DDS Unavailable, CainAbel.AA PSWTool.RAS.A Agent.GVUEPJO

Askey127,

Thanks for that, I sent you a PM separately on another matter! Here is the log as requested:-

********************************** begin log **************************************
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f10a46830b7d69439bc3bd22dd8ec2f4
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-06-19 02:05:48
# local_time=2012-06-18 07:05:48 (-0700, US Mountain Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 888443 888443 0 0
# compatibility_mode=770 16774141 100 100 15299741 115853596 0 0
# compatibility_mode=5892 16776573 100 100 0 176672852 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=417538
# found=1
# cleaned=0
# scan_time=6224
C:\Windower.34\FinalFisher\FinalFisher.exe probably a variant of Win32/Agent.GVUEPJO trojan (unable to clean) 00000000000000000000000000000000 I
********************************** end log **************************************

I know what the application is with the infection, and it is no longer used. I was about to say I can delete the entire folder structure starting at C:\Windower.34 when I noticed that the date on C:\Windower.34\FinalFisher (the folder itself) is 6/13/2012 while I know for sure that the folder has not been accessed since 12/17/2009 when C:\Windower.341 was installed and took over the duties. All other files and folders have dates from 2008 and 2009. Here is a DOS listing of the folder and it's contents:

"DOS" wrote: Directory of C:\Windower.34

04/26/2009 12:10 AM <DIR> .
04/26/2009 12:10 AM <DIR> ..
04/17/2009 03:37 PM <DIR> FFXI Crafter 2.0
06/13/2012 05:13 AM <DIR> FinalFisher
04/26/2009 12:10 AM <DIR> LogMod3
11/30/2009 01:41 AM <DIR> plugins
05/02/2010 08:01 PM <DIR> screenshots
07/23/2010 11:37 PM <DIR> scripts
0 File(s) 0 bytes

"DOS" wrote: Directory of C:\Windower.34\FinalFisher

06/13/2012 05:13 AM <DIR> .
06/13/2012 05:13 AM <DIR> ..
08/30/2010 10:36 PM 296,448 FinalFisher.exe
12/17/2009 04:44 PM 8,395 FinalFisherPreRelease.rar
04/11/2009 04:58 PM 98,304 WindowerHelper.dll
3 File(s) 403,147 bytes

If it helps, the entire folder structure under C:\Windower.34 - including the top level directory - can be deleted. I would have taken care of it, but something about that date tells me that something isn't right, so I'll bow to your expertise in this matter and leave it alone! (hides hands behind back!!)

Dave

daveyb,
I don't know whether FinalFisher might be installed by or related to Final fantasy in any way.
FinalFisher is known to phone home for updates. If it is still doing so, that may account for the file dates.

I would delete the entire folder tree, or transfer it temporarily to a flash drive, in case it turns out to be important for some obscure reason..
If you care, we can do a Reg search for FinalFisher and remove any startups or other references. Your call.

Your machine looks clean, but I can't explain why we get BSODs when using TFC or the [EMPTYTEMP] command in OTL.
I would go ahead and use cleanmgr on the "Start" command line and see if it can clean up the C: drive without a BSOD.

askey127

OK, cleanmgr ran without error. I'll delete finalfisher completely - its a 3rd party utility for keeping track of fishing in Final Fantasy, so it won't break anything.

I think you can close this ticket for now, if anything else comes up I will open a new ticket.

Thanks for your patience and help with this! It is much appreciated!

Dave

As an aside, found out what was going on with those BSODs.
It was a change in OTL and TFC.
If you erase your copies, and download new copy of TFC, it should work fine.
It's very thorough at cleaning. Keep it and use it every week or so.

Thanks for following through with that, I've deleted all the downloaded software and re-downloaded TFC - it ran flawlessly this time!

Thanks again!

DaveyB