spoolsv.exe taking up all available CPU

jester13 · 10-14-2009, 10:12 AM

I think there's a virus running under cover of spoolsv.exe Windows XP sp3 OS, upon startup have to go to task manager and end process spoolsv.exe at least twice, somtimes three times to get any CPU freed up. Have gone into computer in safe mode, after turning off system restore, and renamed spool under C:\WINDOWS\system32 to spoolsv.exe.old Restart computer, new file called spool. Avira, AVG and Malwarebytes have failed to detect anything.

DDS logfile-
DDS (Ver_09-10-13.01) - NTFSx86
Run by jwhite at 11:04:58.28 on Wed 10/14/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2511 [GMT -4:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\System32\svchost.exe -k eapsvcs
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k dot3svc
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\oracle\ora90\BIN\OWASTSVR.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\system32\wm.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\creative\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex}&startPage={startPage}
mWinlogon: System=ziswin.exe
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [AdobeBridge]
mRun: [Adobe Version Cue CS2] "c:\program files\adobe\adobe version cue cs2\controlpanel\VersionCueCS2Tray.exe"
mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe"
mRun: [<NO NAME>]
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe"
mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~2.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodakp~1.lnk - c:\program files\kodak\picture easy software\program\PezDownload.exe
mPolicies-system: CompatibleRUPSecurity = 1 (0x1)
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
Trusted Zone: hp.com
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-140-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: {DA9CC0AF-B2C2-4C15-894A-509C222935E9} = 172.16.1.7,128.1.5.9
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 nwv1_0

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\creative\applic~1\mozilla\firefox\profiles\qt78ss19.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R2 OracleWebAssistant1;OracleWebAssistant1;c:\oracle\ora90\bin\OWASTSVR.EXE [1999-1-20 117248]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]
S3 Mssseruce;Mssseruce; [x]
S3 OracleClientCache80;OracleClientCache80;c:\orant\bin\ONRSD80.EXE [2004-8-20 101136]
S3 OracleOrahome90ClientCache;OracleOrahome90ClientCache;c:\oracle\ora90\bin\ONRSD.EXE [1999-2-11 99328]
S3 scsiscan;SCSI Scanner Driver;c:\windows\system32\drivers\scsiscan.sys [2005-7-1 11520]
S3 Tfspisgr;Tfspisgr;c:\windows\system32\drivers\rdpdr.sys [2004-8-11 196224]
S4 Naearrv1wmms;Naearrv1wmms; [x]

=============== Created Last 30 ================

2009-10-14 10:47 <DIR> --d----- c:\windows\system32\spool
2009-10-13 12:12 <DIR> --d----- c:\program files\AVG
2009-10-13 12:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg9
2009-10-13 11:42 <DIR> --d----- c:\windows\pss
2009-10-13 11:17 <DIR> --d----- c:\docume~1\creative\applic~1\Uniblue
2009-10-13 09:53 153,088 -------- c:\windows\system32\dllcache\triedit.dll
2009-10-09 12:09 <DIR> --d----- c:\docume~1\creative\applic~1\Malwarebytes
2009-10-09 12:09 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-09 12:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-09 12:09 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-10-09 12:09 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-09-29 15:25 55,656 a------- c:\windows\system32\drivers\avgntflt.sys
2009-09-29 15:24 <DIR> --d----- c:\program files\Avira
2009-09-29 15:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-09-29 13:16 <DIR> --dsh--- c:\documents and settings\creative\IECompatCache
2009-09-15 11:05 7 a------- c:\windows\system32\Class13
2009-09-15 11:05 5 a------- c:\windows\system32\Band4

==================== Find3M ====================

2009-08-17 11:04 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
2009-08-03 15:07 403,816 a------- c:\windows\system32\OGACheckControl.dll
2009-08-03 15:07 322,928 a------- c:\windows\system32\OGAAddin.dll
2009-08-03 15:07 230,768 a------- c:\windows\system32\OGAEXEC.exe
2009-07-29 00:37 119,808 a------- c:\windows\system32\t2embed.dll
2009-07-29 00:37 81,920 a------- c:\windows\system32\fontsub.dll
2009-07-29 00:37 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-07-29 00:37 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 09:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2007-06-06 09:18 1,305 ---sh--- c:\windows\config\ntp2.ini2
2009-05-01 13:15 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009050120090502\index.dat
2009-05-01 13:16 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat

============= FINISH: 11:05:34.19 ===============

gmer results-

gmer results-

GMER 1.0.15.15125 - http://www.gmer.net
Rootkit scan 2009-10-14 14:19:35
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\creative\LOCALS~1\Temp\fxlyrfoc.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Fastfat \Fat ADB4CD20

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

jester13 · 10-15-2009, 01:15 PM

Ended up formatting the machine and, working off a fresh build, trying to find all the software now. Sorry I couldn't wait, contract expires at the end of the week and I have to have this machine running by then.

