Hi Again
Sorry for the delay It took me awhile to test then I fell asleep as it was
late here UK
I can see why you are having problems with this, It drops two
files on the system which are exact copies of the original file, Its hard to
describe this as It behaves like a worm by sending itself to everyone in the
infected pc's address book via MSN but the main file does keep contacting out
so It could have some Backdoor features.
The File gets copied as spoolsv.exe into the windows folder but it will not
be visible unless you enable operating system files and hidden files and
folders, you cannot delete it as Its the same name as the genuine Microsoft
spoolsv.exe file even using the same name in properties "Spooler SubSystem
App", I tried to delete it with a batch script and set attributes to remove
hidden, read and system status but still got access denied messages when I
run the script, Then it drops another file into the system32 folder called
resys.exe which again is a exact copy of the infecting file and has hidden
and read only status. It then enters itself as SVCHOST=
C:\Windows\spoolsv.exe into the Run area of the registry and also hooks into
explorer.exe to make sure it starts with windows, This makes the Worm/Trojan
even run in safe mode and finally you cannot use Task Manager when its on the
system, You can open task manager but cannot end the Worm process, If you
left click the end process windows doesnt show up , If you right click on a
entry and choose end process it will end the process of items below it but
the Worm keeps running.
You picked a great infection there
)
I've made a simple batch script and included taskkill in the folder so that
I can stop the worm version of Spoolsv.exe, Then the batch with remove
hidden, read only and system status on both files and remove them, It then
removes the Run Key and restores explorer.exe back to the way it should be
then deletes all temp files,
One important part to this is the fix needs to be run in safe mode, The Worm
will be running in safe mode but not the genuine file so taskkill will only
stop the Worm and when you reboot the genuine file starts up as normal, My
email is on the fixtool so if you have any problems just let me know, The
alternative would of been using Hijack This as the Antivirus scanners may not
of restored the explorer.exe entry but that could lead to mistakes or the
genuine file being removed because the Worm is very difficult to find with it
being hidden as a operating system file.
Its a good idea to change passwords on programs you use including MSN and
remeber this worm will send itself to everyone on the infected pc's MSN list
so you may get this again if your contacts are infected
Download the Remover Here :
http://andymanchesta.com/DL/Remover.zip
Save to desktop and extract the file, Please Then reboot into safe mode !!
(Reboot and keep tapping F8 and choose safe mode from the list)
Once your in safe mode go into the remover folder and double click
Remover.bat and follow the on screen prompts , Its very small and will only
take 10 seconds to run and then the Worm will be removed,
Let us know if you need more help with this
Regards
Andy
