« previous next »
Pages: [1]   Go Down

Author Topic: HELP! Win32:SysPatch [Wrm]  (Read 2840 times)

0 Members and 1 Guest are viewing this topic.

dsaranti

  • Guest
HELP! Win32:SysPatch [Wrm]
« on: January 25, 2009, 05:20:59 PM »
I keep getting the following notice:
File name: C:\WINDOWS\SYSTEM32\USER32.DLL
Malware name: Win32:SysPatch [Wrm]
I can not move it to quarantine, delete it, do anything with it. The notice keeps popping up. I appreciate all your help,
Dimitri
Logged

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: HELP! Win32:SysPatch [Wrm]
« Reply #1 on: January 25, 2009, 05:30:17 PM »
A virus has infected a system file. Try System restore, or replace the file from a system disk if you have one.
Logged
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

micky77

  • Guest
Re: HELP! Win32:SysPatch [Wrm]
« Reply #2 on: January 25, 2009, 08:06:31 PM »
There is a lengthy previous post on this threat.At the end of the thread, some claim that Drweb cureit removed the problem.Have a look I would guess the scan would be in safe mode

http://forum.avast.com/index.php?topic=41227.0
« Last Edit: January 25, 2009, 08:14:59 PM by micky77 »
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33647
  • malware fighter
Re: HELP! Win32:SysPatch [Wrm]
« Reply #3 on: January 25, 2009, 08:35:34 PM »
Hi micky77,

Why not give the download link for DrWebCureIt: ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe
Save launche.exe unto the desktop see to it you have the latest version of it, and do a full scan after starting in safe mode: http://www.pchell.com/support/safemode.shtml

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pages: [1]   Go Up
« previous next »