SPCMDCon.sys.

spcmdcon.sysQuestion: I've been having bubbles from SECURITYTOOLS asking me to register with them.
since I don't want to, I recieve messages on my screen every minutes.
and every 30 mn, my computer is shut down, just like that. Then, I have a blue screen, and I can see that the virus' name is SPCMDCon.sys.
and it restarts on its own.
what can I do?
enco22Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
JonveeConnect With a Mentor Commented:
Another excellent Tool is Combofix.   You can download the free, ComboFix, and save it to your Desktop >
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Before using ComboFix please disable any realtime Anti-virus, Anti-spyware, Shields, etc. that you may have running.

Also it may be necessary to rename ComboFix.exe (to Combo-Fix.exe for example), before saving it to your desktop.  If you have difficulties downloading it, try downloading to another machine, then into a USB memory stick or CD.  Rename it and carry to the infected machine, then try this key combination to reach a Run box>
Windows Logo+R: Run dialog box

Double click "combofix.exe" and follow the prompts.
When it's finished it will have produced a Logfile, probably at C:\ComboFix.txt.
You could post that log, together with a HijackThis log, in a reply for us.
Please do not mouseclick Combofix's window while it is running, because it may stall.  It is absolutely normal for you to see a blue screen with flashing cursor, and this can last for up to 25 mins.
Ideally ComboFix should be run in normal mode, although it will work in safe mode if you're unable to reach normal mode.

If you need it>   A guide and tutorial on using ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 
_Connect With a Mentor Commented:
Several options are available:

Download and burn to cd/dvd one of the following ISOs

List of boot cds:
http://www.zimbio.com/AntiVirus+Software/articles/455/FREE+Bootable+AntiVirus+Rescue+CDs+Download

I have had pretty good luck with Kaspersky:
http://devbuilds.kaspersky-labs.com/devbuilds/RescueDisk/
Download the .ISO file, burn it to disk, and then boot from it. It should ask to download update files, and then scan the system.

or get Malwarebytes and/or SuperAntispyware and run them on the system.
You may need to boot into Safe Mode to get them to run, or better yet, take the infected drive out and either Slave it to another system or use a USB external caddy to put the drive in, and scan that way.

SUPERAntispyware (free for home use)
http://www.superantispyware.com/

Malwarebytes
http://www.malwarebytes.org/
0
 
JonveeCommented:
General information on the spcmdcon.sys file if it was uninfected>

Diagnostic information on SPCMDCON.SYS:
http://www.spywarecease.com/file-diagnosis/SPCMDCON-SYS-111648.html

What is spcmdcon.sys for?
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/XP/Q_21378810.html
0
Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

 
enco22Author Commented:
I want to thank you all of you, but i resolve the problem myself. I reboot with safe mode and I restore to an early date. Now everything work fine.
I hope this info can be useful for others that they have the same problem.
Email me if needs more detail info.
0
 
JonveeCommented:
That's good enco22, and now that you have resolved your own problem you may wish to retrieve your points by clicking the 'Accept As Solution' button in your own comment, to complete the question.

On LH column click "Asking questions", then click "How do i close a question".
http://www.experts-exchange.com/help.jsp#hi407

Incidently it is the policy of Experts Exchange that we should not include our personal email addresses in a question....it's also for your own security.   You can however include it in your "Member Profile".  
But not a problem, i'll put in a request for a Moderator to remove it for you.
Thanks   Jonvee.
0
 
_Commented:
Thanks for the feedback.    : )
0
 
_Commented:
Thank you much.   : )
0
All Courses

From novice to tech pro — start learning today.