Viprerescue and _Synclog.data problems

March 22, 2020 at 09:12:17
Specs: Windows 10
Is a folder called "viprerescue" part of Windows 10? What is its purpose? I have my Quicken data in C:\QWDATA and this folder is also in the C:\viprerescue folder. Some how the qwdata folder has a WordPerfect files such as "_Synclog.data" in it Also, a shortcut icon appears on my desktop with the same name. Delete it and it will reappear after a reboot. Anything deleted shows in the recycle bin as a WordPerfect item. Thinks for your help.

CoffeeBreak


See More: Viprerescue and _Synclog.data problems

Reply ↓  Report •

#1
March 22, 2020 at 09:20:21
Maybe some info here:

https://www.bleepingcomputer.com/fo...

But somewhat odd if you don't have that particular scanner on your system...

"Channeling the spirit of jboy..."


Reply ↓  Report •

#2
March 22, 2020 at 10:15:13
Hi T-R-A

This is from the website you provided. VIPRE Rescue is a handy, easy to use tool designed to clean your computer if you are already infected with a virus and your operating system is not working properly as a result of the infection. If you are already running VIPRE and a virus has disabled it, you can still run this program to clean your computer.

If the shortcut had not appeared on my desktop, I would not been aware of this situation. My operating system appears to be working properly. I installed a new version of Word Perfect and on or about the same time the shortcut showed up. My first thought was that WordPerfect caused it. I would like to add that three files appear show up on each quicken account. They are as follows: _Synclog,data, qdata_Synclog.dat and QDATAOFXLOG.DAT. Add one check in Quicken and the last two items will change.

I don't really know when the VIPRERESCUE showed up. If this file is not part of Windows 10, I am considering deleting it, but would that be safe?

CoffeeBreak


Reply ↓  Report •

#3
March 22, 2020 at 10:46:35
" I installed a new version of Word Perfect and on or about the same time the shortcut showed up."

And there was no "extra software" during the install of Word Perfect? It's often a thing to try an encourage additional software installations (especially when a company is struggling financially---such as Corel). Is it listed in Add/Remove Programs?

"Channeling the spirit of jboy..."


Reply ↓  Report •

Related Solutions

#4
March 22, 2020 at 11:14:06
Hi.

No extra software as far as I can tell. Just three WordPerfect things. A 32 bit filter, a 64-bit thing and the WP thing. I installed this from a DVD. I looked today at the DVD and I can see no other additional software available to install. I would like to know what is re-entering shortcut to C:\Users\{UsersName}\Desktop. I see no record of add/removr "VIPRE" software.

CoffeeBreak

message edited by CoffeeBreak


Reply ↓  Report •

#5
March 22, 2020 at 13:38:06
I'd suggest moving it first to something like a C:\Temp folder and see if any other software "acts-up" first before deleting it entirely. You could restore it if that occurs. Would also benefit to run a complete virus/malware/adware-scan.

"Channeling the spirit of jboy..."


Reply ↓  Report •

#6
March 22, 2020 at 15:58:54
You should be able to use the program if it is genuine.

VIPRE Rescue Scanner
https://www.softpedia.com/get/Antiv...
https://www.vipreantivirus.com/vipr...


Reply ↓  Report •

#7
March 22, 2020 at 17:28:41
I have done a full anti-virus scan of my hard drive (not the quick scan) with Norton. I have transfer the QWDATA folder from VIPRERESCUE folder to a DVD drive and then deleted that folder. I have deleted the shortcut from the desktop and this deleted the C:\Users\{UsersName}\ Desktop\reference to desktop icon. Also, I coped a file C:\Users\{UsersName}\Documents\Quicken\UsersName's quicken data-Synclog.dat to the DVD and then deleted that file. Deleted all other files that had "_Synclog.dat" from the hard drive. Using search for "Synclog.dat". I had 19 items, now there is 5.

Shut down the computer, then restarted it. No desktop icon . Started several program, all working. At last I started the Quicken program with no problems, rebooted and yes, the desktop short cut was back. This tells me that opening the Quicken program make the desktop thing reappear. Now there is 6 Will delete one at a time the other files and see what happens. JohnW, I will look at the VIPRE rescue scanner, etc.

CoffeeBreak

message edited by CoffeeBreak


Reply ↓  Report •

#8
March 22, 2020 at 17:53:31
Did you do a clean install of W10?
In other words you booted from the W10 ISO & deleted all the partitions during the install.

