Soglueda.A infection - Windows XP (page 6) — malwareremoval.com Archive

crazyfirex · 2011-01-05T21:40:31+00:00

I am running a Windows XP SP3 computer that is not connected to the internet. The first symptom I noticed was a system-hidden file (attributes SH) named dllrun.exe with all of its information in Spanish repeatedly appearing on my flash drive, along with an autorun.inf file. On a whim, I created a file named dllrun.exe at the root of the drive and restarted the computer, to find that it was overwritten. This website: https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm:Win32/Soglueda.A describes my symptoms correctly. (Please read it.) Using process monitor, I have decided C:\WINDOWS\system32\services.exe is infected, as it is A.) not signed by Microsoft, and B.)creating the file winm.dll (once again, described at the Microsoft link). I cannot find winm.dll, although Sysinternal's process monitor claims it to be created, so I assume the file is deleted after being injected into running processes. I also have not located " .cmd", but haven't looked thoroughl

Soglueda.A infection - Windows XP

95 min read

crazyfirex

February 6, 2011, 11:52 PM UTC

I want to thank you for your patience, time, and expertise. I will make a donation to help the cause.

turtledove

February 7, 2011, 5:12 AM UTC

"crazyfirex" wrote:I do have 2 questions.
1.) Why didn't uninstalling ESET remove those folders?
2.) Can I delete "svchost.exe "?

Good evening crazyfirex,

With ESET: Unfortunately, not all programs uninstall everything regarding cleanup.

The svchost file is no longer showing a space.

By the way, in a previous post you mentioned services.msc; that is a legit file.
If uncertain of a file, you may have it checked at http://www.virustotal.com
or http://virusscan.jotti.org/en