Deleted spools.exe and now paying the price! - Page 2

Question

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

plastered 0 Junior Poster in Training · Answer 1 · 2009-01-31T05:51:38+00:00

Also I noticed that my internet is running real slow. Could it be because of this mess? I'll follow the steps and revert back.

plastered 0 Junior Poster in Training · Answer 2 · 2009-01-31T06:06:55+00:00

i finished running the tool and the following is the result.

===============================================

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\p_protect.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

==============================================

Log of HJT is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 05:30:55, on 2009-01-31
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 192.168.1.1,218.248.240.23
O17 - HKLM\System\CS1\Services\Tcpip\..\{35D307E8-6B83-4F28-9479-8EC657B823F4}: NameServer = 192.168.1.1,218.248.240.23
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4969 bytes

==============================================

When the computer rebooted there was an error message saying there is no disc in drive. I am posting the screen shot. Also whenever I log out it gives an error message stating "Userinit failed to initialize as the Windows is shutting down."

Also when I right click on Recycle bin, the Empty Recycle Bin option is greyed out.

======================================

Thanks for the help. Will wait for the next steps.

plastered 0 Junior Poster in Training · Answer 3 · 2009-01-31T06:08:41+00:00

I'll take the Recycle Bin error back. I just found the option back :)

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 4 · 2009-01-31T07:00:42+00:00

Your hijackthis log is clean, but you really need to get yourself an anti-virus program and a firewall installed.

Go to Start | Run and type in sfc /scannow and hit the Ok button. Insert your CD if/when requested.

plastered 0 Junior Poster in Training · Answer 5 · 2009-01-31T16:23:16+00:00

I will do that. The sfc / scannow was fine. Now before we can mark this thread solved if wanted to know the "Standby / Hibernate" option on my computer is missing and why my computer is running slow. Very slow.

I took opened the tower for a mess up of the dust and had also removed the only memory module (256 MB - humour me) cleaned it and then fixed it. The computer response time had increased drastically although there aren't many processes running and there is enough page file memory. Any fix. Other than getting more RAM :)

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2009-01-31T19:16:32+00:00

There is no substitute for more memory :). 256Mb :icon_eek: wonder it boots :D.

Reduce Internet Explorer's cache to 50Mb, clear out all temp files, defragment the hard drive etc.

Not sure what is happening with your standby/hibernate.

jbennet 1,618 Most Valuable Poster Team Colleague Featured Poster · Answer 7 · 2009-01-31T21:19:00+00:00

jbennet 1,618 Most Valuable Poster

15 Years Ago

Have you got your chipset drivers installed?

plastered 0 Junior Poster in Training · Answer 8 · 2009-02-01T06:16:18+00:00

@ Crunchie:
Sometimes I wonder the same :P How the hell does it reboot and then I think maybe it is because I got a 512 Mb Video card. :P Lol!!

@ jbennet

Yep everything is installed. I was able to use the option until yesterday before it disappeared.