIVERS\monitor.sys
0x810C0000 \SystemRoot\System32\TSDDD.dll
0xA46F1000 \SystemRoot\system32\drivers\luafv.sys
0xA4714000 \SystemRoot\system32\drivers\spsys.sys
0xA47C4000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA47D4000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xB080F000 \SystemRoot\system32\drivers\HTTP.sys
0xB087C000 \SystemRoot\system32\DRIVERS\bowser.sys
0xB0895000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xB08B4000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xB08ED000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xB091D000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
0xB3C0C000 \SystemRoot\system32\drivers\peauth.sys
0xB3CEA000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB3CF4000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB3D00000 \SystemRoot\system32\DRIVERS\v2imount.sys
0x81160000 \SystemRoot\System32\cdd.dll
0x95400000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20101225.007\NAVEX15.SYS
0xB3D08000 \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20101225.007\NAVENG.SYS
0x77350000 \Windows\System32\ntdll.dll

Processes (total 75):
0 System Idle Process
4 System
452 C:\Windows\System32\smss.exe
552 csrss.exe
604 csrss.exe
612 C:\Windows\System32\wininit.exe
648 C:\Windows\System32\services.exe
664 C:\Windows\System32\lsass.exe
676 C:\Windows\System32\lsm.exe
740 C:\Windows\System32\winlogon.exe
856 C:\Windows\System32\svchost.exe
900 C:\Windows\System32\nvvsvc.exe
928 C:\Windows\System32\svchost.exe
1028 C:\Windows\System32\svchost.exe
1064 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\svchost.exe
1192 C:\Windows\System32\audiodg.exe
1216 C:\Windows\System32\svchost.exe
1232 C:\Windows\System32\SLsvc.exe
1292 C:\Windows\System32\svchost.exe
1344 C:\Program Files\Windows SteadyState\SCTSvc.exe
1388 C:\Windows\System32\rundll32.exe
1512 C:\Windows\System32\svchost.exe
1764 C:\Windows\explorer.exe
1836 C:\Windows\System32\svchost.exe
1888 C:\Windows\System32\taskeng.exe
2000 C:\Windows\System32\CTSVCCDA.EXE
308 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
912 C:\Program Files\GFI\GFI Backup 2009 - Home Edition\GFIHInst.exe
1424 C:\Program Files\GFI\GFI Backup 2009 - Home Edition\GFIHSched.exe
1492 C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
1712 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1920 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
1904 C:\Program Files\Process Lasso\ProcessLasso.exe
1680 C:\Program Files\Process Lasso\ProcessGovernor.exe
1676 C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe
2068 C:\Windows\System32\rundll32.exe
2132 C:\Program Files\Norton Ghost\Agent\VProTray.exe
2156 C:\Program Files\Norton Ghost\Agent\VProSvc.exe
2192 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
2200 C:\Program Files\Windows SteadyState\Bubble.exe
2276 C:\Program Files\Windows Media Player\wmpnscfg.exe
2340 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
2348 C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
2424 C:\Windows\System32\svchost.exe
2460 C:\Windows\System32\dllhost.exe
2660 C:\Windows\System32\svchost.exe
2776 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
2952 C:\Windows\System32\SearchIndexer.exe
3044 C:\Program Files\Webroot\Washer\WasherSvc.exe
3140 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
3256 C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe
3560 C:\Windows\System32\wbem\unsecapp.exe
3652 C:\Windows\System32\UI0Detect.exe
3896 dllhost.exe
1212 C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe
2044 C:\Program Files\Windows Media Player\wmpnetwk.exe
2560 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
2224 C:\Windows\System32\taskeng.exe
5840 C:\Program Files\Free Download Manager\fdm.exe
3860 C:\Program Files\Norton Utilities 14\nu.exe
4320 C:\Windows\System32\VSSVC.exe
496 C:\Windows\System32\svchost.exe
3784 C:\Windows\System32\dfrgui.exe
908 C:\Windows\System32\Defrag.exe
5060 DfrgNtfs.exe
5584 C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
2096 C:\Program Files\Mozilla Firefox\firefox.exe
4068 C:\Program Files\Mozilla Firefox\plugin-container.exe
4364 C:\Program Files\Windows Media Player\wmplayer.exe
4240 C:\Windows\System32\mfpmp.exe
4600 C:\Windows\System32\SearchProtocolHost.exe
4788 C:\Windows\System32\SearchFilterHost.exe
5196 C:\Users\Owner\Desktop\MBRCheck.exe
5952 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000048`53c00000 (NTFS)
\\.\F: --> \\.\PhysicalDrive1 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: ST3500418AS, Rev: CC38
PhysicalDrive1 Model Number: WDC WD10EADS-00L5B1, Rev: 01.0

