malware protected a file. Can't delete, open, nothing?

Question

I have a user who has a malware infected system. I have directed him to obtain and run adaware SE, Spybot S&D, and AVG to try and rid his system of this pest but....

Just in case this thing has protected itself very well here is what he found out so far;

The file won't delete through normal means even in safe mode.
righ clicking the file doesn't bring up a menu as would happen with any normal file so he can't change the properties. Need to get rid of the "read only" flag so it can be deleted.

I am thinking a command line type instruction may be needed to reset the attributes and delete this thing if the anti-malware can't do the job.

Answer 1

Get a copy of MoveOnBoot. It's free and this simple tool allows you to Move, Copy or Delete files before Windows can lock or alter the files. The changes are made to your hard drive before Windows starts, hence it requires a restart of your system after you give MoveOnBoot its instructions. There are no messy boot or DOS commands, just a simple 3-step process.



Step 1: Locate the name of the file that is causing your problems.



Step 2: Decide if you want to copy, move or delete the file.



Step 3. Choose a destination for moving the file, or a new file name for the rename option (this option won't appear if you are deleting a file).



Click OK to confirm you want to process. The nice thing is that the program doesn't make you reboot straight away. It's a good idea to reboot ASAP, but if you are in the middle of something and want to wait, the program will simply run next time you start Windows.

Good luck.

Answer 2

Whoah, SLOW DOWN THERE NELLY! I hope you see this before following anyones advice so far, not that they are totally wrong but you need to be sure of what your trying to delete. Let me explain, there are some files you cannot delete because they are system files, i.e. NEEDED FOR WINDOWS TO RUN! It may not be completely apparent because some files are accessed by other files and have funny names like MBX@15F0@8B2600.### or Perflib_Perfdata_dbc.dat, some even have READABLE NAMES! This is the same, roughly, for most programs under windows. When you start a game or an application it USUALLY creates a .tmp (Temporary) file, which is locked to the application in use, the more apps you have running the more of these temp files you'll have. NOT ALL OF THESE KIND OF FILES ARE .tmp, thats just the most common. Before you start unlocking files & deleting them you need to be sure of what it is, what its attached to etc... MOST, and I use that loosely, temporary files will get deleted when you switch the computer of. I say loosely because thats not always the case. If you want to make sure all the files have gone do a reboot and a disk cleanup (in accessories folder in xp) BEFORE starting any other programs, this will get rid of any temporary files it may have missed. If you still have files you can't get rid off try doing the above in safe mode (press F8 on a reboot). Anything left after that are either in use or system critical! You don't have to be careful JUST BE AWARE!

Answer 3

Off-the-shelf anti-virus and a firewall is all I need.



The reality is that anti-virus and firewall programs alone are not enough to protect you against many types of hacker tools and other cyber-attacks. Even using both a firewall and anti-virus together, you are still vulnerable to spyware, Trojan horses, remote access tools (RATs), password crackers, keystroke loggers, and much more.



Just as important, anti-virus and firewall programs do not provide you with critical security patches for your computer software. Microsoft issued thousands of security patches to their operating systems and other software last year. How many of those patches did you apply to your own computer? How many software security holes do you still have in your Windows operating system, Word, Excel, Outlook, Internet Explorer, etc? Closing these well-known security holes is imperative to keep hackers and the new hybrid worms off your computer.



You need more than just your anti-virus program or a firewall; you need a comprehensive security solution for your PC if you don't want hackers, viruses and worms on your system invading your privacy.



And if you ever have a security problem with your PC, who would you call? You will pay a small fortune to get help from any of the cheap off-the-shelf security programs. Those products are not made to provide a total solution, rather just a piece of a good overall protection strategy.



Without professional grade, complete security like INVISUS - chances are good that you will become a victim of a cyber-attack. You may have already been hacked and you would never know it! Don't make the mistake of thinking popular retail security programs are enough.



How much is all the time and money you've put into your computer worth to you? How important or valuable is the information on your computer? Would you really trust your privacy and security to a $40 security product?



The free security programs I can find online are enough.



The simple answer to that myth is this. You get what you pay for. When businesses and government agencies are spending millions on securing their computers, why would you ever think that a free security program would do an adequate job of protecting your computer? "Free" feels good to the wallet, until your privacy and security have been breached and your identity has been stolen. And free security programs are only limited versions or evaluation copies of the software. If you want real protection, you are going to have to pay for it.



Free security programs downloaded from the Internet do not provide you any support at all. They can't afford to help you. Instead, they will sell you their professional version and then offer you support. Would you be comfortable with "free" medical care from a doctor you've never met? Or "free" work done on your car by an unknown mechanic? Or would you trust free tax preparation services by someone you just met on the street? Of course not. So don't get lured into thinking that the free security programs you can find online are the best and most effective security programs you can find.

Answer 4

I would try checking the registry for the file an deleting it right there.



Ususally with malware you will have to delete it from the start folder and everywhere ortherwise it will probably re-install the protected file on the restart.



Once I had some spyware that was reinstalling instantly from different files each time I tried to delete one of them - you have to be patient here, locate all files and delete them one by one from the memory (running provesses) HDD and the registry - this all in case all available cleaners (you already named the major ones) can't do the job for you



restoring the PC might be the more practical solution (in case you know when it started and it is not too long ago)



gl

Elex

Answer 5

Here are some things to try:



In Safe Mode, try going in with Admin Rights and taking ownership of the file. You might find a weakness in the malware's defenses that way.



If that doesn't work, Windows Recovery Console might let you delete the sucker.



Also, have him run those anti-malwares in Safe Mode. This malware seems to be fairly sophisticated, though.



By the way, have you identified the malware by name yet? That might be of some help in searching the Web for help.

Answer 6

move the file to your desktop , reboot and as soon as the arrow will move delete it. if you can get it before windows starts it it will delete , but you got to be fast.spyware terminator is the best as far as a program goes for this.

Answer 7

See if Killbox can get rid of it:

Answer 8

reformat the computer. He probably needed to anyways.

Answer 9

http://www.activevirusshield.com/antivirus/freeav/index.adp?



Dump the other programs from your computer



Active virus shield works, and it is free