13 replies to this topic

[retired911]

I am seeing "The Aspi32 service failed to start due to the following error:
The system cannot find the file specified." under the event viewer. I have a WMI error too and a few warnings which I will try to work out one by one with this being the first I guess.
I am running Win 7 Home Premium SP1.
I ran Autoruns for the Aspi32 as I have done some other readings here and I am attaching the file to the post.

Attached Files

•  AutoRuns.zip   301.81K   75 downloads

[AdvancedSetup]

ASPI32 is not needed or used by Windows 7

Please run the following scanner and send back the logs.

Download DDS from one of the locations below and save to your Desktop
dds.scr
dds.com


Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool, on Vista or Win 7 right click and select Run as administrator
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

When done, DDS will open two (2) logs:

• DDS.txt
  
• Attach.txt

• Save both reports to your desktop
  
• Please include the following logs in your next reply: DDS.txt and Attach.txt
  You can ignore the note about zipping the Attach.txt file in most cases.

[retired911]

Here we go with the logs.

Attached Files

•  DDS.txt   34.68K   112 downloads
•  Attach.txt   11.93K   108 downloads

[AdvancedSetup]

Well not exactly sure what software you installed tried to install this but this is the cause of the error.

5/31/2012 1:28:49 PM, Error: Application Popup [1060] - \SystemRoot\SysWow64\drivers\aspi32.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.


You may want to try downloading the RegScanner from NirSoft and searching for aspi32.sys and then post back the results.

http://www.nirsoft.n...regscanner.html

These errors could be normal and nothing to worry about but it could also be a sign of trouble, more research would be needed.

5/27/2012 1:38:41 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk3\DR3.
5/27/2012 1:08:46 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

[retired911]

I hope I did this right?

Attached Files

•  regscanner.zip   548bytes   51 downloads

[AdvancedSetup]

No you zipped up the configuration file. I need a text or log file of what it found please.

[retired911]

I'm not sure if I did this right but here it is..


[General]
ToolTipTimeAutoPop=-1
ToolTipTimeInitial=10
ToolTipTimeReshow=10
ShowInfoTip=1
ShowGridLines=0
SaveFilterIndex=0
ShowFoundDuringScan=1
LookAtKeys=1
LookAtValues=1
LookAtData=1
CaseSensitive=0
AddKeyEntries=0
KeysOnly=0
UseTimesRange=0
UnicodeSearch=1
UseLenRange=0
UseValueTypes=0
ValueTypes=2
BaseKeys=31
UseBaseKeys=1
UseRemoteComputer=0
RemoteComputer=
BaseKey=
Find=aspi32.sys
ExcludeList=HKLM\Software\Classes, HKCU\Software\Classes
UseExcludeList=0
MaxNumOfItems=10000
MatchMode=2
LenFrom=0
LenTo=100
WinPos=2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF B7 02 00 00 0B 00 00 00 5A 06 00 00 5B 02 00 00
Columns=F5 00 00 00 64 00 01 00 B2 00 02 00 C6 00 03 00 64 00 04 00 64 00 05 00
Sort=0

[AdvancedSetup]

Let's try this again.

Start RegScanner. In the Registry Scan Options box where it says Scan Options and "Find String:" type in: aspi32 and click the OK button.
It will scan your registry and will put any entries it finds into the main program window.

When it's done click on File -> Save Selected Items

Then give it a name and save it to your desktop as a text file. Then find that name on your desktop and open it and copy/paste the results or attach the text file please.

An example entry might look something like this.

==================================================
Registry Key : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D785D669091E2204DBC757E74DE3E319
Name : 1768009307CEAB9448EEDEFD77817D73
Type : REG_SZ
Data : D:\Program Files (x86)\PowerArchiver\WnASPI32.dll
Key Modified Time : 10/6/2011 12:22:58 AM
Data Length : 50
==================================================


Thanks

[retired911]

Sorry bout that..


==================================================
Registry Key : HKCU\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
Name : LastKey
Type : REG_SZ
Data : Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Aspi32
Key Modified Time : 6/1/2012 1:08:07 PM
Data Length : 69
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet001\services\Aspi32
Name : ErrorControl
Type : REG_DWORD
Data : 0x00000001 (1)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet001\services\Aspi32
Name : Type
Type : REG_DWORD
Data : 0x00000001 (1)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet001\services\Aspi32
Name : Start
Type : REG_DWORD
Data : 0x00000004 (4)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet001\services\Aspi32
Name : MatchFlags
Type : REG_DWORD
Data : 0x00000000 (0)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet001\services\Aspi32
Name : ImagePath
Type : REG_EXPAND_SZ
Data : System32\drivers\aspi32.sys
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 28
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet001\services\Aspi32
Name : AutorunsDisabled
Type : REG_DWORD
Data : 0x00000002 (2)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet002\services\Aspi32
Name : ErrorControl
Type : REG_DWORD
Data : 0x00000001 (1)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet002\services\Aspi32
Name : Type
Type : REG_DWORD
Data : 0x00000001 (1)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet002\services\Aspi32
Name : Start
Type : REG_DWORD
Data : 0x00000004 (4)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet002\services\Aspi32
Name : MatchFlags
Type : REG_DWORD
Data : 0x00000000 (0)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet002\services\Aspi32
Name : ImagePath
Type : REG_EXPAND_SZ
Data : System32\drivers\aspi32.sys
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 28
==================================================