Reply ↓  Report •

#9
March 22, 2020 at 17:55:31
how to uninstall vipre rescue
https://bit.ly/3dgz225

Reply ↓  Report •

#10
March 23, 2020 at 11:30:45
Hi Johnw

News update. Was able to run the ViperRescue program that was already installed on this computer. No "High Fives" yet. Can not say if it fixed the "_Synclog.dat" thing or not. Scan took over 4 hours. I now have 5 items in quarantine. Will provide more information later. I am tried from working on this.

CoffeeBreak


Reply ↓  Report •

#11
March 23, 2020 at 16:48:53
"Can not say if it fixed the "_Synclog.dat" thing or not"
Maybe, at least vipre has quarantined stuff that shouldn't be there.

If still there.
quicken sync log.dat on desktop
https://is.gd/zmhkI3


Reply ↓  Report •

#12
March 23, 2020 at 18:57:03
Hi John. I also had the -0- file size for the desktop short cut. At the moment it is deleted. Opening the Quicken program will make them (or some of the 3 files) reappear. The shortcut is not my main concern . My main concern is about the three other files inside the QWDATA folder. Doing any harm, helpful, or what. Go to "This PC" and find the files in question, they will have a WordPerfect icon with them. I have asked WordPerfect about why they are putting WP files in with Quicken files. No answer or comment yet from WP. Thanks for the last link. Does anybody else see a WordPerfect - Quicken connection? I am thinking about renaming the QWDATA folder (changing location).

Can I update the definitions in the VIPERESCUE program? Will "upgrade.exe" do that or upgrade to a better program? I do not know how I got this program!

Thanks for your help and interest in this matter.

CoffeeBreak

message edited by CoffeeBreak


Reply ↓  Report •

#13
March 23, 2020 at 19:56:58
"I do not know how I got this program!"
One thing at a time, reply to my post #8 please.

message edited by Johnw


Reply ↓  Report •

#14
March 23, 2020 at 20:34:05
"Did you do a clean install of W10? In other words you booted from the W10 ISO & deleted all the partitions during the install."

No I did not. I had version Windows 7. Put a DVD in the tray, and installed Windows 10. Then I had both versions installed. If something happened, I could go back to Windows 7 if needed. Hard drive had no partitions, just the C drive. After 30 days the Windows 7 was removed by Windows 10. This was automatic, on the 30th day Windows 7 was gone. This was installed in late December 2019.

I needed to upgrade to Windows 10 because TurboTax said that their 2019 program would not work on Windows 7. Then on or about February 10, 2020 WordPerfect advised me that I would have to upgrade my old version to a newer version (WordPerfect Office X9) on a subscription basis (yearly fee). Soon after that, the problems with Quicken started.

I am sorry about not responding to post #8. Did not mean to do that.

CoffeeBreak


Reply ↓  Report •

#15
March 23, 2020 at 20:57:04
"No I did not. I had version Windows 7. Put a DVD in the tray, and installed Windows 10"
Ok, that is fine & is what I expected.
Vipre rescue has probably been on your drive for a very long time, usually installed by a user, either intentional or unintentional.
Because it is controlled manually, the user has to check if the latest version is installed, which is as per my previous links > 7.0.7.8

Malwarebytes Free offers the same cleaning, except when you run it, it automatically updates.
https://www.softpedia.com/get/Antiv...
https://www.freewarefiles.com/Malwa...
https://www.freewarefiles.com/scree...
https://www.malwarebytes.org/downlo...

"the problems with Quicken started"
I will now put some time & more thought on how to tackle this issue.


Reply ↓  Report •

#16
March 23, 2020 at 21:22:57
Right click on the problem file, what options do you get?
Upload SS ( screenshots ) to Imgur.

message edited by Johnw


Reply ↓  Report •

#17
March 24, 2020 at 13:26:14
“Right Click on the problem file, what options do you get?”

I opened the following file in C Drive (This PC):
Qunol09_Synclog.dat, dated 2-10-20, File type, WordPerfect X9 Merge data, File size 99KB.

Right clicked the file and got the following options: Open, 7-Zip, CRC SHA, Share, Open with, Norton Security, Scan with Malwarebytes, Restore previous versions, Send to, Cut, Copy, Create shortcut, Delete, Rename and Properties (which shows - Open with WordPerfect X9 and the Date created & the Date last saved, which my case both were 2-10-20).

Enter one check, deposit etc. and that file size number would increase. Also, the two dates would not be the same

The name Qunol is a CoQ10 supplement and the 10 is for a calendar year. It just as well could have been JohnwAuto19. The 7-Zip option is something like the old Pkzip and Pkunzip program. You can open a CD or DVD with it and read all the files.

