spool.exe

I had the task of fixing a computer with the spool.exe virus. This computer is Windows XP sp2 with from what I could tell no antivirus installed. Usually when I'm fixing a computer I will use hijack this, spybot, adaware, and process explorer as tools. Even in safe mode every program I put on the machine was automatically attacked and shutdown. This was extremely frustrating so after consulting Google I decided to delete the spool.exe from C:\WINDOWS\system32\drivers. After I restarted the computer every one of the file association paths broke. So now if I click on any program windows will ask me how I want to open that program. Has anyone ever dealt with this type of problem before? Right now the only option I see is fdisk and I would rather not reinstall if there is a fix available. Thanks.

I would say use system restore in order to get functionality back. Have you tried using one of those online antivirus scans? You probably shouldn't be connected to the network, but, if you already are, you should try to get some antivirus help via the web. You can also try opening task manager and killing the virus process directly, although I'm not sure if that would work. If it did kill the process, you should be able to run software to get rid of it. Do this in safe mode through the Administrative account.

Quote:

---

Originally Posted by itPro

I would say use system restore in order to get functionality back. Have you tried using one of those online antivirus scans? You probably shouldn't be connected to the network, but, if you already are, you should try to get some antivirus help via the web. You can also try opening task manager and killing the virus process directly, although I'm not sure if that would work. If it did kill the process, you should be able to run software to get rid of it. Do this in safe mode through the Administrative account.

---

I was in safe mode with the admin account. I killed the process through task manager and some how it kept re launching itself. I couldn't use a web browser because the virus disabled them all (Explorer, firefox, and Opera). Although now that the actual file "spool.exe" has been deleted I can't use any program. So even in safe mode I can't access the internet for a scan. I just created a bootable anti virus disk using Bart PE although I'm pretty sure that wont fix my file association problem. When I get home tonight I will look at system restore. Thank You.

This might be a long shot but it looks like it dug itself into HKEY_CLASSES_ROOT.

See if you can still run command.com. Cmd.exe is probably not working because of the borked .exe association. If command.com works try copying regedit.exe to regedit.com.
Use regedit.com to have a look at HKEY_CLASSES_ROOT. Especially the .exe and exefile keys.

Or if you're able to boot the disk load the registry hive to have a look.

there is a fix....
Inside the zip file is a .com file you can run and a reg file that does the same thing as well. The hard part is getting one of those to run.

For the reg entry press CTRL-ALT-DEL and open Task Manager. Once there, click File, hold down the CTRL key and click New Task (Run). Now that a cmd window is open, type regedit.exe and hit enter or type in the path to the .com file and run it from there.

For the manual fix go here http://support.microsoft.com/kb/837334

This may help:

http://www.dougknox.com/xp/file_assoc.htm

EDIT:

You need to make sure that you have gotten rid of the malware first. This is just to fix the associations problem ;)

Hi I am a newbie here but I saw your conversation about spool.exe and faght it pretty much all night I tried all the tatics mentiond above the virus wouldnt let me go back to restore any further than yesterday and it had made its own restore point so there was no way I was doing that both in cmd prompt and run it pretty much took over all administrator rights I ended up reinstalling windows unfortunitly I did a quick format and the virus is back it might have hoped a ride on my D: external and if thats the case this thing is pretty untouchable any tips on where to go from here. thnx

Hello snightwolfred, and welcome to AO.

We need to know a bit more about your setup, firstly what is your operating system and service pack/update status?

Then your hardware:

1. Laptop or desktop?
2. What drives does it have? In particular do you have a CD or DVD drive and do you have a floppy drive?
3. I notice that you have an external drive and that it is D:\, which tells me that you have only one internal hard drive, is that correct? What make is it?
4. Do you have the CD/DVD for your operating system?
5. Do you have access to another computer (friend/relative/library) where you can perform clean downloads?
6. What were you using the external drive for, or was it just attached to the system? In particular did you run any executable from the external drive?

