I have smithfraud and can't remove it because it infected one of the system32/dll's

[Gunby]

Before I begin this, I am somewhat computer illiterate, but I understand most things.

Well, I'm not sure how I got the Smithfraud trojan, but it happened not too long ago. I've removed most of the areas it's detected with Spybot Search and Destroy, but one of the files infected were one of the c:\windows\system32\.dll files labled as rpcc.dll. Apparently it won't let me remove it because it is being used. So I tried closing all the svchosts to try and stop all of the .dll files and has no effect because it still says it's being used. Idk if that was supposed to work, but I thought I might give it a try. I also tried deleting it directly from the system32 folder after closing all the svchosts, but that didn't work either.

Uhh, I don't know what more to say, but that is pretty much it.

Edit: This computer is not used for anything important so I won't format it.

I'm not sure if the instructions apply to this thread so I am going to do the other stuff first.

 

[darel001]

I would try going into safe mode, and delete it that way . that might work. If the comp isnt important i dont see why you dont want to format it. Although u could run xp cd, preted ur gonna do fresh install , but when it asks you if u wana format tell it to just fix windows. Trying to run the normal recovery by pressing the R at the begg of instalation is a pain.

 

[Rik]

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as ATTACHMENTS into this thread, only after doing the above.


This thread is for the use of Gunby only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.