jsmply

Already have. Thanks! =)

Does the technician license still exist? We have been told it's phased out.

Hi noknojon, In a medium to large corporate network what your saying definitely applies, but what about the very small business though with 1-2 machines, etc. There are a lot of home businesses or tiny operations that would have the same type of setup (or very similiar) as a personal user. Some small businesses are run from the sole owner/employees laptop, etc.

But just to clarify, OldMarine mentioned that often when these security forums give advice, they are under the impression that ANYONE can use the free version to remove infections. That seems like it's no longer true. For example, if your work computer is acting up and you go to one of these security forums for help and they advise you download MBAM to repair the problem . . . you cannot proceed with removal without contacting and waiting for a response from corporate sales? Is that correct? Seems the same would be true if your a computer tech trying to remove an infection (and that probably happens quite a lot on the tech forums).

Exile, don't want to get too far off topic or hijack oldmarine's thread so I sent you a PM on this topic. Would appreciate it if you can check it when you get a chance, thanks!

Thanks Ronny. I will run the updates when the boss is back in the office as it's his machine. Should I leave this thread open or just assume this is the fix and open a new one when/if this does not correct the repair? Thanks!

Hi LonnyRJ, sorry for the delayed response. The boss is out of town for a while so I won't have access to the machine again for a bit. Do you mind if I keep the thread open? Just to clarify, I see parts of the regfile that mention the printer spooler. The printer spooler is currently working fine on this machine with LOTS of attached printers, some shared. Will the reg file compromise any of that? I went ahead and ran just the crypsrvs part of the regfile before the boss left town (while I was waiting for your reply) but that alone didn't fix it. I take it Combofix has been updated to fix this problem in Windows XP2 and XP3? That will be my next step here. Thanks and again I'm really sorry for the delay. The boss left town unexectadly and I have no access to that office.

One last reply and then I will wait for your answer. The Spooler description reads as follows: "@%Systemroot%\system32\spoolsv.exe, -2" and I also notice that directly underneath it, the display name as an @ sign also, the display name reads "@%Systemroot%\system32\spoolsv.exe, -1" . Does that help at all? I just want to clarify all details before running the fix and causing an issue. Thanks!

Also, I see we are making changes to the spooler registry entries. Right now the printers (including shared printers that are connected to this machine) work just fine on the network. Does that mean anything? Will this disrupt any shared printers that are connected to this machine? I just want to make sure the fix doesn't cause more harm than good. Thanks!

Thank you Lonny. Is this regedit fix safe to run on XP2? Also, is there any risk in these fixes? I just want to make sure as I only have access to the machine via LogMeIn right now as the machine resides in the bosses office and due to sensitive information in the area, he only wants me to have remote access except for critical system problems. Like I said, the machine "works" right now . . . I just want to make sure none of these processes run the risk of crippling it. I seem to recall running Combofix a few times via LogMeIn on other systems, but just wanted to verify. Also, the regedit process is to repair the problem, correct? Just so I understand, what are we running combofix for here? Thanks!

Thanks Jack. I definitely have the @ sign and the 1002. Lonny, this is XP Pro SP2. Thanks!

LonnyRJ, as Exile360's requset I went ahead and made a new thread. Would you all be so kind as to help me there (or here, or anywhere)! http://www.malwarebytes.org/forums/index.php?showtopic=20922 Thanks!

Hi Everyone, Exile360 has requested I start a new thread for an issue that has occurred on an XP SP2 workstation I have. I first became suspicious of the problem from Combofix when it found that several files failed sigcheck. I did some digging and found out that the reason is because Cryptographic services are not running. I have tried all the normal stuff and none of that helped. I seem to have the same exact thing going on as the poster in this other MBAM Forum thread: http://www.malwarebytes.org/forums/index.p...20104&st=60 However, Exile360 (who was one of the main contributors on that thread) requested I start a new thread here as he does not have an XP2 machine available. Would someone mind giving me a hand with this issue? LonnyRJ requested I check a registry entry as he believed the problem was only in SP3. This is the entry and it matches the regststry on my machine exactly: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc Description REG_SZ @%SystemRoot%\system32\cryptsvc.dll,-1002 Thanks in advance!

Also, I went ahead and looked up that registry entry you posted on the machine in question (XP SP2) and I have the exact same entry that you typed for the description. Is that a sign of a positive or negative diagnosis? Thanks!

Hi LonnyRJ and anyone else following. I have this same exact error showing up on an XP2 system. Here is the exact error from the event viewer: "The CryptSvc service failed to start due to the following error: %%1290" I have tried various things including the normal software programs that can repair CryptSvc by unregistering and re-registering the dll's and deleting the catroot2 folder, none of that helps. The system seems to run fine, other than the fact it obviously can't install Windows Updates. Would somoene mind giving me a hand? I can't update to SP3 because of the nature of the problem, so the fix posted won't work (at least I'm not trying because of the warning).