Re: spoolsv32.exe
From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 08/19/05
- Next message: MowGreen [MVP]: "Re: Microsoft update virus security issue (W2k SP4) error: 0x8DDD0"
- Previous message: Phil Weldon: "Re: Rebooting loop!"
- In reply to: Unplugged: "spoolsv32.exe"
- Next in thread: Unplugged: "Re: spoolsv32.exe"
- Reply: Unplugged: "Re: spoolsv32.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 19 Aug 2005 09:36:19 -0400
From: "Unplugged" <dave_tek@hotmail.com>
| This would seem to be the latest player in this week's worm-war.
|
| Our network is distributed in such a way that centralized updates are
| not easily accomplished, so a number of our Win2K machines were caught
| with their Hotfixes down about their ankles. Most machines were
| cleanable using a couple of tools from Sysinternals (AutoRuns and
| ProcessExlorer) followed by Windows and AV updates, scanning, etc., but
| at least one set required a heavier-handed approach. ERD Commander
| from Winternals Software did the trick, getting us around the reg key's
| locked-down security permissions.
|
| The new process name, spoolsv32.exe, turned up today. The display name
| in the Administrative Tools/Services list is Win32 AutoDrivers. The
| reg key is:
|
| HKLM/System/Controlset001/Services/Win32 Autodriver
|
| The executable is C:\Winnt\spoolsv32.exe.
|
| So far, it has been consistently difficult to remove, and I'm pretty
| sure that is has shown up on at least one set that has had the PnP
| patch loaded. That PC was previously infected with Esbot, however, so
| there may be some linkage there.
|
| This executable name has been associated with past worms, but this is
| definitely one of the newer PnP jobbies. I sent a sample to Symantec's
| SARC but haven't heard back yet. Anyone else run across it?
Please submit a sample of "spoolsv32.exe" to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against 18 different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all paricipating vendors.
When you get the report, please post back the exact reults.
In the mean time...
You can use the following Multi AV Command Line Scanner front end utility to scan your
computer
After you execute Multi_AV.exe you'll find a folder called; C:\AV-CLS
In the folder C:\AV-CLS you will find the file; killproc.txt [ C:\AV-CLS\killproc.txt ]
Open it in your text editor (double click on the killproc.txt file) and append to the list
spoolsv32.exe and then save the file.
It should then have the following contents...
iexplore.exe
firefox.exe
spoolsv32.exe
Then follow the rest of the below instructions...
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove
viruses, Trojans and various other malware.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.
You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.
* * * Please report back your results * * *
-- Dave http://www.claymania.com/removal-trojan-adware.html http://www.ik-cs.com/got-a-virus.htm
- Next message: MowGreen [MVP]: "Re: Microsoft update virus security issue (W2k SP4) error: 0x8DDD0"
- Previous message: Phil Weldon: "Re: Rebooting loop!"
- In reply to: Unplugged: "spoolsv32.exe"
- Next in thread: Unplugged: "Re: spoolsv32.exe"
- Reply: Unplugged: "Re: spoolsv32.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
