Unable to delete files

Discussion in 'Malware Help (A Specialist Will Reply)' started by jburwick, Mar 28, 2008.

  1. jburwick

    jburwick Private E-2

    I have followed all of the steps in the procedure for cleaning XP. My computer seems to be running OK now with none of the pop-ups from AVG alerting me of trojans and prompting me to heal them. However, I have a folder with 4 files that may have been the cause of the problem, and I am unable to delete these files.
    I downloaded a trial of Kaspersky, tried it and uninstalled it. The folder I originally downloaded to has these four files. When I try to delete, I either get a warning that the file name is too long or the file name is invalid. I looked at the Properties of these files, and it says they are 0 Bytes. I tried the File Assassin in the Malwarebytes program as well. I can't delete the files of the folder containing them.
    I am attaching the scan files you recommended. I am concerned that these viruses will reactivate at some time in the future.

    VIRUS TEST MS-DOS Batch File.jpg
    KISTR.bat
    KIS7_2.22.2009_02B780B7.key
    INSTALLATION NOTE!!! READ ME!!!.JPG

    John
     

    Attached Files:

    Last edited: Mar 28, 2008
    jburwick, Mar 28, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is Spyware Doctor a working version that removes malware or just a trial? If a trial, uninstall it now.

    Uninstall the below software:
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) SE Runtime Environment 6 Update 1
    Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME


    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {87CADEB4-0FD4-4288-9EC3-AD7C14EDFC54} - C:\WINDOWS\system32\xxywuuu.dll (file missing)
    O2 - BHO: (no name) - {BCCA6DD1-948A-45D2-9AD4-C64BC3DA0A4F} - (no file)
    O2 - BHO: Act.UI.InternetExplorer.Plugins.AttachFile.CAttachFile - {D5233FCD-D258-4903-89B8-FB1568E7413D} - mscoree.dll (file missing)
    O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech Desktop Messenger Agent.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O9 - Extra button: Attach Web page to ACT! contact - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
    O9 - Extra 'Tools' menuitem: Attach Web page to ACT! contact... - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: ActLink - {2A0C35F4-82A3-4C80-919D-7879FEE79DF6} - (no file)
    O20 - Winlogon Notify: xxywuuu - xxywuuu.dll (file missing)

    After clicking Fix, exit HJT.


    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\John\Local Settings\Temp

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Mar 29, 2008
    #2
  3. jburwick

    jburwick Private E-2

    Iwent through this process and attached the log files. Those 4 files are still on the computer and I still cannot delete them. Thanks for your help. It is much appreciated.
     

    Attached Files:

    jburwick, Mar 30, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not answer my question about Spyware Doctor.

    What is the name of the folder they are in? Give the full path to the files.

    Your logs are clean.
     
    chaslang, Mar 31, 2008
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds