Internet, Play, Teach

Removing the SPD.EXE virus from Windows 7

I’ve had a few computer issues over the course of the last week. First the cooling fan packed up on my computer. Got a new fan and fixed that. Then I started having some data loss issues on my hard drives. I think I’ve solved that. Then I notice a process called “spd.exe” maxing out my CPU. I think I’ve fixed that.

They say these things come in threes, so hopefully I’m all fixed. For now !

It’s been quite frustrating at times trying to resolve these issues. My computer had it’s lid off 10 times on the one day – I was cursing, more than a little bit !

Positives that have come are that I’m making better provision for backup of my data, and the ongoing task of backing up to the cloud will continue. I’ve got a much more effective cooling system on my computer now than I had before, which means I can run the CPU at full throttle without the machine crashing – So I’ve solved a major bugbear. And I’ve become more adept at spotting and removing viruses from my computer. Happy, in the end yes 🙂

The fan and the hard drive issues aren’t all that interesting. If someone said they wanted to know more about how to cool a desktop PC effectively, then perhaps I’ll post.

For me documenting the virus I’m doing because I couldn’t find a virus scanner or other piece of software to remove it automatically. So it may be helpful for others searching on Google for “the answer”.

Removing the SPD.EXE virus from Windows 7

I noticed that I had a process in my “Task Manager” running at 100% CPU – spd.exe, also pretends to be “cFosSpeed Service”. As I wasn’t running anything else on the machine I thought it odd. A few Google searches later and I learn that it may be a virus or malware. Inspection of the virus’ files which include libcurl.dll, confirmed my concerns that it’s a virus (or malware). My Microsoft security essentials hadn’t picked it up. So I tried CCleaner and Malwarebytes, both of which failed to recognise spd.exe as a problem. I even installed something called UnHackMe which was recommended on the page I found the info about the spd.exe virus. This didn’t recognise it either.

So what to do ? Well I’m fairly handy with technology – so fix it myself. I’m not aiming this as a newbie step-by-step guide, it’s more a document that would aid power users or the makers of Malwarebytes/anti-virus software to be able to remove.

DonCharisma.org-Temp-dir-spd.exe

To remove the virus, you’ll need to locate all the files. In my case – %TEMP%\TMP-SETUP.EXE and the files in %APPDATA%\ADOBE\FLASH PLAYER\SPEEDCACHE\*

DonCharisma.org-Flash-Player-Speedcache-spd.exe

 

The virus also puts an entry into the registry so it’ll start itself on machine startup. In regedit search for “SpeedUpSystem”. I learn’t this from looking at %APPDATA%\ADOBE\FLASH PLAYER\SPEEDCACHE\aso.bat file which writes the entry in the registry.

DonCharisma.org-Task-Manager-spd.exe

 

And you’ll need task manager open to kill the process.

In my case I also archived the files in a password encrypted .rar archive, in case I want to inspect in future for whatever reason.

The removal process : –

1. Kill the spd.exe process in Task Manager.

2. Delete all files and the directory itself – %APPDATA%\ADOBE\FLASH PLAYER\SPEEDCACHE\*

3. Delete the file %TEMP%\TMP-SETUP.EXE

4. Delete the registry entry for “SpeedUpSystem”

5. Restart the machine.

6. Job should hopefully be done – check task manager to make sure spd.exe isn’t running anymore.

Hope this helps someone somewhere !

Warm regards

Don Charisma

Resources and Sources

Info I found on spd.exe virus – http://greatis.com/blog/how-to-remove-malware/spd-exe.htm

Malwarebytes – https://www.malwarebytes.org/

CCleaner – http://www.piriform.com/ccleaner/download

26 thoughts on “Removing the SPD.EXE virus from Windows 7”

  3. Pingback: DGen.exe pushes CPU Utilization to 100% | Flameater

  4. thanks, it helped… i found it today as my pc was so fkin hot and voila… spd.exe 100% cpu

  5. Thanks Don, I have an Avira free antivirus and I usually don’t restart or shut down my system more than once or twice a week. A few days back I noticed the startup missing error due to the fact that my antivirus has deleted the “spd.exe” and by the looks of it I thought that my flash player has missing parts. so, I download a new version of adobe flash player and install this new version.
    I thought that the problem is solved till this morning, that the damned error showed up again.
    That’s when I searched for fixes and came upon your website.

    Thanks again.

  6. i did what you said, it wasnt so clear on how the registry thing works so i searched for SpeedUpSystem, it found it, and i just deleted it…every time i open my pc now i get a Windows Script Host Eror saying it cant find the script file…\afile.vbs. How can i solve this??

  7. Thank you so much! I may also change my passwords as this virus is a Trojan.

  10. helpfull info. DON. i had minor glitches with my windows 7 program like you fixed n researched the problems on my own all is well for now, i just run disk clean up every month to keep it right an stay away from sites the take to long to load they carry viruses that get pass the fire wall.

  14. I finally gave up on Windows and bought an Apple iMac. Fewer problems and it comes equipped with about any language one could possibly want. Windows machines come only in Japanese in Japan, and I read English.

    1. That’s one direction for sure, price is always a factor for me so I’m apple as far as my ipad and iphone, but can’t afford to go fully that direction. I’ve had my fair share of issues with Apple too, so they are not perfect either !

      It’s my understanding that the language can be switched on a Windows machine, and keyboards with English characters bought or at least stickers applied to the keys … But yes all this is hassle !

Comments are closed.