rqonk.dll

[gylgamesh]

Hi!

On my w2k sp4 I have been using ss&d since many years and it has worked perfectly well untill now, when a minor problem has appeared with rqonk.dll.

Rqonk.dll is one of the forms of the Virtumonde IE adware. It resides in winnt\system32, imbeds itself in LSASS.EXE and can only be deleted at Windows start. My ss&d, both older and the newest releases, have tried that several times, though without success.

I wonder if anyone has been able to remove it and how?!

Thanks!

[tashi]

Hello,

Please follow the procedure in this link:
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance)

Then start your own thread in the Malware Removal Forum where a helper will advise you when available.

Best Regards.

[gylgamesh]

The solution is so simple and so beautiful, I still can't believe I didn't saw it immediately:

1. Open a DOS window
2. Go to the folder where RQONK.DLL resides, usually C:\winnt\system32
3. Type in "del rqonk.dll"
4. Start spybot
5. Go to 'Tools' -> 'Process List'
6. Kill the tasks 'explorer.exe' and then lsass.exe'
7. A small windows appears saying the sytem will automatically shut down and restart in 60 seconds
8. Go back to the DOS window and press 'Return' or 'Enter' before that happens.

Result: RQONK.DLL is GONE for good!

[tashi]

Hello gylgamesh,

I see you did not respond to the volunteer who posted to your topic.

http://forums.spybot.info/showthread.php?t=24725

Members, if you have an infected machine which could not be cleaned by normal methods.

Start here: "BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) and then post in the Malware Removal Forum where a helper will advise you when available.

Regards.