|
Posted by Buck Rogers on November 25, 2007, 4:24 pm
If you were Registered and logged in, you could reply and use other advanced thread options
On Sat, 24 Nov 2007 21:13:00 -0800, Websider
>I have identified three suspected Virus/Trojan DLL files on my system:
>
>C:\WINDOWS\system32\mlljg.dll
>C:\WINDOWS\system32\tuvwtqq.dll
>C:\WINDOWS\system32\wineak32.dll
>
>When I attempt to delete these files using Explorer, I get the message
>‘Cannot delete … It is being used by another person or program’
>
>I have also identified these suspicious entries in a HijackThis log:
>
>O2 - BHO: (no name) - -
>C:\WINDOWS\system32\mlljg.dll
>02 - BHO: (no name) - -
>C:\WINDOWS\system32\tuvwtqq.dll O20 - Winlogon Notify: tuvwtqq -
>C:\WINDOWS\SYSTEM32\tuvwtqq.dll O20 - Winlogon Notify: wineak32 -
>C:\WINDOWS\SYSTEM32\wineak32.dll
>
>One of these suspicious modules appears to also act as a backdoor for
>injection of other virus/Trojan processes like:
>
>mgrs.exe
>winxxx.exe (where xxx is a two- or three-digit number)
>wanmpsvc.exe
>drvxxx.exe (where xxx are three characters such as 'heb' or 'max')
>
>Using Warecase eXtended Task Manager (XTM)and DiamondCS Advanced Process
>Elimination (APM), I have identified the modules mlljg.dll and tuvwtqq.dll
>under process explorer.exe and have identified the modules tuvwtqq.dll and
>wineak32.dll under the process winlogon.exe.
>
>I have attempted to unload these processes using XTM and APM without success.
>
>Neither Trend Micro PC-Cillan or System Cleaner, or a variety of Spyware
>scanners (Microrsoft, Adaware, Ashampoo, Panda, etc) have been able to
>identify and/or remove these virus/Trojans from my system.
>
>Can you PLEASE advise me of how I can eliminate these suspected
>Virus/Trojans from my system ?
Hello,
One way is to remove hard drive and put it in another computer as a
slave. Boot the computer, navigate to the slave and rename the files
(dll and exe) you've identified above. Return the hard drive to your
computer as master, run hijack this. Check the boxes and fix the
entries you've identified above. If all seems to be running properly,
then delete the files you renamed.
Regards,
Buck
| 
XML site map