Deleting a virus

G

Guest

My MSN has been infected by a virus... IM Names. Whenever I chat with
someone, it keeps poping up! I found the file in C:\ Program Files drive..
but, its not letting me delete it.. its saying access denied. I really need
to get rid of this virus. Please help!
 
D

David H. Lipman

From: "Help" <[email protected]>

| My MSN has been infected by a virus... IM Names. Whenever I chat with
| someone, it keeps poping up! I found the file in C:\ Program Files drive..
| but, its not letting me delete it.. its saying access denied. I really need
| to get rid of this virus. Please help!

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

"C:\ Program Files" is NOT a drive. It is the folder and what you left out was the fully
qualified name and path to the infected file, what was the anti virus software that decalred
the file as infected and what that anti virus software called this infector.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
 
G

Guest

What noone seems willing to tell you is that, sure the file is locked and
therefore inaccessible in your present running state, but it can me deleted
by starting your system in "Safe Mode". The real problem is knowing what
service or application is starting when windows starts that uses this file
and is therefore locking it. You can go>start>run and type msconfig and then
click the startup tab and uncheck all programs from starting that you don't
want or need. Basically you really only need your 3rd party firewall, an AV
program and a Spyware program to start when windows starts. All other
programs should only start when you want or need them to. This may take some
learning about your services and startup apps to finally rid you of the
beast. In Safe mode you should run your AV program as well as a couple of
Spyware\adware\malware cleaners like Adaware and Bit Defender. TTFN.
 
D

David H. Lipman

From: "The Unknown P" <( (e-mail address removed) )>

| What noone seems willing to tell you is that, sure the file is locked and
| therefore inaccessible in your present running state, but it can me deleted
| by starting your system in "Safe Mode". The real problem is knowing what
| service or application is starting when windows starts that uses this file
| and is therefore locking it. You can go>start>run and type msconfig and then
| click the startup tab and uncheck all programs from starting that you don't
| want or need. Basically you really only need your 3rd party firewall, an AV
| program and a Spyware program to start when windows starts. All other
| programs should only start when you want or need them to. This may take some
| learning about your services and startup apps to finally rid you of the
| beast. In Safe mode you should run your AV program as well as a couple of
| Spyware\adware\malware cleaners like Adaware and Bit Defender. TTFN.

Not entirely true. If the file is loaded in Safe Mode then its file handle will be held
open and it still won't be able to be deleted unless the process that is holding the file
handle open is killed. For example, a DLL loaded in Winlogin via the Notify funtion will
have its file handle held open in Normal Mode or safe Mode.
 
G

Guest

So, how do you go about killing the IM srv file. Its destroying my PC! I
tried going into P:\ Program Files... it wont let me delete it. Is there
somewhere else i can find it and delete it?
 
D

David H. Lipman

From: "Help" <[email protected]>

| So, how do you go about killing the IM srv file. Its destroying my PC! I
| tried going into P:\ Program Files... it wont let me delete it. Is there
| somewhere else i can find it and delete it?
|

You STILL haven't provided the information needed to be specific.

In my previous reply I stated --
"...what you left out was the fully qualified name and path to the infected file, what was
the anti virus software that decalred the file as infected and what that anti virus software
called this infector."

I also gave you information on the Mul;ti AV Scanning Tool which provides four AV scanners
from four different AV vendors to find a remove "viruses".
 
S

Shenan Stanley

Help said:
So, how do you go about killing the IM srv file. Its destroying my
PC! I tried going into P:\ Program Files... it wont let me delete
it. Is there somewhere else i can find it and delete it?
Click to expand...

Repeating my post..
 
D

David H. Lipman

From: "Help" <[email protected]>

| Thanks! What do I do when I get to this
| site...www.help2go.com/component/option,com_forum/Itemid,32/page,viewtopic/t,17786
|


Assuming what you have is what Shenan has indicated, the following will do this for you...


Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

French team finds way to unlock computers infected with WannaCry virus 2
Virus or Spyware removal 7
Windows Live ID sign in box ????????? 3
removing virus 2
JS/Downloader.Agent 6
Urgent! Virus Attack 18
possible virus please help 2
Is GDiVX1.9.9.2.exe a virus? 4

Top