What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please help Spools.exe

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I just started having troubles with my computer. I have spools.exe running, and I don't recognize it. I'm having odd pop ups asking me to DL stuff. Also, I'm not able to view any graphics only text. Here's my Hijackthis file. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:38:33 PM, on 6/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\LocalService\cftmon.exe C:\Program Files\Internet Explorer\iexplore.exe c:\program files\mcafee.com\agent\mcupdate.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdtej.exe] C:\WINDOWS\system32\kdtej.exe O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Owner\cftmon.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Owner\cftmon.exe O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'Default user') O21 - SSODL: xvorfwbd - {D45B3E29-9D01-4BE6-9F0A-B7F7B3EB4D4D} - C:\WINDOWS\xvorfwbd.dll O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Schedule - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe – End of file - 2673 bytes
Post #2
Here's a 2nd Hijackthis file… it looks slightly different. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:50:25 PM, on 6/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\LocalService\cftmon.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdtej.exe] C:\WINDOWS\system32\kdtej.exe O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Owner\cftmon.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Owner\cftmon.exe O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'Default user') O20 - Winlogon Notify: opnmjatr - C:\WINDOWS\SYSTEM32\opnmJAtr.dll O21 - SSODL: xvorfwbd - {D45B3E29-9D01-4BE6-9F0A-B7F7B3EB4D4D} - C:\WINDOWS\xvorfwbd.dll O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Schedule - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe – End of file - 2572 bytes
Post #3
Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.
  • Open the SDFix folder and double click on RunThis.bat to start the script.
  • Type Y and press Enter to begin the script.
  • It will start cleaning your PC and then prompt you to press any key to Reboot.
  • Press any key to restart the PC.
  • Your system will take longer than normal to restart as the fixtool will be removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished.
  • Press any key to end the script and to load your desktop icons.
  • A text file should automatically open, so please copy the contents and post them here. We also need you to post a new HijackThis log
Post #4
Hi IndiGenus, Thanks so much for getting to my post so quickly. I am on my laptop now….the infected computer is my desktop. I've loaded the SDfix and its working, I think, so I'll post the results in the AM. Have a great night!
Post #5
Hello -

I ran the SDFix, and now at least my graphics are showing up, instead of text only. Here's the log file from SDFix.

SDFix: Version 1.194
Run by [removed] on Tue 06/17/2008 at 10:28 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
narqwe

Path :
\??\C:\WINDOWS\system32\narqwe.sys

narqwe - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value
Restoring Default Schedule Service Path

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\opnmJAtr.dll - Deleted
C:\WINDOWS\system32\kdtej.exe - Deleted
C:\175490~1 - Deleted
C:\Documents and Settings\LocalService\cftmon.exe - Deleted
C:\Documents and Settings\Owner\cftmon.exe - Deleted
C:\Program Files\XP Antivirus\xpa.exe.tmp - Deleted
C:\d.exe - Deleted
C:\WINDOWS\neltabxw.exe - Deleted
C:\WINDOWS\vrmdtneg.dll - Deleted
C:\WINDOWS\wpvmqosg.dll - Deleted
C:\WINDOWS\xvorfwbd.dll - Deleted
C:\WINDOWS\system32\drivers\spools.exe - Deleted
C:\WINDOWS\system32\narqwe.sys - Deleted



Folder C:\Program Files\XP Antivirus - Removed
Folder C:\WINDOWS\system32\824223 - Removed
Folder C:\WINDOWS\system32\834668 - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-18 06:09:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

C:\WINDOWS\SYSTEM32\wuauclt.exe [912] 0xFF44C318

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …


scan completed successfully
hidden processes: 1
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Disabled:Internet Explorer"
"C:\\Program Files\\Real\\RealOne Player\\realplay.exe"="C:\\Program Files\\Real\\RealOne Player\\realplay.exe:*:Disabled:RealOne Player"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 21 Jul 2001 94,784 ..SH. — "C:\WINDOWS\twain.dll"
Wed 4 Aug 2004 50,688 ..SH. — "C:\WINDOWS\twain_32.dll"
Wed 4 Aug 2004 1,028,096 A.SH. — "C:\WINDOWS\SYSTEM32\mfc42.dll"
Wed 4 Aug 2004 54,784 ..SH. — "C:\WINDOWS\SYSTEM32\msvcirt.dll"
Wed 4 Aug 2004 413,696 A.SH. — "C:\WINDOWS\SYSTEM32\msvcp60.dll"
Wed 4 Aug 2004 553,472 ..SH. — "C:\WINDOWS\SYSTEM32\oleaut32.dll"
Wed 4 Aug 2004 83,456 A.SH. — "C:\WINDOWS\SYSTEM32\olepro32.dll"
Wed 4 Aug 2004 11,776 ..SH. — "C:\WINDOWS\SYSTEM32\regsvr32.exe"
Tue 4 Feb 2003 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 4 Feb 2003 401 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv15.bak"
Wed 8 Aug 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!


For some reason, when I run my HJT and click "Save Log", HJT shuts down. So, its not letting me save a log. Any suggestions on that? Also, C:\WINDOWS\system32\kdtej.exe is still a running process according to HJT.
Post #6
I believe that process is related to a wareout infection so we'll go after that next. Then try HJT again, not sure why it's doing that?

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

Once the desktop loads please post the text that will open (report.txt) and a new HijackThis log.
Post #7
Hello- I'll soon post the logs for the wareout fix. But, my HJT is still not making a log. It will do a system scan, but as soon as I hit "save log" all of HJT shuts down. I even did an uninstall/reinstall and that didn't fix it. Is it possible that its been compromised as a part of a virus to not work? Not sure how else to explain it.
Post #9
Username "Owner" - 06/18/2008 19:08:16 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces\{7520F761-84E3-42C8-B8A3-A578E6FDDDBC} "DhcpNameServer"="[removed],[removed]"
Post #11
OK no problem, we have other options to still try. Let's try running Deckards System Scanner. It will run HJT as part of the scan but will give us more info. too.

Please download Deckard's System Scanner (DSS) and save it to your Desktop.
  • Close all other windows before proceeding.
  • Double-click on dss.exe and follow the prompts.
  • When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.
Post #12
Ok… I renamed the file…it works now…but, now I have WinAnonomys.com popping up! Where's all this carp** coming from?? Anyway, here's the new HJT files. Also, hopefully you saw the other scan you requested just a few up from this one. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:49:23 PM, on 6/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\mcafee.com\agent\McAgent.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\Owner\Desktop\LogFileHJT.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\rundll32.exe O2 - BHO: (no name) - {08F358BD-339B-41E1-8757-AE8F249EDFFB} - C:\WINDOWS\system32\iifCTMfF.dll O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe O4 - HKLM\..\Run: [BM6baaff4c] Rundll32.exe "C:\WINDOWS\system32\cpbvjsqj.dll",s O4 - HKLM\..\Run: [6899ccd0] rundll32.exe "C:\WINDOWS\system32\radcgccr.dll",b O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe – End of file - 2076 bytes
Post #13
Ahhh, you have a Vundo infection also, very heavily infected machine here….

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  • Please, never rename Combofix unless instructed.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Post #14
Hi there… good morning! Here's my ComboFix log file:

omboFix 08-06-16.5 - Owner 2008-06-19 7:33:52.5 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\BM6baaff4c.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\aocaloed.dll
C:\WINDOWS\system32\bmf.cs
C:\WINDOWS\system32\ccs.so
C:\WINDOWS\system32\cpbvjsqj.dll
C:\WINDOWS\system32\FfMTCfii.ini
C:\WINDOWS\SYSTEM32\FfMTCfii.ini2
C:\WINDOWS\system32\ho.ln
C:\WINDOWS\system32\iifCTMfF.dll
C:\WINDOWS\system32\ko.o
C:\WINDOWS\system32\kodbsswx.dll
C:\WINDOWS\system32\mn.n
C:\WINDOWS\system32\ntpl.bin
C:\WINDOWS\system32\nvrsma.dll
C:\WINDOWS\system32\radcgccr.dll
C:\WINDOWS\SYSTEM32\rccgcdar.ini
C:\WINDOWS\system32\xwssbdok.ini

—– BITS: Possible infected sites —–

hxxp://ygsondheks.info
.
((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.

