i got a virus!! any way to get rid of a file that creats it's self when you delet it?

[Pyro13]

on i got a virus from some dick that when i delete it it keeps coming back in to the C:\windows\system folder. any program i can write to stop it from re-creating it's self or getting rid of it? thanks in addvance



------------------
[]D Y R o

[MartinLiss]

Go to McAfee and click on Help! I've got a virus! and you'll be able to get help for free.

------------------
Marty
What did the fish say when it hit the concrete wall?
> > > > > "Dam!"

[This message has been edited by MartinLiss (edited 02-13-2000).]

[Pentax]

Is it anyone more than me who would vote for chpping of the fingers of all guys spreading viruses?
I've got one of them in my class, and he makes me sick!

------------------
Wilhelm Tunemyr,
Sweden

[email protected]

"Dort, wo man Bücher verbrennt, verbrennt man am Ende auch Menschen"
Heinrich Heine (1797-1856)

Pravda zvítezi!

[G.Kumaraguru]

Then you would have to chop down about 10% of
the population because they spread a more deadly thing called AIDS.

[Konan555]

Ohhhhhh, very topical.

ERm, on the computer front. If it's replicateing it's self there must be a program memory resident.

[Pentax]

Well, for those who spread AIDS on purpose, maybe something else should be chopped of...
If you by accident spread a [computer] virus, of course it's not your fault. But some people enjoy destroying other's computers, and I find that disgusting.
But right, that's not topical.

------------------
Wilhelm Tunemyr,
Sweden

[email protected]

"Dort, wo man Bücher verbrennt, verbrennt man am Ende auch Menschen"
Heinrich Heine (1797-1856)

Pravda zvítezi!

[Pyro13]

SCREW AIDS! Can anyone help with my computer!!!!!!! when i delete it it makes it's self in the same spot again! It even overrides another program with the same name that i created to screw it up!

------------------
[]D Y R o

[Phil.Hebert]

Get a Clean Boot disk.

Cold boot your computer booting from the disk.

Do not change directories, Do not run any programs.

Deleter the file useing the DEL command, Make sure there is not copies anywhere else.

If you stillhave it, do this again but run a virus scaner from a clean disk.

If that does not work, "Bite your lip, format your HD and Cuss out loud!!!"

[clonE]

i had the same problem, but it was with a password stealer/deltree. It was made in visual basic, so i took all the visual basic runtime dlls of my computer to stop it from running, then searched my computer until i found the file that was recreating the file and deleted both of them, well all 4 of them. email me if you still need help

[Bob Baddeley]

If you know when you got the virus, look for a file that was modified or created on that date. Also, there must be another file that was created that recreates the file you found. Look in the system.ini and win.ini and autoexec.bat and config.sys and all the other big system files that can initiate a Run command. You might find a line that would tell the computer to run a strange file. Delete that line and find that other file.

It is also possible that the registry is the location of the problem. You might search through it for som'n strange or unnatural.

One final thing. Don't email anybody, just in case. You don't want to spread this thing.

good luck,

bob

[Pyro13]

I found C:\windows\system\mine.exe (the base virus) and C:\msdos98.exe has the same icon and was createdon the same day (funky) so i'm guessing that's the recreating program and i can't delete it because it says it's being used by windows. any way to kill it?


------------------
[]D Y R o

[Phobic]

Check your email, Pyro. I had the exact same virus, and I figured out how to delete it.

By the way for everyone else to know, this virus wasn't just another stupid download. This virus spreads by sending itself through friends on peoples computers, so it appeared he had gotten some 'pictures' from one of his friends. Trusting his friend of course, he downloaded it.

[slashandburn]

Heres A small Tips, Proubally the file was written in 32Bit mode(Windows (95/98) Try booting with an old Boot Disk EX(Dos Boot Disk,Win 3.1 Boot disk,Mcafee Virus Boot Disk) then use the del command on it, Also look around your reg files(regedit.exe) then search around and try to delete all the regfiles that may be used by the program(don't do this unless you know what your doing) :<:> :-:=

Sugestion 2. Start windows in Safe mode Try to destroy it there(hold CTRL(or alt im forgot) when windows starts up.

Sugestion 3. It sounds like a Malissa virus which Mcafee or that other virus scanner would takecare of.

Try deleting the information inside of the file. Here's the code to do that:

Sub DestroyFile(sFileName As String)
Dim Block1 As String, Block2 As String, Blocks As Long
Dim hFileHandle As Integer, iLoop As Long, offset As Long
'Create two buffers with a specified 'wipe-out' characters
Const BLOCKSIZE = 4096
Block1 = String(BLOCKSIZE, "X")
Block2 = String(BLOCKSIZE, " ")
'Overwrite the file contents with the wipe-out characters
hFileHandle = FreeFile
Open sFileName For Binary As hFileHandle
Blocks = (LOF(hFileHandle) \ BLOCKSIZE) + 1
For iLoop = 1 To Blocks
offset = Seek(hFileHandle)
Put hFileHandle, , Block1
Put hFileHandle, offset, Block2
Next iLoop
Close hFileHandle
'Now you can delete the file, which contains no sensitive data
Kill sFileName
End Sub

That's pretty damn neat...a file that re-creates itself when deleted. Maybe there are actually two programs. One prolly copies one and renames it so that if the program doesnt detect it, it renames the file, re-copies it and does it over and over. Who knows? Anythings possible in the computer world these days.

I've actually seen this virus before: my broter had it at Miami U (Ohio) about a month ago. I saw someone remove it - I didn't do it myself - but the file was for SURE msdos98.exe because I thought the name was cute. Anyway, from what I can remember it is in your registry and one of the files that comes up when you run sysedit (win.ini maybe?) The one in sysedit had an entry which you had to scroll way over to the right to find (ie lots of blank space first) Find that, and then search the registry for both programs. There is definately information out about it though. Let me know if you need more.

-John

[Edited by RoyceWindsor1 on 05-03-2000 at 04:51 PM]

After editing (deleting) the lines in all the important files (goto run - sysedit).
Restart in msdos and find and use the del command on the virus file.

That is, if the code i gave you dint work.

[Edited by Matthew Gates on 05-03-2000 at 05:23 PM]

[jcouture100]

You can also check your registry under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

or

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To see if the replicating app (MSDOS98.EXE) is triggered there. Check your Win.ini and System.ini file too, just in case they hid the replicating app in the run or boot section of the .ini to run MSDOS98.exe.

I once made a virus because some dick sent me one.....
simple little thing, deleted win.com and win.ini
it also made the windows dir unaccessable(rename windows to _windows, rename it in a dos shell, and dont use the key _, use Alt + 255)


but your problem is probably easy to fix.
boot up in dos. then delete msdos98.exe
and for the other one, if it does recreate itself when it is destroyed, then just go to filder options.
then make it so the file extensions are shown...(uncheck "hide extensions for known file types")
and rename the exe(the one that keeps recreating itself) to txt
then open it, delete the stuffing, and delete it...
simple.
or simpler, open notepad, and open the exe through that file.
then delete the entire file......
after that, check for any registry settings, and also check win.ini system.ini(or whatever its called)
and autoexec.bat

I also suggest a good virus scanner..... I like AVP(www.avp.ch or http://www.avp.ru or something like that, i cant remember)


well hope this helps.....
and try to get that ****er back....
write a simple deltree program, that deletes win.ini and win.com, win.com is the windows shell, I think.
also try to make explorer.exe messed up...
using the open command....sorry to be posting this insanity here, but I strongly beleive in revenge.....

jcouture100 is exactly right, thats where it is.

As for the revenge thing PLEASE don't write another virus, that's all we need.

[Guv]

A friend of mine had this problem, and I figured out the following which got rid of it for him. Unfortunately, I do not remember the name of the Bastard or where I found him, but the following is the Scenario I used.

Before you start, I would advise starting Explorer, and setting his View Options to show all Files and all file Attributes. It might be necessary later. In Explorer, Click View, Folder Options, View Tab. Then check/uncheck the file view Options.

If you use Ctrl-Alt-Del, Windows will display all the Tasks running. Scan the list and see if you can identify the culprit. There must be a program running to do what you are describing. The Window which displays the running tasks, has an Option Button to terminate programs. Use it to terminate the Bastard. You should be able to delete the File now, but you are not done yet: He will come back when you Restart your system.

Make sure you write down any information you can get from the Task Monitor Window before you Terminate him.

Next use Start, Programs, Accessories, System Tools, System Information. When SysInfo starts, you will see a Tree Structure on the left. Check for Components, Software Environment, Startup Programs. Click on Startup Programs, to get more information about the Bastard. This should tell you his name and the folder where he resides. You should be able to erase him.

Next run msconfig. This is not always available via Start, Programs, Et cetera. Try Start, Run, Browse and find msconfig.exe in C:\Windows\System. Run him. He has a Startup Programs Tab. Click on it, and uncheck the Bastard if you can figure out who he is.

When I erased the culprit on my friend's System, I had to turn off System, Hidden, Read-Only Attributes. I use Ztree to do this, and do not know how to do it any other way. I am sure that Windows Documentation can tell you how to control File attributes.

If you have what my friend had, the above should work. It sure sounds like the symptoms he had.