Just a quick question.

thee_rook · Feb 3, 2009

My buddy is a Network Admin for a law office and has come down with a network worm. Any and everything that touches the network comes down with it. The name of this worm is "WIN32:SYSPATCH". My question is if anyone here has dealt with it and/or if anyone has suggestions to start with. All servers, desktops, and laptops in 3 cities are infected. He is running Norton for protection and it never even as much as caught a whiff of it. AVG and Avast will see it, but cannot remove it. It modifies the user32.dll(needed by Windows to boot) and a CLS.EXE file.

Again, any and all insight would be helpful and appreciated.

Rook

chaslang · Feb 6, 2009

You can look at this: http://forum.avast.com/index.php?topic=41227.0

Or you can attempt to run sfc /scannow from a command prompt in an attempt to repair the infected system file. This may not completely work since other active parts of the infection could just reinfect the file. Thus you may want to work thru our cleaning procedures ( READ & RUN ME FIRST. Malware Removal Guide ) so that we can attempt to help you with this.

thee_rook · Feb 13, 2009

Thanks for the response. One hell of a re-image project over 2 days. LOL.

chaslang · Feb 15, 2009

If you have reinstalled your system, you should work thru the below to possibly help avoid future malware problems:

How to Protect yourself from malware!

Log in or Sign up

Just a quick question.

thee_rook Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

thee_rook Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member