==================================================
Registry Key : HKLM\SYSTEM\ControlSet002\services\Aspi32
Name : AutorunsDisabled
Type : REG_DWORD
Data : 0x00000002 (2)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\CurrentControlSet\services\Aspi32
Name : ErrorControl
Type : REG_DWORD
Data : 0x00000001 (1)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\CurrentControlSet\services\Aspi32
Name : Type
Type : REG_DWORD
Data : 0x00000001 (1)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\CurrentControlSet\services\Aspi32
Name : Start
Type : REG_DWORD
Data : 0x00000004 (4)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\CurrentControlSet\services\Aspi32
Name : MatchFlags
Type : REG_DWORD
Data : 0x00000000 (0)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKLM\SYSTEM\CurrentControlSet\services\Aspi32
Name : ImagePath
Type : REG_EXPAND_SZ
Data : System32\drivers\aspi32.sys
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 28
==================================================

==================================================
Registry Key : HKLM\SYSTEM\CurrentControlSet\services\Aspi32
Name : AutorunsDisabled
Type : REG_DWORD
Data : 0x00000002 (2)
Key Modified Time : 6/1/2012 1:01:58 PM
Data Length : 4
==================================================

==================================================
Registry Key : HKU\S-1-5-21-3936609380-3145785385-1925700108-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
Name : LastKey
Type : REG_SZ
Data : Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Aspi32
Key Modified Time : 6/1/2012 1:08:07 PM
Data Length : 69
==================================================

Attached Files

•  regscan.txt   6.73K   38 downloads

[AdvancedSetup]

Click on START and type in CMD in the search box - when it shows on the menu right click it and choose "Run as administrator"

Then type in the following and press the Enter key and then restart the computer.

SC DELETE Aspi32


Then review your event logs and that error should no longer be present.

[retired911]

That looks like it did it, now I just see these;


Level Date and Time Source Event ID Task Category

Warning 6/2/2012 5:31:50 PM Microsoft-Windows-Wininit 11 None Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications.

Warning 6/2/2012 5:30:56 PM Microsoft-Windows-WLAN-AutoConfig 4001 None "WLAN AutoConfig service has successfully stopped.
"
Warning 6/2/2012 5:30:56 PM Microsoft-Windows-WLAN-AutoConfig 10002 None "WLAN Extensibility Module has stopped. Module Path: C:\Windows\System32\IWMSSvc.dll
"
Error 6/2/2012 5:25:58 PM Microsoft-Windows-WMI 10 None "Event filter with query ""SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND TargetInstance.LoadPercentage > 99"" could not be reactivated in namespace ""//./root/CIMV2"" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected."

[AdvancedSetup]

You might want to double check your system and make sure it's not infected.


If you think you are infected, here are the steps needed to get your computer cleaned....
Please read the following so that you can begin the cleaning process:

Don't use any temporary file cleaners unless requested - this can cause data loss and make recovery difficult

You have 3 Options that you can choose from as listed below:

• Option 1 —— Free Expert advice in the Malware Removal Forum
  
• Option 2 —— Paying customer -- Contact Support via email
  
• Option 3 —— Premium, Fee-Based Support

OPTION 1

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the
Malware Removal forum so a qualified helper can help you fix any malware related problems or infections you may have.

• Please read and follow the directions here, skipping any steps you are unable to complete.
  
• After posting your new post, make sure under options, you select Follow this topic and choose Instantly,
  so that you're alerted when someone has replied to your post.

NOTE: Please do not post back to (bump) your topic within the first 48 hours.
Replying to your own posts changes the post count and helpers are looking for topics with zero replies.
If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• 
  
  • If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
    Or
    
  • You may send a Private Message to a Moderator asking for assistance.

OPTION 2

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or here.

OPTION 3

If you would like to use our Malwarebytes Premium Consumer Services partner, Comprehensive solutions to all your computer support needs—from installation and set-up to troubleshooting and tune-ups go to our Malwarebytes Premium Services support site.


Please be patient, someone will assist you as soon as possible.

[daledoc1]

Actually, I think the OP is already being assisted by Maniac in the malware removal section HERE ?

(Sorry for the intrusion -- Just mentioning this, so that retired911 will know that starting another topic there is not necesssary. )

Cheers,

daledoc1

[retired911]

Thank you all for your help.