On Mon, 01 Aug 2011 19:37:04 GMT, (Guy Fletcher) wrote:

This should be so simple on the face of it, but aaaaargh!

In a nutshell, I have a virus that has corrupted the USERINIT registry
entry. Identified it ok. Just need to delete c:\program\abc\def.exe (I
got the name from regedit.)

1. I can't delete folder "abc" because it says it's "not empty". Fair
enough, I'll delete "def" first.
2. Uh huh. Says "def" isn't there.
3. I go into DOS (or rather the command prompt feature of WXP).
4. I do the ATTRIB command for -r -s -h, and it takes it without error
message..... BUT nothing's changed, at all!
5. Read on the internet that the TYPE command ignores whether files
are hidden/system, so I do that on def.exe.
6. YES! It lists gobbledegook (as expected with .exe data) so that
proves it DOES exist and is still there.

So - the question seems to be why the ATTRIB command had no
effect..... anybody have any suggestions?

Thanks
Guy


Download and burn Hiren's BootCD
http://www.hirensbootcd.org/download/

Boot to it and select "Mini Windows". Delete the folders from there.

Unk