I will wait for your replies to the above before giving you more detailed instructions. :)

First off thank you guys very much for the help on the file association issue. After fighting with this for quite some time I decided to just re-install windows xp. This machine is a Dell dimension 8400. I formatted the drive using the dell windows install disk and re-installed windows xp sp2. When it was done installing I tried to boot into windows and it automatically blue screened. So I swapped out the hard drive with one that I knew was good ran the install and I got a blue screen again when I tried to boot into windows. I noticed the computer was only on bios version 3 so I updated it to bios version 9. I swapped out the dell xp install disk for a regular windows xp install disk and swapped out the sata cable to the hdd just in case. I ran the install and now when I boot up it will tell me the windows didn't start properly and gives me the choice to go to last good known, safe mode, or start windows normally. Whichever one I choose just causes the computer to loop and restart. I ran memtest86 and everything passed. I'm not even sure where I should go from here. Any advice is appreciated. Thanks.

Hi,

Get dban:

http://dban.sourceforge.net/

Nuke the HDD with the bootable disk. And start the re-installation from scratch.

A single pass will do for the drive overwrite.

Run chkdsk from the XP cd (or Bart PE). That drive may be
going bad. Make sure S.M.A.R.T. is enabled in the bios.

It's not unusual to see PC's with more than one issue, both
hardware and software.

Hmmmm,

Quote:

---

So I swapped out the hard drive with one that I knew was good ran the install and I got a blue screen again when I tried to boot into windows. I noticed the computer was only on bios version 3 so I updated it to bios version 9. I swapped out the dell xp install disk for a regular windows xp install disk

---

I wonder if it isn't something to do with the Dell CD? A hidden partition or the like?

Dell is notorious for that kind of stuff-- my laptop came with a small fat partition (~50mb) with memtest and some dell utils...It is likely you have a small logical partition at the beginning of your hd...i recommend just deleting it

Nihil- I've also tried the install with 2 non dell windows xp discs and they also ran into the same problems.

Hard disk A had bad sectors chkdsk repaired them and it still blue screened.
Hard disk B also had bad sectors when I ran chkdsk. Hard disk B also blue screened. So I decided to use a 3rd hdd which we will call hard disk C. I ran setup and it blue screened when windows tried to boot. Now I'm pretty sure hdd B, and C were fine before I stuck them in the computer. Is it possible that the virus is hiding somewhere else in the computer and some how wrecking the sectors on the hdd's when I run setup? I also swapped out the cd drive and that didn't fix the problem. I'm not sure if this is applicable but on each of the 3 hdd's when I run chkdsk it goes through really fast until around 50% then it goes really slow.

**EDIT**

At this point the user is going to by a new computer so I will no longer be working on this issue. Thank you to all the AO users for your help and suggestions.

Hmm well I would really like to know the outcome of this?

Was this malware or hardware problem?

Hi there joshmobile & Cider,

This really is an intriguing one, and I think that we are looking at more than one problem.

1. Malware. OK a nuisance, but I have never heard of spool.exe causing damage. It is associated with trojan/worm remote access type activity. I do not believe that this is related to the HDD problems.

2. To have three HDDs "go bad" one after the other is strange. I don't really believe that was caused by hardware faults in the drives themselves. That is just too much of a coincidence for my liking.

3. RAM seems to check out.

4. Different cables were tried.

5. Different installation CDs were tried.

At this point, all I can suggest is that the PSU is defective and is killing the drives during the Windows install? After all, the Molex connector comes straight from the PSU to the HDD. If you use the same bad one, it will kill anything you attach it to.

I would suggest getting the respective manufacturers' diagnostic software, slaving the drives to another machine and running a full/deep scan. If you are offered a "repair" option then take it, otherwise, try zero-filling it.

Normally I would not recommend continued use of a defective drive, but I don't think that these drives are physically damaged, just electronically scrambled. Unfortunately, checkdisk isn't exactly the sharpest tool in the shed when it comes to these situations :(

It might even be possible to "repair" these drives, but the software is quite expensive and would not be worth it, unless you encountered defective drives on a regular basis.

@ joshmobile:

Quote:

---

Is it possible that the virus is hiding somewhere else in the computer and some how wrecking the sectors on the hdd's when I run setup?

---

Yes, that is quite possible but highly improbable. I think that is what this TCP (trusted computing platform) technology is all about. Basically you protect flashable components with a special EEPROM chip to keep malware out.

You see, there are a number of memory devices in your PC that are flashable. They are used to store device firmware and can be updated, which also means that they can be infected or compromised.

To do such a thing would take a considerable degree of skill and knowledge, and I hardly think that someone with those pre-requisites would stoop to something as trivial as this?

My money is on a bad PSU;)