On 8/1/2011 3:37 PM, Guy Fletcher wrote:
This should be so simple on the face of it, but aaaaargh!

In a nutshell, I have a virus that has corrupted the USERINIT registry
entry. Identified it ok. Just need to delete c:\program\abc\def.exe (I
got the name from regedit.)

1. I can't delete folder "abc" because it says it's "not empty". Fair
enough, I'll delete "def" first.
2. Uh huh. Says "def" isn't there.
3. I go into DOS (or rather the command prompt feature of WXP).
4. I do the ATTRIB command for -r -s -h, and it takes it without error
message..... BUT nothing's changed, at all!
5. Read on the internet that the TYPE command ignores whether files
are hidden/system, so I do that on def.exe.
6. YES! It lists gobbledegook (as expected with .exe data) so that
proves it DOES exist and is still there.

So - the question seems to be why the ATTRIB command had no
effect..... anybody have any suggestions?

Thanks
Guy

Linux, Knoppix, BartPE, or the XP Recovery Console should allow you to
delete the folders and files. Have you tried Malwarebytes?

http://www.malwarebytes.org


--

Joe =o)