Trend Micro Identified Threat but Cannot Quarantine

[ske]

Trend Micro Internet Security 2009 identified a potential trojan horse infected file dchn.sco in the system32 folder. It could not quarantine it, and I could only delete using Unlocker. Now that the file is deleted I am getting a RUNDLL error popup upon startup. "The Specified module dchn.sco could not be found"

I have determined that dchn.sco is not a file that belongs on my system to begin with, so good riddance. But now it looks like I have some manual registry clean up to do.

Can anyone tell me how to clean up my loose ends on this one?

Thanks,

Steve

 

[Dark Lord of Tech]

run ccleaner its free!

 

[aford10]

^ +1
ccleaner has a registry repair tool that should fix it right up.
http/www.ccleaner.com/

 

[ske]

Thanks guys. I tried ccleaner and glary utilities with no effect.
Trend Micro just sent a fix. Disk Cleanup, then run their program TwinFix.exe.
I'm going to give that a try with fingers crossed.

 

[Dark Lord of Tech]

good luck ske,hope it works out!

 

[ske]

Just tried it. TwinFix removed the offending file, and I still get the rundll error.

I guess it's better than having the virus. More like a hangnail...

 

[ske]

hijackthis.exe tracked down the offending leftovers.
Great program! I just needed to dig up a guide online to interpret the results.

 

[Dark Lord of Tech]

great job,glad you got it worked out!

 

[ske]

Thanks. I have to say the Trend Micro Support is very responsive and helpful.

 

[Dark Lord of Tech]

cool good to know!

 

[aford10]

We use Trend Micro at the bank I work at. It's a good quality product.

 

[pc cleaner]

You could try booting into safe mode first, and then try your usual removal process this should probably fix it.

Failing that, you could try another file shredding tool in safe mode. Which should remove and fix it. Let us know how you go



pc cleaner - http/helpcleaningmypc.info/

 

[btk1w1]

The dll files needed to be unregistered then deleted.

HJT is definitely a good way to ID the offending start-up items and remove them.

Another good tool is winpatrol by BillP Studios.

Good to hear you solved the problem.

P.S. you can get an automated analysis of your HJT log at:

http/www.hijackthis.de/

You copy and paste the contents or browse for the text file and submit it. It is best to be used as a guide but coupled with researtch is very effective.

 

[ske]

The dll files needed to be unregistered then deleted.

HJT is definitely a good way to ID the offending start-up items and remove them.

Another good tool is winpatrol by BillP Studios.

Good to hear you solved the problem.

P.S. you can get an automated analysis of your HJT log at:

http/www.hijackthis.de/

You copy and paste the contents or browse for the text file and submit it. It is best to be used as a guide but coupled with researtch is very effective.

Thanks for the link. Hopefully I won't need it!

 

[ehn]

Thanks so much for bringing up this topic and finding a fix, ske!

I got the same message at startup (RUNDLL error, specified module dchn.sco could not be found) after I cleaned up after an AVG scan. Tried HijackThis and it worked.

Since I'm a bit of a novice, I found this to be helpful:

Make sure to backup your files.
Set up a system restore point.
Download and run HijackThis (found it on majorgeeks.com).
If you're having trouble finding the offending registry item, you can make sure to create and save a log before the system does the scan (which for me opened in a Notepad), then do a search for "dchn" in Notepad, then go back to find the item on the scan list, check the box, and remove.