DIGIT-ARC read-only archive · snapshot: July 23, 2026

Virus found in spool.sys any expert here

7 posts · originally from https://geek.digit.in/community/threads/virus-found-in-spool-sys-any-expert-here.16043/

ri12ku2002
ri12ku2002 Original post #1
Sep 26, 2005 at 10:40 AM
Found Strain of trojanrootkitAgent.ae in C:\WINNT\SYSTEM32\SPOOLV.SYS
i CHOOSE OPTION REPAIR OR DELETE, BUT THE MESSAGE IS FILE IN USE
WHAT CAN I DO PLEASE GIVE ME SUGGESTION MY INTERNET GOING VERY SLOW
I AM USING WINDOW 2000 AND MY ANTIVIRUS IS qUICK hEAL
lywyre
lywyre #2
Sep 26, 2005 at 11:19 AM
check the filename again ! Is it SPOOLV.SYS or SPOOLSV.sys

If it is SPOOLV.sys you can safely delete it or if it is SPOOLSV.sys it is the printer service, and you rather not delete it.
Instead try system restore, that will be a safer decision and also empty your temp folder (Type "%TEMP%" in the address bar, without quotes).

Also download "Autoruns.exe" from www.sysinternals.com and remove the entry for spoolv.exe in the startup.
Autoruns is a program to check what programs are running while Windows boots up. More:*www.sysinternals.com/utilities/autoruns.html
ri12ku2002
Sep 26, 2005 at 1:42 PM
Its work

Ya my typing mistake its SPOOLSV.SYS
thx its work
but another problem is .................
*217.170.4.137/_vti_bin/index.html THIS ADDRESS ALSO OPEN AUTOMATICALLY IN BROWSER
HOW CAN I STOP THIS
T
Sep 26, 2005 at 2:00 PM
use spybot and see if it removes it
else downlaod hijackthis run it .. an dpost log file here
Choto Cheeta
Sep 26, 2005 at 3:13 PM
but another problem is .................
*217.170.4.137/_vti_bin/index.html THIS ADDRESS ALSO OPEN AUTOMATICALLY IN BROWSER
HOW CAN I STOP THIS

make sure that the Start page/Home Page is asigned Blank...
expertno.1
Sep 26, 2005 at 4:09 PM
*217.170.4.137/_vti_bin/index.html THIS ADDRESS ALSO OPEN AUTOMATICALLY IN BROWSER
HOW CAN I STOP THIS
This is the sure sign of spyware if inspite of making the home page as blank it opens

So get spy bot

and pleaase post a hijackthis log here

Thanks
REgards..
Expertno.1
ri12ku2002
Sep 26, 2005 at 5:17 PM
problem still remain

thx for ur value post
but the problem still remaining
the home page address is blank
during surfing that address automatically come then a security message come "you want to search bar .................................."
then i close direct from task manager after that my internet not working :cry: after reboot net is working but after some time that link come again and internet stop

"Subha sai paresaan huan resart kar kar ke thak gaya huan"

i use the microsft Antispyware but nothing be found

please tell me brief about the log file i am new in computer