Author Topic: Win32:SysPatch [Wrm]  (Read 4240 times)

0 Members and 1 Guest are viewing this topic.

arryb

  • Guest
Win32:SysPatch [Wrm]
« on: March 13, 2009, 12:35:34 AM »
I've just installed Avast - have been using AVG but didn't like it. And this has popped up:

What is it, and what do I need to do to get rid of it?

Any help much appreciated.

Thanks, Arry.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: Win32:SysPatch [Wrm]
« Reply #1 on: March 13, 2009, 01:08:10 AM »
It is a pain as avast can't move it to the chest or delete it as it is an important, system file and it's likely to be protected. Some have reported if they rename the file to say user32SUS.dll and reboot, windows should replace it from the dll cache folder, but that a) requires that you have a copy of the file in that location, b) it is the same version and importantly c) that this option works as if it doesn't it might not boot. So I think the next option is the better one, but when working with system files there is always a risk.

There is a tool that by all accounts may be able to repair the infected file so it isn't being moved or deleted.

DrWeb CureIt! - See http://www.freedrweb.com/cureit/ - Download ftp://ftp.drweb.com/pub/drweb/cureit/launch.exe (Free) Fairly effective against file infectors.

After running CureIt I would also suggest two other ant-spyware/malware applications.
If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security