Need some assistance

[JimiP]

Hi all,

I've been working with a customer computer that has a nasty rootkit. Spooldr.sys. The PC will boot up onto the login screen but when I attempt to select an account it will begin to load up but right when I do I get the infamous BSOD. It will do the same thing when I try to boot into Safe Mode. The man who owns the PC needs to access his E-Mails and other important files yet I cannot even fully boot it up.

Reformatting is not an option ATM. After I get a chance to Ghost the HDD to another then I can go about reformatting if I have to.

Any help would be greatly appreciated.
-JimiP

 

[John]

That's a nasty rootkit that comes from those greeting ecards. SUPERAntiSpyware will nuke it, but it must be installed in Normal mode. If you want to run SAS in safe mode without having to install anything, and you already have SAS installed on another pc, you can simply copy the entire SUPERAntiSpyware folder from c:\program files\ to a flash memory drive. Now run SUPERAntiSpyware.exe and it will update the definitions and copy them to the local machine.

Since neither is an option yank the drive and scan it on a clean computer.

 

[Medea]

Nice to know that SAS will nuke that file. John is, of course, correct. The likely source of that file was from one of those stupid ecards. In some of them, after clicking on the URL in the body of the email, a screen appears asking you to download "Microsoft Data Access" to view the message. It's not a Microsoft program, and it will install a file named MSDATAACCESS.EXE which:
infects the computer and causes a chain reaction of disabling security programs like antivirus and firewalls, joining a peer-to-peer botnet to receive more commands and dangerous software from a wide range IP addresses, corrupting a file called TCPIP.SYS, and changing your DNS settings on your local area network or dialup connection.

Once your computer is infected, its difficult to remove - but not impossible.

For a detailed explanation, see:
http://www.pchell.com/support/greetingcards.shtml