HELP PLEASE!! I cannot get online to download spybot. I think I have a worm/virus. Norton AntiVirus wont start, Task Manager Won't Start, Cannot connect to the net. For a while, my computer wouldn't boot, just continually restarted. I have run HijackThis! here is the log: Logfile of HijackThis v1.97.7 Scan saved at 3:39:34 PM, on 11/24/2003 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Ontrack\Fix-It\mxtask.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\System32\SPOOLSRV.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe E:\KAZAA\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://webmail.juno.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Danny Boy's Browser R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Windows Spooler] SPOOLSRV.exe O4 - HKLM\..\Run: [NAV CfgWiz] C:\PROGRA~1\NORTON~1\Cfgwiz.exe /R O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.exe O4 - HKCU\..\RunOnce: [Windows Spooler] SPOOLSRV.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM (HKLM) O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37830.8122222222 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Please Help me fix whatever crap is going on! Thank you sooo much. Daniel

This is the only thing I see that draws my attention but is not a huge problem. R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 Anyone else see something I might be missing??? KTTD

I do see something suspecious... in processes C:\WINDOWS\System32\SPOOLSRV.exe and... O4 - HKLM\..\Run: [Windows Spooler] SPOOLSRV.exe O4 - HKCU\..\RunOnce: [Windows Spooler] SPOOLSRV.exe the spooler process should be: C:\WINDOWS\system32\spoolsv.exe as you have listed above... As far as what virus is causing it...not sure yet ...looking at one of the randex varients but reg entry not quite the same...mabye what I see will help someone else to better the diagnosis..until then I will keep looking... For now try running scan in safe mode since you can't run task manager to end process on SPOOLSRV.exe

I must be getting old. I missed two of them tonight :( KTTD

Just found another link... http://www.titan.co.nz/clint/page58.html Trojan is called "magic Horse" by them It steals cashed passwords and sends them by email to hacker. Have hijack only running and check the following entries to fix. O4 - HKLM\..\Run: [Windows Spooler] SPOOLSRV.exe O4 - HKCU\..\RunOnce: [Windows Spooler] SPOOLSRV.exe Reboot the pc and delete the spoolsrv.exe file located in c:\windows\system32\spoolsrv.exe <-this file Be careful.....dont delete spoolsv.exe Note the spelling

KTTD Guess that's why more than 1 or 2 ppl people can read logs...helps to have more than one set of eyes looking at them. Danielgrigson Once you get rid of that and hopefully all is well and working properly again...few things I would do. I would certinly look into running a firewall...xp's if nothing else..and visit windows update to grab the critical updates (there are lots) By turning on xp's firewall you should be able to stay online long enough to get updates to protect you from the many exploits and worms running around that hit just because you are online. (if you don't know already) To turn on firewall: start> settings> network connections> your internet connection> properties> advanced> check "protect my computer and network by limiting or preventing access to this computer from the internet" Ok your way out. Good luck

Blender, You are correct and just as others learn. I myself have again gained more knowledge. Computers are a never ending learning experience. Thank you for your time and experience. KTTD