Need help in removing trojan from SysWOW64\srrstr.dll

[Shoana]

My system has started facing redirect issues from a week and so, in my case I am having AVGFree as well as Malware, I have ran the Malware and it was able to find out some Trojan and later when I ran AVGFree then the all the other Trojans were quarantined but has not healed one the Trojan which is in the SysWow64\srrst.dll and I just wanted to know that how can I heal the same as I am afraid of messing up with the system. Is there anyone who can help me out??

[Baijayanthi]

As far as I know srrst.dll file is concerned it will be in C:\Windows\System32 and not in C:\Windows\SysWow64\. In order to get rid of the same just follow the below solution.

• First just reboot in the Safe Mode with Networking and then download and install ComboFix and then run the same as Administrator and then just follow the prompts and see if the srrst.dll file is deleted or not.
• If it is then open the MalwareBytes tool and then go in to More tools >File assassin and then find out the file's location so as to delete it and then reboot the machine.
• After reboot run a full computer scan and then check out the log and let me know if you find anything to be suspicious.

[AmaF]

There are possibilities that the redirect issue might be because of a corrupted hosts file/ DNS cache as well, so to be at the safer side, just follow the below steps:

• First delete the host file which will be in C:\Windows\System32\drivers\etc but then make sure that you are also able to view the hidden files and folders.
• After that Flush the DNS cache and in order to do the same just go in to start and then type cmd in the Run and then press enter. When you are done with the same then Type ipconfig /flushdns and then press Enter and then repeat the same step once again.
• When you are done with the above steps then Exit all programs and then again open the command prompt and then type inetcpl.cpl and then hit on enter. After you get a window click on the advanced tab and then click on reset which will be under Internet Explorer settings, when the process is completed then close the IE and then reboot the machine.

[Shoana]

I will try out the same but then I just wanted to know that is it necessary to go in to safe mode in order to get the combofix as I am able to go in to the websites in normal mode as well, I also wanted to add that I have used the combofix long time ago and it used to take a long time, so what if my laptop goes in to the sleep mode between the process and so??? Is it necessary to get Windows Recovery Console before trying out the process that has been mentioned above????

[Baijayanthi]

I will like to inform you here that the Safe Mode is recommended whilst scanning as there are a no of services that don’t get started in the whilst in that mode, any this is a better and efficient scanning method in the case that you are having, after getting the combofix you can just disable the other antivirus that you are having rather than uninstalling them, as far as the Recovery console you don’t need to install it for the process.

[Shoana]

Hey thanks for the same I have tried downloading the Combofix but then it is appearing as if it does not work under the Windows 7, so what should I do know??? I mean that will I have to try out making a force delete to get rid of the trojan from the malware scan??? Or there is any other workaround that I can try out??? Any further help for the same will be appreciated.

[Baijayanthi]

I think that you might have misunderstood something the Combofix does work on 32 and 64 bit versions of Windows 7 and I am very sure about the same as I have been running Combofix on my machine which is running on Windows 7 Windows 7, if you want then you can get the latest version of the tool from its official site.