Help With Virus Tspy_alemod.a

[PaulB1955]

OK Mobo, There is only one problem, about every 2 minutes I get a pop up from Trend Micro PC-cillin Internet Security Notification saying: Real-time Scan
Trend Micro PC-cillin Internet Security has detected a virus, spyware application, or other Internet threat, and performed the action specified.

Infected file: C:\WINDOWS\SYSTEM32\WININET.DLL
Virus name: TSPY_ALEMOD.A
User name: Brian
Scan action result: The Quarantine action was unsuccessful. Manually delete the file if you are sure that it is not needed.
Note: If Search for and clean Trojans is enabled and is executed after scanning, you can click Next to view final scan result information. How do I get this :censored: to go AWAY!!! Thanks, Paul

[Mobo]

Thats simple enough ot rid:
Download this please - http://www.downloads.subratam.org/KillBox.zip

Unzip to your desktop then doble click on killbox.exe. Then in the space provided paste this: C:\WINDOWS\SYSTEM32\WININET.DLL

Then tick the "delete on reboot" option and then click the red x to set it to reboot.

[PaulB1955]

Hi Mobo, Just got back from vacation and I am STILL getting this anoying pop-up from Trend Micro saying: Trend Micro PC-cillin Internet Security has detected a virus, spyware application, or other Internet threat, and performed the action specified.

Infected file: C:\WINDOWS\SYSTEM32\WININET.DLL
Virus name: TSPY_ALEMOD.A
User name: Brian
Scan action result: The Quarantine action was unsuccessful. Manually delete the file if you are sure that it is not needed.
Note: If Search for and clean Trojans is enabled and is executed after scanning, you can click Next to view final scan result information. I went to their web page and did EVERYTHING that they said, I also downloaded Killbox and did EVERYTHING that you said. My computer seems to be working OK, except for this :censored: pop-up that keeps showing up every couple minutes! Is there ANYTHING that I can do to get rid of it???? Thanks again, Paul

[Mobo]

Ok paul. This is tried tested and true..


Go to start
run
cmd

Type this exactly as shown----> cd\windows\system32

Then type exacxtly as shown here-->del wininet.dll

Then download the attached file unzip and put that wininet.dll in the system32 folder.

[PaulB1955]

OK Mobo, When I typed del wininet.dll and hit rerturn it comes up with: ACCESS IS DENIED! Now WHAT??? Paul

[Mobo]

Are you logged in as administrator ? If not then log into an admin account.Then right click on the wininet.dll file in the system 32 folder. Select properties and uncheck any of the two boxes if they are checked and apply.

[PaulB1955]

Mobo, Yes...I am logged in as Administrator. Everytime I try to delete wininet.dll it says Access is Denied. Paul

[Mobo]

Download smitRem.zip and save the file to your desktop.
Right click on the file and extract it to it's own folder on the desktop.
http://noahdfear.geekstogo.com/click%20cou.../click.php?id=1



Next, please reboot your computer in SafeMode by doing the following:[list=1][*]Restart your computer[*]After hearing your computer beep once during startup, but before the Windows icon appears, press F8.[*]Instead of Windows loading as normal, a menu should appear[*]Select the first option, to run Windows in Safe Mode.


Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply

[Mobo]

Better still Bill.

Disable system restore http://www.cyberanswers.org/forum/index.ph...e&pg=sysrestore


Download the attached file, unzip and double click on the fix.reg file.


Then reboot, rescan with trend micro.

[PaulB1955]

Mobo, Well I did as you suggested and disabled system restore, downloaded the fix.reg file, rebooted and rescanned with trend Micro. After the scan it comes up with one virus C:\WINDOWS\SYSTEM32\WININET.DLL However, I am unable to get rid of it :censored: Do you have ANY other ideas?? Paul