Cant get rid of Trojan Horse BHO.BHJ 2

[mba14]

PLEASE HELP. I have a virus that I have not been able to get rid of -- Trojan Horse BHO.BHJ in the file c:\windows\system32\dsdmopr.dll. I have turned off system restore. I have run the following programs to try to get it off (in safe mode and boot-time): AVG Antivirus and Spyware, Avast antivirus, Spybot, and Adware all to no avail. These programs did get rid of the W32 Beagle worm, and the Trojan Horse Generic8.ECG viruses. However, this last one will not come off. I even tried to logon as admin and delete the dll file with the virus but got access denied. Can anyone help?

 

[TomCologne]

Have you tried "HijackThis" or the free online scanners, faq760-3862?


Anyway, access is usually denied because "explorer.exe" is running and using it.

Open the command window, then close Explorer:

Task Manager>Processes>explorer.exe <End Process>

Delete the file or rename it to eg "dsdmopr.dllBAD" using the command line.


However, there may be other related files. So I'd do a search for "dsdmopr" first. Note that it will return "dsdmoprp.dll" which is legit. Any other results are at least suspicious.

You will also have to delete the registry entries. Don't forget the backup!

There's a free utility called "Resource Hacker" (ResHacker.exe) to open and read *.exe, *.dll and more files. No installation required and it might be useful for you. I know that it was an invaluable help when I had a problem with the "YellowPages" BHO.


TomCologne

 

[TomCologne]

Probably unnecessary: Backup your files before doing anything!

TomCologne

 

[electronicsfreak]

First off download avg anti spyware from the link below.

http://www.ewido.net

(delete anything it finds)

second, download killbox below and use it to delete the stubborn file

http://www.bleepingcomputer.com/files/killbox.php

3rd, download ccleaner and remove all temp junk

http://www.filehippo.com/download_ccleaner/

(if you have nero, uncheck it from the applications part of the program)

4th, download hijackthis (like tom said) from the link below and post the logfile on here. Unless you are sure of what you are doing do not attempt to fix anything as not everything it shows is bad.

http://www.download.com/HijackThis/3000-8022_4-10379544.html

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[electronicsfreak]

Thanks for the star

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon