Avast WEBforum

Other => Viruses and worms => Topic started by: dsaranti on January 25, 2009, 05:20:59 PM

Title: HELP! Win32:SysPatch [Wrm]
Post by: dsaranti on January 25, 2009, 05:20:59 PM
I keep getting the following notice:
File name: C:\WINDOWS\SYSTEM32\USER32.DLL
Malware name: Win32:SysPatch [Wrm]
I can not move it to quarantine, delete it, do anything with it. The notice keeps popping up. I appreciate all your help,
Dimitri
Title: Re: HELP! Win32:SysPatch [Wrm]
Post by: FreewheelinFrank on January 25, 2009, 05:30:17 PM
A virus has infected a system file. Try System restore, or replace the file from a system disk if you have one.
Title: Re: HELP! Win32:SysPatch [Wrm]
Post by: micky77 on January 25, 2009, 08:06:31 PM
There is a lengthy previous post on this threat.At the end of the thread, some claim that Drweb cureit removed the problem.Have a look I would guess the scan would be in safe mode

http://forum.avast.com/index.php?topic=41227.0 (http://forum.avast.com/index.php?topic=41227.0)
Title: Re: HELP! Win32:SysPatch [Wrm]
Post by: polonus on January 25, 2009, 08:35:34 PM
Hi micky77,

Why not give the download link for DrWebCureIt: ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe
Save launche.exe unto the desktop see to it you have the latest version of it, and do a full scan after starting in safe mode: http://www.pchell.com/support/safemode.shtml

polonus