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Hewlett-Packard MBR code detected
SHA1: 161E5DF10EB9B6EAC4AA8DF99305EF77B11BEBD8
931 GB \\.\PhysicalDrive1 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Thanks for all the time you've spent on this. Hope to hear the results soon (and any suggestions as to what could be wrong if it isn't infected).

turtledove

December 27, 2010, 8:47 AM UTC

Good day srcstcbstrd,

I'm rechecking our previous steps and will return as soon as possible.
Thank you for the logs. I'd like you to do a scan online please.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Hold down Control then click on the following link to open a new window to ESET online scanner
Then click on:

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Now click on:
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on:
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Post
C:\Program Files\ESET\EsetOnlineScanner\log.txt

Thank you

turtledove

srcstcbstrd

December 27, 2010, 5:36 PM UTC

Good afternoon - here's the log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=02245070c2c3014c8dafbb8953df8f08
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-12-27 05:04:56
# local_time=2010-12-27 12:04:56 (-0500, Eastern Standard Time)
# country="Canada"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=3584 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776574 100 100 39612744 130051342 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=266152
# found=5
# cleaned=0
# scan_time=25678
C:\Qoobox\Quarantine\C\Program Files\Mozilla Firefox\components\nsaddestination.dll.vir probably a variant of Win32/Adware.GooochiBiz application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Owner\AppData\Roaming\OpenCandy\OpenCandy_AE8086E9756945E3B9D2592DDBF07119\p1v1_PPIRegistryReviver_w.exe a variant of Win32/SlowPCfighter application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Owner\Documents\Programs Downloaded\FFSetup2.zip a variant of Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Owner\Documents\Programs Downloaded\FFSetup220.zip Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I
F:\Most Recent Downloads\www.HotDDL.com_NIS2010_by_IMRAN_SAMSUDEEN_.rar Win32/Packed.Autoit.E.Gen application (unable to clean) 00000000000000000000000000000000 I

turtledove

December 28, 2010, 7:43 AM UTC

Good Day srcstcbstrd,

Copy these instructions please as you'll be off the internet during part of the fix.
**Vista users: Right Click, select Run as Administrator*

ComboFix - CFScript
WARNING !
This script is for THIS user and computer ONLY!
Using this tool incorrectly could damage your Operating System... preventing it from starting again!

You will not have Internet access when you execute ComboFix. All open windows will need to be closed!

Please open Notepad and copy/paste all the text below... into the window:



KILLALL::



File::

C:\Users\Owner\Documents\Programs Downloaded\FFSetup2.zip

C:\Users\Owner\Documents\Programs Downloaded\FFSetup220.zip

F:\Most Recent Downloads\www.HotDDL.com_NIS2010_by_IMRAN_SAMSUDEEN_.rar 

Folder::

C:\Users\Owner\AppData\Roaming\OpenCandy



DirLook::

C:\Users\Owner\Documents\Programs Downloaded

F:\Most Recent Downloads

Save it to your desktop as CFScript.txt
Please disable any Antivirus or Firewall you have active, as shown in this topic. Please close all open application windows.
Drag the CFScript.txt (icon) into the ComboFix.exe icon... as seen in the image below:

This will cause ComboFix to run again.
Do Not use your keyboard or mouse click anywhere in the ComboFix window, as this may cause the program to stall or crash.
Do Not touch your computer when ComboFix is running!
When finished... Notepad will open ... ComboFix will produce a log file called "log.txt".
Please copy/paste the contents of log.txt... in your next reply.

