Can't delete infected file

My anti-virus software has flagged a file as "infected", but
says it cannot delete it. The infected file is
C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A

1. Is this file completely foreign, or does it actually have
a legitimate function in Windows?

2. I am unable to delete it manually. Is there any way to get
around this? (It is not set to "read only"...)

Thanks,
Joe

if you are using XP you may need to turn off system restore in control
panel/system.

then it might do the trick


"Joe Mildenberger" <joseph@shaw.ca> wrote in message
news:wb27c.865762$X%5.597934@pd7tw2no...
> My anti-virus software has flagged a file as "infected", but
> says it cannot delete it. The infected file is
> C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A
>
> 1. Is this file completely foreign, or does it actually have
> a legitimate function in Windows?
>
> 2. I am unable to delete it manually. Is there any way to get
> around this? (It is not set to "read only"...)
>
> Thanks,
> Joe
>

Joe Mildenberger wrote:

> My anti-virus software has flagged a file as "infected", but
> says it cannot delete it. The infected file is
> C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A
>
> 1. Is this file completely foreign, or does it actually have
> a legitimate function in Windows?
>
> 2. I am unable to delete it manually. Is there any way to get
> around this? (It is not set to "read only"...)

the file is probably in use (ie. running) and therefore locked by the
OS... try restarting in safe-mode...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

Joe,

FF.EXE is a legacy from earlier DOS versions (I think 6.0 backwards) and is
File Find. It shouldn't be in XP unless you upgraded from say Win98. This
does not mean the file isn't infected.

--
Sir_George
For better access to newsgroups;
http://www.microsoft.com/windowsxp/...roups/setup.asp


"Joe Mildenberger" <joseph@shaw.ca> wrote in message
news:wb27c.865762$X%5.597934@pd7tw2no...
> My anti-virus software has flagged a file as "infected", but
> says it cannot delete it. The infected file is
> C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A
>
> 1. Is this file completely foreign, or does it actually have
> a legitimate function in Windows?
>
> 2. I am unable to delete it manually. Is there any way to get
> around this? (It is not set to "read only"...)
>
> Thanks,
> Joe
>

DaveB,

FYI: Your suggestion would not work. The folder for System Restore is
"System Volume Information" and that is not the location the OP stated where
the file is located. Therefore, clearing the contents of the folder would
not have any effect.

--
Sir_George
For better access to newsgroups;
http://www.microsoft.com/windowsxp/...roups/setup.asp


"DaveB" <dave@brown9997.(NoSpam)freeserve.co.uk> wrote in message
news:c3ii3a$lg0$1@news7.svr.pol.co.uk...
> if you are using XP you may need to turn off system restore in control
> panel/system.
>
> then it might do the trick
>
>
> "Joe Mildenberger" <joseph@shaw.ca> wrote in message
> news:wb27c.865762$X%5.597934@pd7tw2no...
> > My anti-virus software has flagged a file as "infected", but
> > says it cannot delete it. The infected file is
> > C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A
> >
> > 1. Is this file completely foreign, or does it actually have
> > a legitimate function in Windows?
> >
> > 2. I am unable to delete it manually. Is there any way to get
> > around this? (It is not set to "read only"...)
> >
> > Thanks,
> > Joe
> >
>
>

On Sat, 20 Mar 2004 20:53:48 GMT, Joe Mildenberger <joseph@shaw.ca>
wrote:

>My anti-virus software has flagged a file as "infected", but
>says it cannot delete it. The infected file is
>C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A
>
>1. Is this file completely foreign, or does it actually have
>a legitimate function in Windows?
>
>2. I am unable to delete it manually. Is there any way to get
>around this? (It is not set to "read only"...)
>
> Thanks,
> Joe

You can try a nice free utility called move-on-boot from
http://www.gibinsoft.net/gipoutils/

It can remove a locked file on next reboot.
Jari

Sir_George wrote:

> Joe,
>
> FF.EXE is a legacy from earlier DOS versions (I think 6.0 backwards) and is
> File Find.

??? in dos one used dir /s [filename.ext] to find files... there was no
"File Find"...

--
"we're the first ones to starve, we're the first ones to die
the first ones in line for that pie in the sky
and we're always the last when the cream is shared out
for the worker is working when the fat cat's about"

"Joe Mildenberger" <joseph@shaw.ca> wrote in message
news:wb27c.865762$X%5.597934@pd7tw2no...
> My anti-virus software has flagged a file as "infected", but
> says it cannot delete it. The infected file is
> C:\WINDOWS\System32\FF.EXE , and the virus is BackDoor.Rirc.A
>
> 1. Is this file completely foreign, or does it actually have
> a legitimate function in Windows?
>
> 2. I am unable to delete it manually. Is there any way to get
> around this? (It is not set to "read only"...)
>
> Thanks,
> Joe
>
Keep trying.

-*MORT*-

On that special day, kurt wismer, (kurtw@sympatico.ca) said...

> Sir_George wrote:
>
> > Joe,
> >
> > FF.EXE is a legacy from earlier DOS versions (I think 6.0 backwards) and is
> > File Find.
>
> ??? in dos one used dir /s [filename.ext] to find files... there was no
> "File Find"...

Maybe he had a freeware called "Fast File Finder" on his old DOS
machine, and misunderstood it to be a part of the OS, although it
wasn't.

I had that thing, too, but rarely needed it, as in those times, the
files were few, compared to today; and I mostly knew where I had stored
mine


Gabriele Neukam

Gabriele.Spamfighter.Neukam@t-online.de


--
Ah, Information. A good, too valuable these days, to give it away, just
so, at no cost.