“Upload SS (screenshots) to Imgur.”

I do not know how to do that or what the word imgur means!

You had other question and I well get to them soon.

CoffeeBreak


Reply ↓  Report •

#18
March 24, 2020 at 15:34:28
"I do not know how to do that or what the word imgur means!"
Always google everything you don't understand.
how to take screenshot in windows 10
https://bit.ly/2J9IEOj
how to upload to imgur
https://bit.ly/33J3TzJ

Reply ↓  Report •

#19
March 24, 2020 at 19:29:03
“Vipre rescue has probably been on your drive for a very long time, usually
\installed by a user, either intentional or unintentional.”

In my original post, I asked the following question, “Is a folder called
"viprerescue" part of Windows 10?” I knew that the folder, was on my hard drive, but did not know its purpose. Click on it and a pop message would say “You do not have permission to access this directory.” It was not on the Control Panel, Programs, Uninstall a program list. I had no real reason or need to see inside the folder, so it stayed on my computer.

So, after the current _Synclog.dat problem showed up, I did a complete search for Synclog.dat and discovered some of those files were in VIPRERESCUE folder. Then. I changed permissions on that folder to “Full control” from “List folder contents.”

Today I was looking at the VIPRERESCUE folder and noticed a file named
21160311633449, dated 1-31-16. It looked similar to the 5 files I got on
3-23-20.

Clicked on it and Excel opened it. Someone had run the Viper scan. Checked my credit card bill and I had a bill from Microsoft for an Assure Software Support Plan, dated 1-31-16. So, they installed the Vipre software, ran the program and I know why I was completely in the dark about the VIPRERESCUE folder. I agree that “been on your drive for a very long time.” I had this computer about 1 week when this happened.

“Maybe, at least vipre has quarantined stuff that shouldn't be there.”

This is part of Viper’s report dated 3-23-20. Getting rid of any thing dealing with is a Trojan a good thing.

Here is part of Vipre's report.

<?xml version="1.0"?>

-<SBCSQuarantineRecordXML threatDefinitionVersion="44998" BufferOnly="false" Source="0" quarantineLocation="C:\VIPRERESCUE\Quarantine" scanGUID="{B539C390-8246-49E0-A9D5-DAA73C35C0BF}" dateTimeStampUTC="2020-03-23T18:
12:08" quarantineId="{58F7236F-6901-434A-AF25-4A62AB4570DD}" isHookThreat="false" optionalScan="0" author="" canQuarantine="true" adviseType="3" type="Malware" CategoryID="26" category="Trojan Downloader" level="2" name="Trojan.Win32.Bredolab.Gen.1 (v)" threatId="4369901">

<authorURL/>

<desc>A Trojan Downloader is a program typically installed through an exploit or some other deceptive means and that facilitates the download
and installation of other malware and unwanted software onto a victim's

PC. A Trojan Downloader may download adware, spyware or other malware
from multiple servers or sources on the internet.</desc>

<threatAdviceDetails>This is a high risk and should be removed immediately as it may compromise your privacy and security, make dangerous changes to your computer's settings without your knowledge and consent, or severely degrade your computer's performance and stability.</threatAdviceDetails>

<customData/>

-<fixes>

-<fix dispValue="C:\Program files
\WindowsApps\Microsoft.StorePurchaseApp_12003.1001.1.0_x64__8wekyb3d8bbwe\
StoreExperienceHost.dll" isTransient="false" actionType="1" traceType="4">

I agree that Google is the best way to get information.

Will send additional information soon. But, not tonight.


CoffeeBreak


message edited by CoffeeBreak


Reply ↓  Report •

#20
March 28, 2020 at 14:22:35
Hi Johnw (in reference to your Post # 15)

I am sorry for the delay in this reply. This is not “soon.” Sometimes things happen and they will causes a change in plans.

“Because it is controlled manually, the user has to check if the latest version is installed, which is as per my previous links > 7.0.7.8"

I know that I do not have the latest version of this program. I think that I have just parts of various versions. No home page or anything else. I looked through VIBRERESCUE folder and saw 4 “exe” files, Clicked on “VipreRescueScanner.exe,” dated 9-3-15, file size 541,534, and then, a DOS like window started scanning the hard drive. At the very end of the scan, something like (hit any key to exit the program) appeared.

At the start of the Vipre report referred to in my post #19 was the following:
<?xml version="1.0"?>
<SBCSThreatEngineResults version="7.0.7.8">

The SBCSThreatEngineResults seems current.

CoffeeBreak

message edited by CoffeeBreak


Reply ↓  Report •

Ask Question