This thread's last reply is from July 14, 2013, 11:08 AM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
Computer is very slow right now...cursor arrow is shaky and sticks on screen for millisecond. ....
======================================================
SystemLook 04.09.10 by jpshortstuff
Log created at 13:33 on 02/07/2013 by Administrator
Administrator - Elevation successful
My Internet service went off again. I don't want you to think I am slacking on this. Here are the results:
I went to Jotti's with my I.E. browser to upload the sptd.sys file and right away I got this:
"File is empty (0 bytes)!" Therefore it would not load.
I went to C:\WINDOWS\system32\drivers\sptd.sys (The file actually doesn't load at Jotti's with a ".sys" extension...just as "sptd")
There I checked the properties of the file and it registered at 675kb.
I returned to Jotti's with my Firefox browser and loaded the file again. After 2 hours the file was still loading (the "upload progress" was still at zero and to the right, the "service load was at about 10% which is where it was when I started. The message was "Uploading, please wait..."
Something isn't right.
If using Vista or Windows7, when prompted by UAC allow the prompt.
Click on Start Scan
The scan will run.
When the scan has finished a list of detected items should be displayed.
Check to make sure the Cure option is selected in the drop down options. If cure is not available DO NOT select either Delete or Quarantine, just select Skip and let me know.
Please click on Continue
TDSSKiller will now attempt to clean the infection from your computer.
It will now ask for a reboot to complete the process, please click on Reboot now
When finished re-booting, a log of the cleanup will be found at C:\TDSSKiller.2.4.0.0_DD.MM.YYYY_HH.MM.SS_log.txt(where DD.MM.YYYY_HH.MM.SS are the date and time the tool was run)
Post the contents in your next reply please.
Next
Double click OTL.exe to launch the programme.
Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.
:Files
C:\WINDOWS\system32\drivers\sptd.sys
Click the Run Fix button.
OTL will now process the instructions.
When finished a box will open asking you to open the fix log, click OK.
The fix log will open.
Copy/Paste the log in your next reply please.
Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.
OK, the file appears to have been removed successfully, now please do the following ....
Please double click GMER to start it ....
Wait for it to finish it's preliminary startup scan, which should only take a few seconds, and when it has ...
Click >>> to open the options.
Click Files and wait for it to "populate" the main window.
Click the + against the Windows folder to expand it.
Click the + against the System32 folder to expand it. (this is a large folder, so may take a few seconds to populate)
Click the Drivers folder. (this is a large folder, so may take a few seconds to populate)
In the right hand side of the GMER window, there should now be a list of files with .sys file extensions.
Scroll through the files (the scroll bar is at the bottom not the side) and look for any with the pattern .... sp**.sys .... (where ** are replaced by any other 2 letters ... eg spbh.sys, spmi.sys, etc etc)
If you find any ...
Note down their names
Do not attempt to delete them at this point.
Post me the names of any that you find.
This might seem like a pointless exercise, since you can scroll through the same folder using Explorer.exe in Windows, but GMER can see files which may be hidden when using Explorer.exe, so since we had problems finding these kind of files earlier, I want to make sure that there aren't any hiding on your computer now.
Out of only 21 items (including 10 folders) showing in the GMER window from the "drivers" folder there were none starting with sp**
I went to folder options (just to be sure) and unchecked "show hidden files and folders" and also unchecked "hide protected system operating files" and then "apply"
I then did a search of the system32 drivers file and it is gone.
OOPS...I must have been on page 1 of this thread. Sorry.
Anyway....My computer is faster but (perhaps unrelated) my Firefox browser keeps going back to the previous page on it's own. Weird.
I can try a reinstall.
AVG: No Flags
The "sptd" file is still in a folder on my computer at: C:/_OTL/MovedFiles/07042013_083451/C_WINDOWS/system32/drivers/sptd
The "hosts" file and the "downloads" files we moved earlier are closeby in a "07012013_104730" folder
Should I remove all of these?
I understand the sptd.sys file is used for Daemon Tools and Alcohol 120% and perhaps others
which I am not using at present.
No worries, it's easy to miss the page markers if you're not looking for them.
Try uninstalling and re-installing Firefox, there's a new version just come out (version 22), so you'd probably need to update anyway. If you're still having problems with it afterwards let me know.
The files you've noticed are the encrypted backups that OTL makes, they're not hazardous, but we'll remove them in a moment anyway when we remove OTL and the other programs we've been using on your machine.
First ....
Let's clear out OTL and the files and folders it created. This will also remove TDSSKiller, SystemLook and GMER (apart from the random named .exe file).
Double click OTL.exe to launch the programme.
Click on the CleanUp! button.
OTL will download a list from the Internet, if your firewall or other defensive programmes alerts you, allow it access.
You will be prompted to allow the clean up procedure, click Yes
When finished exit out of OTL
Now delete OTL.exe (if still present).
Next
Please delete ... 6wn7uw97.exe
As far as I can see, your computer looks clear of infection now.
Are you still noticing any problems ?
If you are let me know about them.
If not it's time to make your computer more secure.
Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.
OK....Gary. Did the cleanup. Went with the text links you provided and learned some new things. I alsodid the cleanup which I already do on a regular basis..I also use CCleaner and sometimes ATF cleaner to remove what Disk Cleanup doesn't. I uninstalled Firefox 22.0 and reinstalled it. I have Firefox Maintenance installed and I think that keeps me updated. I emptied out all of the Sp3 and hotfix folders and removed all but the latest restore point. Dumped more than 3 Gigs overall. I just hit the space bar and the browser jumped back to the previous page....TWICE. Hmmmmm! Also...when I try to post...it goes to the previous page and I have to hit the "forward" arrow to keep from losing my post. This happens over and over until it decides to post. GOOD NEWS.....My computer is faster than a roadrunner now. Thank you so much!!!.................Steve
Also get this a lot of this: "The submitted form was invalid. Try submitting again."
I just keep posting over and over til it takes......
✨ Ask AI about this thread
No ads, no affiliate links — generated on request from this thread's own
archived content, not written by forum staff. Never run a scan/removal tool
as a self-service step if the original thread describes it being done under
a helper's direct supervision, and don't include your name, email, or other
personal details in a follow-up question. See our privacy page
for details on how this works.
