I have been attempting to remove this Virus for some time and cannot get rid of it. My anti-virus, Trend-Micro's PC-Cillian 2007 Internet security continues to detect it but cannot quarantine or remove it. If I leave the anti-virus on, it pretty much stops my computer from the warning pop-ups. I have attempted the symanted fixvundo tool to no avail. The virus software says the file that is infected is awtsrqr.dll, when I try to manually delete that file it says it is in use. When using Process Explorer I find it is tied to winlogin, Explorer.exe and cannot kill the processes.
I need help, cant remove on my own. I have attached my hijack this log.
Thanks.
Drew

You need to have a read of this - [URL="http://www.techspot.com/vb/topic65943.html"][B]If your system is infected. Read this before deciding whether to CLEAN or REFORMAT.[/B] [/url]

Then if you should wish to proceed with cleaning your system you need to go and read the [B][URL="http://www.techspot.com/vb/topic58138.html"]Viruses/Spyware/Malware, preliminary removal instructions[/URL][/B]. Follow all the instructions exactly.

Post fresh [B]HJT[/B], [B] Combofix[/B], and [B]AVG Antispyware [/B]logs as [B][COLOR="Red"]ATTACHMENTS[/COLOR][/B] into this thread, only after doing the above.


[B][COLOR="Red"]This thread is for the use of [/COLOR]dmm1673 [COLOR="Red"]only. [/COLOR][COLOR="Red"]Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.[/B][/COLOR]

i had the same problem with vundo couldn't get any help!!!
so i took it upon myself to find a way of ridding my laptop of this serious pain in the neck...........that .dll file can be removed with a program called "unlocker 1.8.6"
what to do is google it ...i cant remember what site its off but its free .
unlocker 1.8.6 lets u see what programs the .dll is using and unlock the paths thus you can delete because its not being used by another program...after deleting do registry clean and another spyware scan ...............i'll probarly get stick saying thats not the proper way of doing it but it worked for me
stu