ms32.sys

From: Jnthn (n_at_yahoo.com)
Date: 10/23/05 

Date: Sun, 23 Oct 2005 13:57:01 +0200

There's a file named ms32.sys in the root directory of my boot drive.
It's an EXE file.

After deleting c:\ms32.sys, the computer began to shut down every 15
minutes: It was as if I clicked "Turn Off" in Start > Turn Off
Computer. Every single time, "W32Time" errors were listed in the Event
Viewer. I then disabled "Automatically synchronize with an Internet
time server" in Date and Time Properties but the problem became worse:
the PC would shut down shortly after loading the desktop.

I couldn't solve the problem so I put back ms32.sys in the root folder.
The PC doesn't shut down anymore.

I unpacked ms32.sys (it was UPXed) and found the string
"http://195.95.218.100/users/serg/web/serg.jpg" in it. I downloaded
"serg.jpg" and although it has a JPG extension, it's an EXE file.

When I go to "http://195.95.218.100," CMD.EXE starts on my computer. A
"Windows Script Host" error window pops up ("There is no script engine
for file extension '.vbs'.").

Neither AVG Anti-Virus nor HouseCall online virus scanner find any
viruses on the machine. I also ran Ad-Aware.

I couldn't find the string "ms32.sys" in the registry and there's
nothing suspicious in ...\CurrentVersion\Run.

Any idea?

Relevant Pages

  • Re: National Geographic
    ... should be a main exe file.. ... Click On The "Compatibility" Tab at the top, ... If the exe you choose didnt work, try doing it a few others ... that same root directory.. ...
    (microsoft.public.windowsxp.general)
  • Re: ms32.sys
    ... Malke wrote: ... > Jnthn wrote: ... >> There's a file named ms32.sys in the root directory of my boot drive. ... >> It's an EXE file. ...
    (microsoft.public.security.virus)
  • Re: Windows script host access disabled...
    ... I got the following msg when I tried to open an .EXE file: ... Windows script host access is disabled on this machine. ... Contact your administrator for details. ...
    (microsoft.public.windowsxp.help_and_support)