** Enable your Antivirus and Firewall, before connecting to the Internet again! **

Post
C:\ComboFix.txt

Thank you

turtledove

srcstcbstrd

December 28, 2010, 2:28 PM UTC

Whew!! I thought I was screwed. After ComboFix was done and rebooted my system, I couldn't open ANYTHING! It wasn't until a did another restart that everything came back (well at least this is working - so far). I'm still getting that incredibly nagging spoolsv.exe alert 4 or 5 times on startup. And...and...when I went to copy and paste the log to this post, the Runtime spoolsv.exe alert came back up to rear it's ugly head. When I acknowledged the alert, the screen went black and the computer froze. I had to do a hard reboot to get out of everything. I know you're doing your all but this thing is getting worse and worse - in fact, just now, while I was in the middle of 'getting worse and...' that bloody Runtime alert came back up. Here's the log:

srcstcbstrd

December 28, 2010, 2:29 PM UTC

Okay, I was in the middle of the log post when what happened above happened again. I had to close Firefox (lucky for the Session Manager app that saves everything) and start again. I'm trying one more time and then that's it. This machine is getting incredibly slow and cumbersome.
I'm sorry, but I just can't get the log copied without this infernal thing freezing up. Okay, one more time:

srcstcbstrd

December 28, 2010, 2:34 PM UTC

Nope - happened again although without the Runtime alert. As soon as I attempted to paste the log, the computer froze and I couldn't shake it loose until I closed Firefox. Is it the fault of Firefox? Who knows. Here's another try:

srcstcbstrd

December 28, 2010, 2:43 PM UTC

Nope - can't post. As soon as I paste the log, the computer freezes and it doesn't matter how long I wait, I have to close Firefox but not the whole post is saved. I'm going over to IE to try that route.

srcstcbstrd

December 28, 2010, 2:54 PM UTC

Nope, can't do it. I went over to IE and the same result. As soon as I pasted, IE froze and wouldn't respond. I even tried copying the log to a new notepad page and tried to CUT and paste but with the same dismal result. I'm sorry but my computer is obviously rebelling after all the scans and deletions of files and is acting like a little kid and holding its breath. I don't know how to get the log to you unless it is by 'private message'. Sorry.

turtledove

December 29, 2010, 2:03 AM UTC

Good evening srcstcbstrd,

I do not know why you can not post.
My best advice at this point is that it is best to save your documents that you need, not downloaded programs; and reformat the system. It has had as mentioned a rootkit/spying/info stealing virus. ESET also found an illegitimate NIS 2010. I suggest staying off such sites and P2P in the future if you want a safe and dependable machine.

Here are a couple of links once you are reformatted. Our forum here for keeping safe:
viewtopic.php?f=4&t=54766 COMPUTER SECURITY - a short guide to staying safer online

For technical help should your printer problem remain after the reinstall.

Tech Support Forums
What the Tech
Tech Support Guy
The Elder Geek on Windows

Sorry I ca not assist further. Thank you for trying.

Let me know you have read this and copied the above links, I will then have the topic closed.

Thank you

turtledove

srcstcbstrd

December 29, 2010, 4:18 AM UTC

Thanks turtledove - saved all the links and will try the reformat. Is there no way to load the recovery discs and just pick up the files that have been corrupted? Will the recovery program not just look and replace the bad or missing stuff?

Anyway, thanks for all your help and (don't take this the wrong way - I really mean it as a compliment) I hope to never have to hear from you again. Your help has been invaluable and I've learned quite a few things. Cheers and let's close this monster down.

turtledove

December 29, 2010, 4:43 AM UTC

Good evening srcstcbstrd,

In this case, even if it only replaced the corrupt files, due to what was found, you're best to restore back to factory condition. That is because we do not know the total amount of corrupted files.

"srcstcbstrd" wrote:Anyway, thanks for all your help......Your help has been invaluable and I've learned quite a few things.

You're welcome.
Have a good New Year.

turtledove

Gary R

December 29, 2010, 7:38 AM UTC

Since you have taken the decision to re-format your hard drive and re-install Windows ....

THIS TOPIC IS NOW CLOSED