10-14-2009, 10:12 AM	#1 (permalink)
jester13 Registered User Join Date: Oct 2009 Posts: 2 OS: winXP sp3	I think there's a virus running under cover of spoolsv.exe Windows XP sp3 OS, upon startup have to go to task manager and end process spoolsv.exe at least twice, somtimes three times to get any CPU freed up. Have gone into computer in safe mode, after turning off system restore, and renamed spool under C:\WINDOWS\system32 to spoolsv.exe.old Restart computer, new file called spool. Avira, AVG and Malwarebytes have failed to detect anything. DDS logfile- DDS (Ver_09-10-13.01) - NTFSx86 Run by jwhite at 11:04:58.28 on Wed 10/14/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2511 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\System32\svchost.exe -k eapsvcs C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k dot3svc svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\oracle\ora90\BIN\OWASTSVR.EXE C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\TightVNC\WinVNC.exe C:\WINDOWS\system32\wm.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\system32\fxssvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe C:\Program Files\Kodak\Picture Easy Software\Program\PezDownload.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\creative\My Documents\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex}&startPage={startPage} mWinlogon: System=ziswin.exe TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [AdobeBridge] mRun: [Adobe Version Cue CS2] "c:\program files\adobe\adobe version cue cs2\controlpanel\VersionCueCS2Tray.exe" mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe" mRun: [<NO NAME>] mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe" mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~1\server\bin\VERSIO~2.EXE mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~2.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodakp~1.lnk - c:\program files\kodak\picture easy software\program\PezDownload.exe mPolicies-system: CompatibleRUPSecurity = 1 (0x1) IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html Trusted Zone: hp.com DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-140-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: {DA9CC0AF-B2C2-4C15-894A-509C222935E9} = 172.16.1.7,128.1.5.9 Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll LSA: Authentication Packages = msv1_0 nwv1_0 ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\creative\applic~1\mozilla\firefox\profiles\qt78ss19.default\ FF - plugin: c:\program files\mozilla firefox\plugins\npyaxmpb.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R2 OracleWebAssistant1;OracleWebAssistant1;c:\oracle\ora90\bin\OWASTSVR.EXE [1999-1-20 117248] R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512] S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016] S3 Mssseruce;Mssseruce; [x] S3 OracleClientCache80;OracleClientCache80;c:\orant\bin\ONRSD80.EXE [2004-8-20 101136] S3 OracleOrahome90ClientCache;OracleOrahome90ClientCache;c:\oracle\ora90\bin\ONRSD.EXE [1999-2-11 99328] S3 scsiscan;SCSI Scanner Driver;c:\windows\system32\drivers\scsiscan.sys [2005-7-1 11520] S3 Tfspisgr;Tfspisgr;c:\windows\system32\drivers\rdpdr.sys [2004-8-11 196224] S4 Naearrv1wmms;Naearrv1wmms; [x] =============== Created Last 30 ================ 2009-10-14 10:47 <DIR> --d----- c:\windows\system32\spool 2009-10-13 12:12 <DIR> --d----- c:\program files\AVG 2009-10-13 12:12 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg9 2009-10-13 11:42 <DIR> --d----- c:\windows\pss 2009-10-13 11:17 <DIR> --d----- c:\docume~1\creative\applic~1\Uniblue 2009-10-13 09:53 153,088 -------- c:\windows\system32\dllcache\triedit.dll 2009-10-09 12:09 <DIR> --d----- c:\docume~1\creative\applic~1\Malwarebytes 2009-10-09 12:09 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-09 12:09 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-10-09 12:09 19,160 a------- c:\windows\system32\drivers\mbam.sys 2009-10-09 12:09 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware 2009-09-29 15:25 55,656 a------- c:\windows\system32\drivers\avgntflt.sys 2009-09-29 15:24 <DIR> --d----- c:\program files\Avira 2009-09-29 15:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira 2009-09-29 13:16 <DIR> --dsh--- c:\documents and settings\creative\IECompatCache 2009-09-15 11:05 7 a------- c:\windows\system32\Class13 2009-09-15 11:05 5 a------- c:\windows\system32\Band4 ==================== Find3M ==================== 2009-08-17 11:04 411,368 a------- c:\windows\system32\deploytk.dll 2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll 2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll 2009-08-03 15:07 403,816 a------- c:\windows\system32\OGACheckControl.dll 2009-08-03 15:07 322,928 a------- c:\windows\system32\OGAAddin.dll 2009-08-03 15:07 230,768 a------- c:\windows\system32\OGAEXEC.exe 2009-07-29 00:37 119,808 a------- c:\windows\system32\t2embed.dll 2009-07-29 00:37 81,920 a------- c:\windows\system32\fontsub.dll 2009-07-29 00:37 119,808 -------- c:\windows\system32\dllcache\t2embed.dll 2009-07-29 00:37 81,920 -------- c:\windows\system32\dllcache\fontsub.dll 2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll 2009-07-19 09:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll 2009-07-17 15:01 58,880 a------- c:\windows\system32\atl.dll 2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll 2007-06-06 09:18 1,305 ---sh--- c:\windows\config\ntp2.ini2 2009-05-01 13:15 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009050120090502\index.dat 2009-05-01 13:16 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat ============= FINISH: 11:05:34.19 =============== gmer results- gmer results- GMER 1.0.15.15125 - http://www.gmer.net Rootkit scan 2009-10-14 14:19:35 Windows 5.1.2600 Service Pack 3 Running: gmer.exe; Driver: C:\DOCUME~1\creative\LOCALS~1\Temp\fxlyrfoc.sys ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Fastfat \Fat ADB4CD20 AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) ---- EOF - GMER 1.0.15 ---- Last edited by amateur; 10-14-2009 at 01:00 PM. Reason: to retain 0-reply status

10-15-2009, 01:15 PM	#2 (permalink)
jester13 Registered User Join Date: Oct 2009 Posts: 2 OS: winXP sp3	Re: spoolsv.exe taking up all available CPU Ended up formatting the machine and, working off a fresh build, trying to find all the software now. Sorry I couldn't wait, contract expires at the end of the week and I have to have this machine running by then.