HELP!!! spoolsv.dll trojan!!

I have Symantec AntiVirus and it's detected a trojan in the file named spoolsv.dll now when I try to clean that file it says it's failed, when I try deleting that file it fails again. Can someone pleeeeeeeease help me as the notifications are driving me crazy and I need to get rid of it ASAP.

Any help would be appreciated.

 

Welcome to MajorGeeks.com, please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

• Bitdefender
• Panda Scan
• HijackThis

 

OK, here's the Hijack This log.

Inline log converted to attachment.

 

You have HijackThis installed incorrectly:

You have it here --> C:\DOCUME~1\June\LOCALS~1\Temp\AlphaZIP-4219328\HijackThis.exe

This is exactly where we specify not to put it. The instructions indicate:

- not a temp folder
- not on the Desktop
- no sub folder of C:\Documents and Settings

Please install it where recommended so that the backups created by HJT are in a safe location. A safe, recommended location is: C:\Program Files\HJT\HijackThis.exe

Please address this and attach the other requested logs from BitDefender & ActiveScan (Panda) so that you can be assisted further. Thanks!

 

OK, scanning with BitDefender and Panda Active Scan will take a long time so I will try and get back to you with the requested logs ASAP.

 

I think I may have found the problem, it's nothing to do with the spoolsv.dll file but there's been a Dialer.Trojan on here lately and I have found it but it won't let me delete it, it says it's in use and it is located in the Temporary Internet Files, would the Brute Force Uninstaller be able to delete this?

 

Based on your HJT log you should proceed with the scans and attach the logs as requested as it appears you have more going on than just a dialer. Running the online scans as instructed using safe mode with networking ensures that very little is running at startup thus allowing for many things to be taken care of BY the scans.

The scan results also allow us to see what your computer is or was infected with and then we know what steps need to be taken to remove what is or may still be there.

 

OK I have the 3 requested logs here as attachments.

 

Running the scans as you said has fixed the spoolsv.dll trojan and the Dialer.Trojan that I found is called 'bgates[1].exe I have tried deleting this file in Normal AND Safemode but it keeps saying it is being used.

 

Download
- Pocket Killbox
- ExplorerXP

Empty your Internet Explorer Cache
Empty your Recycle Bin

<< The installed version of Java on this compter is out-dated. Install version 1.5.0_07 available from http://www.java.com/en/download/manual.jsp. Uninstall all older versions of Java on your computer, before installing the latest version of Java. >>

Uninstall anything you have installed from InCode Solutions.

In HJT Choose Open the Misc Tools Section choose Process Manager, Highlight:

Choose Kill Process

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

 

Here is the fresh HJT log that you requested.

 

Rename hijackthis.exe to analyse.exe.

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Post a fresh HijackThis log.

 

Woops, I must have missed them, will do it now............................................................................

Here's the fresh log,

 

Did you install this tool?
C:\PROGRA~1\PPATCH~1\tracert.exe

 

Nope, why?

 

If you didn't install this, then with HijackThis fix:
O4 - HKCU\..\Run: [Sen] "C:\PROGRA~1\PPATCH~1\tracert.exe" -vt ndrv

Reboot to Safe Mode.

Open Windows Explorer, navigate to C:\PROGRA~1\PPATCH~1. Delete the entire folder.

Reboot to Normal Mode.

Post a fresh HijackThis log.

How is your computer running?

 

It's running fine at the moment, sorry for the late reply I didn't realise there was a 2nd page

 

Lets flush all your restore points and create a new clean one for your system.

Disable And Enable System Restore
How to Protect yourself from malware!

Safe surfing.

 

Cheers for the help wouldn't have done it without you!!

 

You're welcome.