Hey guys, I've recently re-installed xp a couple weeks back and its been runing fine, untill today when i switched it on and got a nice, big, blue screen error, i thought nothing of it and just turned off and on, then my comp took ages to startup, the little blue bar on the loading screen was going forever, anyway, i finally got on and came to restart later on after doing a virus scan then i got another blue screen set for this time i wrote it down, take a look:

STOP: 0X0000007E (0XC0000005, 0XFDA1298, 0XF8286364, 0XF8286060)

Sptd.sys - Address F7DA1298 base at F7D7E000 Date Stamp 4391a4dF

I Know, doesnt really tell you how to fix it. I'm going to search the net and try to find some info while I wait for some replys from you guys.
Heres My comp Specs:
Windows Xp Pro SP2
Pentium 4 CPU 1.60ghz x86 Family 15 model 1 stepping 2 GenuineIntel ~1594mhz
704mb of ram
Total Virtual Memory 2.00GB
Intel(r) 82801BA/BAM AC'97 Audio Controller
Nvidia Geforce FX 5200 128mb
SMC EZ Card 10/100 PCI (SMC1211TX)
Thx alot, Any help much appreciated Thx Dave

Hey Dave,

Run the PreWork, let's take a look at your logs.

TTFN

LGW

thx 4 the reply, i've done a hjt scan, will do an ewido and spy sweeper when i get back from my exam at 11am heres the hjt below, i'll upload now so u can take a look while u wait for me to get back, i havent removed anything yet with hjt, will wait for ur reply n then look through n see what looks dodgy, also my anti virus has been picking up the same virus every 30 mins or so, i've done a boot scan and a normal scan but it doesnt find anything, i think a file somewhere is executing every so often, i will note down what its called the next time it appears, i tried clearing the temp internet files, the temp files and searched windows file but no luck , thx dave

Attached Files

hijackthis.log (6.5 KB, 4 views)

o.k, by prework i hope u ment hjt n ewido because thats were the link took me , anyway, i've noted down the virus name n i think the virus filename changes each time but it still goes into the same folder in system32, virus info i will upload in a text file along with my logs from scanners

Attached Files

	Ewido Scan report_20060614.txt (14.4 KB, 4 views)
	Info on virus.txt (220 Bytes, 5 views)
	Spy Sweeper Session Log.txt (9.4 KB, 4 views)

Hi there

I'm not too sure, but to me the following look rather suspicious:
O4 - HKLM\..\Run: [00saskda] "C:\Program Files\1st Security Agent\newadmin.exe" saskda
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

For the supposed trojan horse, try altering it's file type, like instead of .tmp, make it .txt or something, and see what happens. Check if a new file gets made especialy.

The scan looks clean, just cookies mainly, the only major thing on there is "
14:18: Quarantining All Traces: trojan-downloader-zlob" but apart from that everything else is cookies.

Have you tried doing online virus scans with different companies, PC-Cillin, Norton, Mc-Afee,... ?

Let me know of anything new
Cheers

Thx 4 the reply,

O4 - HKLM\..\Run: [00saskda] "C:\Program Files\1st Security Agent\newadmin.exe" is the program i use to restrict my younger brother from accessing parts of the computer that i don't want him to

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install i think is something to do with my Nvidia drivers.

BTW: I tried panda anti-virus, it picked it up and deleted it, but then it came back , must be generating from somewhere.

I tried making making it a txt file but no luck, i found and easier way, i just changed the security settings and denied all access to the system32-->1024 folder, my comp should be ok now shouldn't it??

thx dave