Multiple Blue Screen Errors with spooldr.sys - logs attached

hip2bme · Mar 18, 2009

Have been getting blue screen errors. When Microsoft's Reporting is done, it tells me it was caused by malware called spooldr.sys. After reading through a few threads, I found your Read and Run me first page. I ran the programs recommended and have attached the log files.

Since the blue screen errors seem to happen randomly, I'm not sure if I've fixed the problem yet or not. Hoping you can tell me.

Thanks in advance for your help!

hip2bme · Mar 18, 2009

Here is the 4th attachment. Thanks!

chaslang · Mar 21, 2009

Welcome to Major Geeks!

According to the logs you have attached, there are no signs of spooldr.sys problems. SUPERAntiSpyware removed some other unrelated malware. Your logs are clean other than that.

If you are still getting BSODs, you need to post the exact word for word error message here. Many BSODs occur for non-malware reasons.

hip2bme · Mar 22, 2009

chaslang,

Thank you for your reply. I have not had any more BSOD errors since running the programs. So it appears as if whatever malware was removed was what was causing the problem. Question for you though, can I now delete all that software I downloaded and installed? The SuperAntiSpyware stays resident in my system tray which is fine, but I have the MGTools, CCleaner, ComboFix and Malwarebytes software still installed. Plus a %Userprofile% folder and Thumbs.db file appears to have been created on my Desktop during the process. Is there any reason I shouldn't remove/delete these at this time?

Thanks!

chaslang · Mar 24, 2009

You're welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

hip2bme · Mar 28, 2009

Unfortunately it took a few days, but I have had another malware problem. The computer rebooted on its own and when it came back I had the Microsoft window that said a serious error had occurred. I had it send the Microsoft Error Report. When it opened the Microsoft window displaying what caused the error, it had the following message...

Malware alert: Problem caused by spooldr.sys, which might be malware
Your computer experienced a problem that was caused by spooldr.sys.
This product might be malware.

Any ideas? I haven't removed any of the other programs yet, I was just waiting for a little while to see if the error reappeared. It did seem to go away for a while though after running all the programs; however, it now seems to be back.

Hoping you might have an idea as to where to look next. If it's not spooldr.sys, what could it be?

Thanks for your help!

chaslang · Mar 31, 2009

It is possible that you became reinfected.

Since you were out of date with your version of SUPERAntiSpyware let's get it updated and run a new scan.

Please uninstall your current version (this is necessary).

Then download this SUPERAntiSpyware

Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.

After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.

Now run a new full scan of your system. And attach this new log.

Now run Malwarebytes and click the Update tab. Then click the Check for Updates button so you update to the current version of the program and database. Then run a new scan with it too. Attach the new log.

Log in or Sign up

Multiple Blue Screen Errors with spooldr.sys - logs attached

hip2bme Private E-2

Attached Files:

SASlog.txt

MBAMlog.txt

ComboFixlog.txt

hip2bme Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hip2bme Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hip2bme Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Log in or Sign up

Multiple Blue Screen Errors with spooldr.sys - logs attached

hip2bme Private E-2

Attached Files:

SASlog.txt

MBAMlog.txt

ComboFixlog.txt

hip2bme Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hip2bme Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hip2bme Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches