I am having a heck of a time getting rid of sphlp32.exe from my computer. I have run AVG, AD-AWARE -- both said they found & dealt with the virus but it keeps showing up. Right now, it is randomly crashing Internet Explorer. AD-AWARE crashed at the same point during 2 or 3 scans so I manually stopped it, at which point it removed/quarantined the bugger.

Upon rebooting, the warning "VIRUS DETECTED!" popped up ... said there was a virus in Windows/system32/sphlp32.exe. AVG said it is not accessible. I went looking for it myself ('Show hidden files' is checked) but could not find it.

Anyone know what I could try next?

 

Try doing a search for it instead of browsing to the folder it claims it is in.

You might also try ccleaner www.ccleaner.com

 

After 2 days work, I think I've gotten rid of the original threat (sphlp32.exe) but there still seems to be something not quite right.

I came across a trial version of a removal tool (SpySweeper from Webroot ... I think I'll buy it that caught the virus & removed it after 3 or 4 tries. After everything seemed clean, I tried running Adaware but it crashed repeatedly at the same point -- I think while it was scanning the registry (HKEY_USER something something something or other).

Today, I downloaded & ran Spybot Search & Destroy. On the initial run, it asked if I wanted to backup the registry. I let it but it crashed while doing this. I ran it a second time (without the registry backup) &, like SpySweeper, it pronounced my system clean.

I am guessing that the registry is corrupt in some way although my system boots & runs good right now.

Is there a simple way for me to examine/fix the registry - REGEDIT? I am not really confident enough to actually do any editing (I know this can really screw things up) but maybe someone here could give me an idea of what to look for or perhaps point me to an 'AUTO REGISTRY REPAIR' program?

 

be sure to run your scans from safe mode.

 

I haven't been using SAFE MODE since I didn't know much about that. I did some reading & now know a bit. I tried it -- my computer won't boot in SAFE MODE. It loads a few drivers, the screen goes blank & all disk activity stops.

I tried SAFE MODE WITH COMMAND PROMPT -- same thing. I assume this means I still have a virus?

Before I try booting to last known good configuration, how much will I lose if I do so? recently installed programs such as the scan programs I have been using?

 

More info (in case anyone is out there ... after Googling around for a while, I found that XP resisting running in SAFE MODE is quite common. There are many opinions as to 'why' -- video drivers / Nero interference / et al -- but no clear solutions.

The viruses/adware seem to be gone but I would still like to run a few scans in SAFE MODE to be sure.

Anyone have any thoughts?

 

how long did you let it sit? it can take up to a couple minutes for safemode to come up.

 

I left it for over 10 minutes on one occasion.

 

if it were me, i would format the drive and reinstall everything, making sure safemode worked. you might want to try reinstalling xp again over itself and see if that solves it.