Soglueda.A infection - Windows XP (page 6) — malwareremoval.com Archive

crazyfirex · 2011-01-05T21:40:31+00:00

I am running a Windows XP SP3 computer that is not connected to the internet. The first symptom I noticed was a system-hidden file (attributes SH) named dllrun.exe with all of its information in Spanish repeatedly appearing on my flash drive, along with an autorun.inf file. On a whim, I created a file named dllrun.exe at the root of the drive and restarted the computer, to find that it was overwritten. This website: https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm:Win32/Soglueda.A describes my symptoms correctly. (Please read it.) Using process monitor, I have decided C:\WINDOWS\system32\services.exe is infected, as it is A.) not signed by Microsoft, and B.)creating the file winm.dll (once again, described at the Microsoft link). I cannot find winm.dll, although Sysinternal's process monitor claims it to be created, so I assume the file is deleted after being injected into running processes. I also have not located " .cmd", but haven't looked thoroughl

Soglueda.A infection - Windows XP

30 min read

crazyfirex

February 6, 2011, 11:52 PM UTC

I want to thank you for your patience, time, and expertise. I will make a donation to help the cause.

turtledove Retired Graduate

February 7, 2011, 5:12 AM UTC

"crazyfirex" wrote:I do have 2 questions.
1.) Why didn't uninstalling ESET remove those folders?
2.) Can I delete "svchost.exe "?

Good evening crazyfirex,

With ESET: Unfortunately, not all programs uninstall everything regarding cleanup.

The svchost file is no longer showing a space.

By the way, in a previous post you mentioned services.msc; that is a legit file.
If uncertain of a file, you may have it checked at http://www.virustotal.com
or http://virusscan.jotti.org/en

"crazyfirex" wrote:I want to thank you for your patience, time, and expertise. I will make a donation to help the cause.

You are very welcome

And thank you for your contribution.
Happy to have been assistance. Stay Safe!

If no more questions, let me know and I'll have this archived.

turtledove

crazyfirex

February 7, 2011, 10:07 PM UTC

Yes, thanks again

I have no more questions, please close this thread.

NonSuch Administrator

February 8, 2011, 5:06 AM UTC

As this issue appears to be resolved,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.