unable to move infected file

Hi!

Check the memory to see if there is any instances of the trojan. If you find any, terminate them. You could also make sure that Explorer displays both hidden or system files (the trojan could set these attributes of the file ssqrp.dll).

You can only upload archive files or image files. You can attach only the text (copy - paste) of the report in a new reply, you don't have the attach the entire file.

Andrei

Hi!

Check the memory to see if there is any instances of the trojan. If you find any, terminate them. You could also make sure that Explorer displays both hidden or system files (the trojan could set these attributes of the file ssqrp.dll).

You can only upload archive files or image files. You can attach only the text (copy - paste) of the report in a new reply, you don't have the attach the entire file.

Andrei

Thanks for replying so quickly. When you say to chek the memory, do you mean to do a memory scan? I have explorer set up to display hidden files.

Thanks again.

Tom

Ypou can open the task manager (pres CTRL+ALT+DEL or press CTRL+SHIFT+ESC or go to run -> taskmgr) and seek any process that looks to be the trojan. If you can, finish them.

Andrei

http://www.processlibrary.com

To see if it are legit processes or not enter the procesname to the follow websites:

http://www.neuber.com/taskmanager/process/index.html Here you can browse to see if it's a malware process or not. If you can't find it kill the process.

I also recommend that you download superantispyware free : http://downloads2.superantispyware.com/dow...AntiSpyware.exe Update it reboot your pc and press several times on the F8 button before the windows loading screen choose for safe mode. After that start superantispyware and perform a complete scan.

Regards

Niels

Hi

To see if it are legit processes or not enter the procesname to the follow websites:

http://www.processlibrary.com

http://www.neuber.com/taskmanager/process/index.html Here you can browse to see if it's a malware process or not. If you can't find it kill the process.

I also recommend that you download superantispyware free : http://downloads2.superantispyware.com/dow...AntiSpyware.exe Update it reboot your pc and press several times on the F8 button before the windows loading screen choose for safe mode. After that start superantispyware and perform a complete scan.

Regards

Niels

I've already been to 'process library' the process 'ssqrp.dll' is not listed, I would delete the process from my pc is I couild locate it on my pc. Its nowhere to be found!! Ive done complete search and no 'ssqrp.dll' is found. but yet BD detects it when doing a scan. I use 'Process Explorer' instead of the normal task manager, and it doest even show up there. I have pasted a portion of the scan report - :

C:\WINDOWS\system32\ssqrp.dll Infected: MemScan:Trojan.Virtumod.ALX

C:\WINDOWS\system32\ssqrp.dll Disinfection failed

C:\WINDOWS\system32\ssqrp.dll Move failed

Here is a report of the memory scan that was done a few days ago - :

Summary:

C:\WINDOWS\system32\ssqrp.dll Infected: MemScan:Trojan.Virtumod.ALX

C:\WINDOWS\system32\ssqrp.dll Rename failed

Download also superantispyware as I suggested in my previous post. Because superantispyware can remove vundo variants and other difficult malware.

Regards

Niels

Open your registry editor (go to Start -> Run -> Regedit <enter>).

The browse to the following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Run

and

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current Version\Run

and seek any refference which points to that dll. If you find any, delete it. Then reboot and do another scan, to see if BD can delete the file.

Andrei

You will see ab-icons when you navigate to the registrykeys Andrei mentionned. To deny a proces to be loaded with windows you have to delete the ab-icon. To verify that you don't remove legit start up items enter them on this website : http://castlecops.com/StartupList.html Take also a look here: start,run,at the run dialog box type msconfig press go to startup (boot) and see if you find any reference to that particular dll file. Use also the site I mentioned to verify it. If you find the dll file uncheck it. After that check also this location start,all programs,startup. But I still recommend that you run a superantispyware scan afterwards.

Regards

Niels

Ok, what exactly are 'ab-icons' ?? I didnt even think of checking start up options under msconfig! Ill check the registry as well. And Ill download the superantispyware software too. Ill post a reply later this evening. Hope all goes well. thanks in advance.

Ok, what exactly are 'ab-icons' ?? I didnt even think of checking start up options under msconfig! Ill check the registry as well. And Ill download the superantispyware software too. Ill post a reply later this evening. Hope all goes well. thanks in advance.

Hi!

What Niels reffered to are that small icons which contain a red "ab".

Sorry that I wasn't clear but I referred what Andrei said in his post. Also I don't have a English windows version. So sometimes it could be that it's named differently. You can also take a look if the trojan also don't use a service: start,run,at the run dialog box type services.msc press enter. But that isn't always the case.

Regards

Niels

Well, I've tried everything everybody has mentioned or suggested I do. BD is still unable to delete the infected file. As a final resort and just because I was tired and fed up with nothing working, I reformatted my HDD and did a clean install. I am still in the process of loading all of the applications I have. But everything is running smoothly. I really appreciate those of you who offered assistance and suggestions to me. Thanks again.

So you also tried superantispyware (sa) in safe mode? Because normally SA could remove it. A format is a little bit too drastic. I knew another solution. But I agree that you than can say that your pc is clean. Good to hear that everything is fine now. Glad that we could assist you.

Regards

Niels

Glad that we could help you (even if you took that drastic decision )

Andrei

Nope Niels, sorry to say I didnt try the SuperAntiSpyware, at that point my impatience had gotten the best of me and I just went ahead and resorted to drastic measures and reformatted. I am going to still download the SA software and keep it on a flash drive just incase something like this happens again, which of course we all hope doesnt doesnt happen again! Again thanks for everybodies help.

Tom