Kill single thread

[Brian]

Is there a way to kill a single thread in a process?

Occasionally, I will run into a piece of spyware that is running as a thread
in a system-critical process. All my usual efforts at removal fail because
the virus loads even in safe mode and successfully blocks various removal
tools from removing it.

I can use ProcessExplorer to find the (generally) DLL running in, for
example, explorer.exe. I cannot kill explorer.exe so I can manually remove
the malware. In some cases, I have had to use the Recovery Console to
manually delete the file, or even remove the hard drive, connect it to
another PC as a non-boot drive, and remove the file by browsing to it.

If I could kill just the thread attached to the particular file, then I
should be able to remove the offending file manually.

Can this even be done?

 

[John Wunderlich]

Is there a way to kill a single thread in a process?

Occasionally, I will run into a piece of spyware that is running
as a thread in a system-critical process. All my usual efforts at
removal fail because the virus loads even in safe mode and
successfully blocks various removal tools from removing it.

I can use ProcessExplorer to find the (generally) DLL running in,
for example, explorer.exe. I cannot kill explorer.exe so I can
manually remove the malware. In some cases, I have had to use the
Recovery Console to manually delete the file, or even remove the
hard drive, connect it to another PC as a non-boot drive, and
remove the file by browsing to it.

If I could kill just the thread attached to the particular file,
then I should be able to remove the offending file manually.

Can this even be done?

Have you tried the freeware "unlocker" ?

<http://ccollomb.free.fr/unlocker/>

-- John

 

[Brian]

Thank you, John. That looks like it should do what I need, and with much less
effort than I had been expending on these.