2008-06-18 19:07 . 2008-06-18 21:17 d——– C:\fixwareout
2008-06-17 22:11 . 2008-06-17 22:11 d——– C:\WINDOWS\ERUNT
2008-06-17 22:03 . 2008-06-18 06:34 d——– C:\SDFix
2008-06-16 21:51 . 2008-06-16 17:36 94,208 –a—— C:\WINDOWS\exwd.exe
2008-06-16 21:43 . 2008-06-16 21:43 577,024 –a—— C:\WINDOWS\SYSTEM32\dllcache\user32.dll
2008-06-16 21:43 . 2008-06-16 21:43 93,696 –a—— C:\qnprukh.exe
2008-06-16 21:43 . 2008-06-16 21:43 69,120 –a—— C:\amtbnr.exe
2008-06-16 21:43 . 2008-06-16 21:43 10,000 –a—— C:\WINDOWS\SYSTEM32\jfiehayd.dll
2008-06-16 21:43 . 2008-06-16 21:43 7,680 –a—— C:\heam.exe
2008-06-16 21:43 . 2008-06-16 21:43 705 –a—— C:\d1.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2003-04-07 01:46 226 —-a-w C:\Program Files\INSTALL.LOG
2001-07-22 02:45 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 07:56 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-04 07:56 1,028,096 –sha-w C:\WINDOWS\SYSTEM32\mfc42.dll
2004-08-04 07:56 54,784 –sh–w C:\WINDOWS\SYSTEM32\msvcirt.dll
2004-08-04 07:56 413,696 –sha-w C:\WINDOWS\SYSTEM32\msvcp60.dll
2004-08-04 07:56 553,472 –sh–w C:\WINDOWS\SYSTEM32\oleaut32.dll
2004-08-04 07:56 83,456 –sha-w C:\WINDOWS\SYSTEM32\olepro32.dll
2004-08-04 07:56 11,776 –sh–w C:\WINDOWS\SYSTEM32\regsvr32.exe
.
C:\WINDOWS\system32\user32.dll … is infected !! (additional data below)
577,024 2005-03-02 18:19:56 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
528,896 2003-09-26 18:51:30 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
528,896 2002-11-22 18:16:00 C:\WINDOWS\$NtUninstallKB824141$\user32.dll
577,024 2004-08-04 07:56:46 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
561,152 2001-08-18 05:36:34 C:\WINDOWS\$NtUninstallQ328310$\user32.dll
560,128 2003-09-25 16:49:02 C:\WINDOWS\$xpsp1hfm$\KB824141\user32.dll
528,896 2002-11-01 21:26:46 C:\WINDOWS\$xpsp1hfm$\Q328310\user32.dll
267,265 2001-08-18 12:00:00 C:\WINDOWS\I386\USER32.DL_
577,024 2004-08-04 07:56:46 C:\WINDOWS\ServicePackFiles\i386\user32.dll
577,024 2008-06-17 02:43:33 C:\WINDOWS\SYSTEM32\user32.DLL
577,024 2008-06-17 02:43:33 C:\WINDOWS\SYSTEM32\dllcache\user32.dll


——- Sigcheck ——-

2005-03-02 13:19 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
2003-09-26 13:51 528896 7c30507d3d251bf5b88048bb2d226de9 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
2002-11-22 13:16 528896 1bd18b332a07fd10bf0322c352a78078 C:\WINDOWS\$NtUninstallKB824141$\user32.dll
2004-08-04 02:56 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\$NtUninstallKB890859$\user32.dll
2001-08-18 00:36 561152 be57a5c3abd240514b98f6bca872fb21 C:\WINDOWS\$NtUninstallQ328310$\user32.dll
2003-09-25 11:49 560128 32173306185f603e75c477e117f3bb8d C:\WINDOWS\$xpsp1hfm$\KB824141\user32.dll
2002-11-01 16:26 528896 68e1f4ef02df52ca9c5e157045d23582 C:\WINDOWS\$xpsp1hfm$\Q328310\user32.dll
2004-08-04 02:56 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\ServicePackFiles\i386\user32.dll
2008-06-16 21:43 577024 7d44da0eff0fccd80339f3faad792882 C:\WINDOWS\SYSTEM32\user32.DLL
2008-06-16 21:43 577024 7d44da0eff0fccd80339f3faad792882 C:\WINDOWS\SYSTEM32\dllcache\user32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2007-10-11 16:48 212992]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2005-09-22 18:29 311296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I263"= i263_32.drv
"VIDC.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
–a—— 1998-11-30 19:04 497376 C:\WINDOWS\p_981116.exe



Heres my HJT file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:29:13 AM, on 6/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Owner\Desktop\LogFileHJT.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 2146 bytes
Post #15
Hi,

I need you to install the recovery console on your PC. If you have your OS CD you can follow the instructions at the following link:

http://support.microsoft.com/kb/307654

If not then you can use these instructions:

Installing the Recovery Console

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System


[external image: Posted Image]


Download the file & save it as it's originally named, next to ComboFix.exe.



[external image: Posted Image]


Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

Let me know how you made out with this and whether or not it has been installed successfully also.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI