Ok-I think i have a virus:Spoolsvc.exe

[CT2DFW]

I apologize if i placed this topic in the wrong place. I am new here so Im not sure what category this would fit under. Anyways, here is my problem. Everytime i reboot windows XP on my computer, it hangs on the welcome screen and then i get the error message popup saying that Windows Search cannot find "spoolsvc.exe". I click ok and then everything goes on normally. However, this happens every single time i reboot which drastically slows down the time it takes to load my comp up. ANy help.
When i try to go to the Symantec or Norton Site, I just get redirected to a perfectnav.com
Something is fishy,
i tried to find this exe file in the registry and under services.msc.

I cannot find the file under services.msc at all.

Then i go to the registry HKey Local Machine/then the registry just disappears. Something is up with my system. Any one else have this prob or a solution?

thanks

[tireman]

See if this is what you are looking for:

Trojan/Virus Info

tireman

[ThePoor]

Spoolsv.exe is not a virus, it's the file associated with the printing... it's Spoolsv.exe not Spoolsvc.exe

[hobey19]

i would run a virus scan (housecall) and run a trojan scan at www.trojanscan.com.

between the two it should find something. i believe that file is associated with printing, but i am not sure.

craig

[CT2DFW]

no the poor
its 2 different things
Spoolsv.exe is a file dealing with printing
Spoolsvc.exe is a virus. Someone has to know something about this.

[Markoman01027]

I also have spoolsv.exe running in the background and it is associated with my printer.

[Computer Hobbyist]

It is a trojan. You might start by reading this thread. It will have removal instructions.

[CT2DFW]

OK, I will try those removal directions when i get home. But, everytime i try to work in my registry, the registry just disappears in thin air. Does any know of any legit commercial registry editor that I can use.
I need to get this thing off my system
thanks

[CT2DFW]

anyone?

[oddjob]

Have you done a virus scan, yet? Also, try doing one in Safe Mode.

[CT2DFW]

which virus scan is good to use.
how do i boot into safe mode?

[DuNgA]

You can go to housecall virus scan like hobey19 said.

http://housecall.trendmicro.com/

It'll do an online scan of your pc.

To enter safe mode, when windows is loading press F8.
It will give you different booting options. I would recommend you to boot in safe mode with networking if you intend to use housecall

[oddjob]

Firstly, restart your computer and hit F8 after POSTing and before the Windows loading screen. Select "Safe Mode with networking".

Secondly, open a browser window and go to http://housecall.trendmicro.com/ and click on "Scan Now. It's Free!" Follow the prompts and allow housecall to scan your computer.

Thirdly, go to www.grisoft.com and download and install/update the free version of AVG Antivirus. Never access the internet without a good antivirus installed on your computer.

Hey DuNgA! You beat me to it, I swear I was typing as fast as I could!

[DuNgA]

Hey DuNgA! You beat me to it, I swear I was typing as fast a I could!

LOL! I knew someone else was answering to his question the same moment i was answering his.

Back to the point.

Never access the internet without a good antivirus installed on your computer.

I second oddjob's view. Antivirus is an essential part of your pc nowdays. There are a few free antivirus out on the web and the AVG is one of the best free av around

[CT2DFW]

thanks
you guys

ill try that tonite

does this housecall just find the virus, or does it kill as well?

[Russinator]

I too had the same problem with my laptop. I found that it was running in proccesses and I would have to disable it everytime(sometimes it would cause errors on startup as well.) Recently I aquired SpyNuker and after running it, my problem stoped and no more SPOOLSVC.exe

[CT2DFW]

where can i get spynuker

[Russinator]

http://www.spywarenuker.com/download.php?hop=tarlink

[Oldkid]

Hello,
I have to strongly recommend against using SpywareNuker. It is allegedly using stolen code from Spybot Search & Destroy which is freeware. Why pay for something when you can get the same job done by the original for free?

You've been the victim of a browser hijacking, which is all too common these days so along with good antivirus you need to run antispyware apps too. The two best that are freeware are Spybot Search & Destroy & AdAware. I suggest running both. Download from their official sites.


http://www.safer-networking.org/index.php?page=home
http://www.lavasoftusa.com/

For all you ever want to know about hijackers/parasites/scumware have a look at http://aumha.org/a/parasite.htm

Just FYI, here is a description of the perfectnav adware program. http://www.kephyr.com/spywarescanner...av/index.phtml

I think Housecall will clean up the trojan but not sure if it will restore regedit & some other tools that are disabled by some viruses & trojans. Take a look at this page of Kelly's Korner to restore any of these if needed after cleaning up:
http://www.kellys-korner-xp.com/xp_tweaks2.htm

HTH

[CT2DFW]

if i do a fresh install of XP Pro, will I be OK?
What is the best way to save a few important files plus abunch of MP3's
these trojans are kicking my a$$ and im ready to jsut do a complete fresh install.
But i need to save my music and a few files
anyone?

[oddjob]

Burn everything you want to keep to CD's, do a low level format of the hdd and go ahead with your XP install.

Just be sure that you don't back up that virus, because you'll just re-infect when you reload your files and music if you do.

[CT2DFW]

OK,

well i just ran both Spybot Search & Destroy & AdAware
they both say that there are no infected files. The registry now seesm to stay up when i bring it up.
But now, when i reboot, there is no desktop. TO go anywhere, i have to go to the task manager, then run, then whatever program i need to use.

ANy suggestions?

i thought about it, i dont really want to reinstall

[CT2DFW]

anyone else?

[oddjob]

Do all your programs work, and appear in their appropriate Programs folder? If so, just select each one with your mouse pointer, right-click and select Send to>Desktop (Create Shortcut). Whatever isn't working properly, just re-install it and it will be back to normal.

[CT2DFW]

hmm-interesting

i will do that tonite


when i hit CTRL ALT DEL

i see the spoolsvc.exe in the running processes. hopefully i will kill it tonite

[Karnevil9]

Delete it from the processes. If you can find it in the registry delete it from there also. if you are running XP with the restore option enabled, disable it, otherwise it will just restore the virus. Leave the restore option disabled until you are sure that the virus is gone. I would suggest to use restore to go back to a point before the virus appeared but I think it is too late.