BackDoor-CFB Virus found in hlp.dll

[Guest]

Found a virus in C:\WINDOWS\system32\hlp.dll called BackDoor-CFB. Now, the
problem is, I can't delete the file because "it's copyrighted or in-use."
What process (if any) is running- so I can end it and delete this file? I
can't restore to a previous point... everytime I try to restore it says
restore failed, and I don't have my recovery discs with me, due to the fact
that I just got assigned (Air Force) here to New Mexico and all my things are
back home in Rhode Island. Anyone have any ideas?

 

[David H. Lipman]

First let me thank you from the bottom of my heart for your service to our country.

Thank You !

Now... Please try the following.


1) Download the following three items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt351.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

2) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
3) Reboot your PC into Safe Mode and shutdown as many applications as possible
4) Using both the Trend Sysclean utility and Stinger, perform a Full Scan of your
platform and clean/delete any infectors found
5) Restart your PC and perform a "final" Full Scan of your platform using both.
6) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
7) Reboot your PC.
8) Create a new Restore point


* * * Please report back your results * * *



--
Dave
http://www.claymania.com/removal-trojan-adware.html







| Found a virus in C:\WINDOWS\system32\hlp.dll called BackDoor-CFB. Now, the
| problem is, I can't delete the file because "it's copyrighted or in-use."
| What process (if any) is running- so I can end it and delete this file? I
| can't restore to a previous point... everytime I try to restore it says
| restore failed, and I don't have my recovery discs with me, due to the fact
| that I just got assigned (Air Force) here to New Mexico and all my things are
| back home in Rhode Island. Anyone have any ideas?

 

[Rick \Nutcase\ Rogers]

Hi,

Restart in Safe mode, run your antivirus software. That file, hlp.dll, is
not a system file and is likely to be part of the virus and should be
deleted.

How to start in Safe mode:
http://www.rickrogers.org/fixes.htm#Safe mode

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[steve eddy]

a google turned up this:
http://www.siteexperts.com/forums/viewConverse.asp?d_id=15259&Sort=0