I thought it will be a simple task to search then solve that spoolsv.exe issue but it isn't
(By the way, the 'System Restore' is disabled since long ago.)
1) I didn't find any trace of C:\Windows\SPOOLSV.EXE (or equivalent) in the XP registry, win.ini or system.ini. So, it seems it is not a 'Backdoor_Ciadoor_B', right?
2) Winlogon.exe of XP cannot run without that C:\Windows\SPOOLSV.EXE if deleted!
3) If it is 'Hacktool.Privshell' trojan, is it enough for me to replace that 'spoolsv.exe' with the good one in 'C:\Windows\System32'? Does XP Pro SP2 needs this file in two places?!
4) Is it possible that 'Winlogon.exe' is directed, at the start, to the infected 'C:\Windows\SPOOLSV.EXE' by a sort of command embedded in 'pagefile.sys' (virtual memory)?!
5) Perhaps the starter is disguised under another name.
Here is the complete list in the 'RUN' key:
=== Begin list1 ==================================================
Known to me (hence clean):
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"CookieWall"="C:\\Program Files\\AnalogX\\CookieWall\\cookie.exe"
Not sure about:
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"PHIME2002ASync"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\System32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\System32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
" "="C:\\WINDOWS\\system32\\primafilla ok !!.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_01\\bin\\jusched.exe"
"MsmqIntCert"="regsvr32 /s mqrt.dll"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
=== End list1 ====================================================
And should I delete the following ones in the 'RUN-' key list?
=== Begin list2 =========================
"ABBYY Community Agent"="C:\\PROGRA~1\\SPRINT~1.0OF\\Sprint\\CAgent.exe"
"TkBellExe"="C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe -osboot"
=== End list2 ===========================
6) Is it a mere coincidence that just before the update 0513-1 my PC got infected or I had it since long but 0513-1 was able to detect it as WIN32:Trojan-gen {Delphi} now?
Note: The size of my actual infected spoolsv.exe is 407,552 Bytes
Thank you in advance for any further hint and/or advice.
Kerim