#1
Inactive
Profile: Join Date: Jun 2008
Posts: 3
Computer Experience:
Trouble removing spools.exe
My mother's computer slowed down, so naturally she decided to download some antivirus software and fix it! Unfortunately, she wound up downloading something even worse, and it appears to be spools.exe. I was unable to run an executable for the longest time, but right before I decided to reformat, I found that I could run a couple nested .bat files in an endless loop, and after enough calls I could launch whatever I wanted to. My attempts at removing it have been unsuccessful, so here's the output from DSS :Total Physical Memory: 510 MiB (512 MiB recommended). SP2 (WinNT 5.01.2600)dss .exehttp://www.yahoo.com http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com http://resultsmaster.com/SmartOffers...meLeftPane.htm http://www.google.com/ig/dell?hl=en&...us&ibd=4060925 http://download.mcafee.com/molbin/sh...1/mcinsctl.cab http://h30155.www3.hp.com/ediags/hpf...qdiagh.cab?326
Didn't find the information you thought to find?Similar Threads
#2
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Welcome to WindowsBBS Glimflicker here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Inactive
Profile: Join Date: Jun 2008
Posts: 3
Computer Experience:
ComboFix log WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net HijackThis log SP2 (WinNT 5.01.2600)http://www.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.yahoo.com http://www.google.com/ig/dell?hl=en&...us&ibd=4060925 http://download.mcafee.com/molbin/sh...1/mcinsctl.cab http://h30155.www3.hp.com/ediags/hpf...qdiagh.cab?326
#4
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
First, if listed in Add/Remove programs, uninstall SystemAntivirus2008 (or might be SAV). Let me know if it's not listed.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/showthread.php?t=74524
Suspect::
C:\WINDOWS\system32\baseuff32.dll
Collect::
C:\WINDOWS\system32\aagtqtlp.ini
C:\WINDOWS\system32\uveivlbc.dll
C:\WINDOWS\system32\pltqtgaa.dll
C:\WINDOWS\system32\qehpfnba.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8f0351bb-15b7-4a40-b036-bb2fe1b49ff7}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Antivirus"=-
"086ccfb2"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c00F3F70] Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#5
Inactive
Profile: Join Date: Jun 2008
Posts: 3
Computer Experience:
Things appear to have gotten worse. Here's the ComboFix log:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net
#6
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Thank you for the submission!Setup Disks for Floppy Boot Install from Microsoft so that we can use it to install the Recovery Console on your computer. No validation required! Please select the download link below that's appropriate for your Operating System then download and save the setup package to your desktop. If necessary, change the language version to match your installation. Do NOT change the name of the downloaded file! Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/showthread.php?t=74524
KillAll::
File::
C:\WINDOWS\system32\baseuff32.dll
C:\WINDOWS\system32\sav.cpl
Folder::
C:\Program Files\SAV
Suspect::
C:\WINDOWS\system32\sockets.dll
Collect::
C:\WINDOWS\system32\Crypt16.exe
C:\WINDOWS\system32\Crypt_16.dll
C:\WINDOWS\system32\baseqgl32.dll
Registry::
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
"Windows"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,\
32,5c,63,73,72,73,73,2e,65,78,65,20,4f,62,6a,65,63,74,44,69,72,65,63,74,6f,\
72,79,3d,5c,57,69,6e,64,6f,77,73,20,53,68,61,72,65,64,53,65,63,74,69,6f,6e,\
3d,31,30,32,34,2c,33,30,37,32,2c,35,31,32,20,57,69,6e,64,6f,77,73,3d,4f,6e,\
20,53,75,62,53,79,73,74,65,6d,54,79,70,65,3d,57,69,6e,64,6f,77,73,20,53,65,\
72,76,65,72,44,6c,6c,3d,62,61,73,65,73,72,76,2c,31,20,53,65,72,76,65,72,44,\
6c,6c,3d,77,69,6e,73,72,76,3a,55,73,65,72,53,65,72,76,65,72,44,6c,6c,49,6e,\
69,74,69,61,6c,69,7a,61,74,69,6f,6e,2c,33,20,53,65,72,76,65,72,44,6c,6c,3d,\
77,69,6e,73,72,76,3a,43,6f,6e,53,65,72,76,65,72,44,6c,6c,49,6e,69,74,69,61,\
6c,69,7a,61,74,69,6f,6e,2c,32,20,50,72,6f,66,69,6c,65,43,6f,6e,74,72,6f,6c,\
3d,4f,66,66,20,4d,61,78,52,65,71,75,65,73,74,54,68,72,65,61,64,73,3d,31,36,\
00
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe," Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
All times are GMT +1. The time now is 19:56 .
