Skip to main content
gamedev.net
🔒 Locked

virus problem...

Started by xyz Oct 5, 2004 at 8:03 AM 26 replies 3.2k views
Original Post
xyz
xyz
Hi, Dunno why but got W32.Korgo.AB... I have norton antivirus 2005, but it couldn't repair it so, I went to norton's web site, and they say to delete the file (in safe mode, is necessary), but the file (system32\proqi32.dll) was still in use (even in safe mode), so I couldn't delete it... Tried Panda ActiveScan, but no luck there too.... So... what can I do? Any help? Thanks
xor
xor
Open the Task Manager with ctrl+alt+delete, try to shutdown as many processes as you can, if a prompt shows up telling you that your computer is going to reboot, open a command line and use the command 'shutdown -a' to stop your computer from rebooting.

When you stop as many processes as you can, the one using the virus is probably killed or not funcioning, and you can now probably delete the file.

You probably will kill the 'explorer' too wich will make your desktop desapear, to delete the file use the task manager again.

Go to 'File' then 'New Task' and in that little browser you can delete, move, copy whatever you need.

Cheers
Aaron71771
Aaron71771
You could go to Mandrakes website and download their MandrakeMove, the Linux OS "portable" CD version to your PC, burn it to a CD and boot your computer using the Linux OS. It should find and mount your Windows partition and then you can use the KDE desktop to browse to the file and delete it.

Here is the link to MandrakeMove: http://www.mandrakelinux.com/en/ftp.php3 Just download the ISO and burn it to a bootable CD.

Since the OS loads from a CD, it will be slow - but you will have quite a bit of fuctionality over your system - more so then using a DOS boot floppy which may or may not be able to access your file system.
Aaron71771
Aaron71771
One othe rnote, if you download MadrakMove and burn it to a CD, use a slow write speed on your cd burner. I usually turn mine down to 4x, takes forever but you greatly reduce your chances of getting a corrupt write to the CD.
PnP Bios
PnP Bios
or, just get a boot disk for ms dos. boot off that, get to the c: drive, and go happy with the del command.
xyz
xyz
how do I know the file I'm deleting isn't necessary for a proper execution of some program?
PnP Bios
PnP Bios
Quote:
Original post by xyz
how do I know the file I'm deleting isn't necessary for a proper execution of some program?


It is... for the virus.
if rundll is calling it, you need to ditch that dll file asap.
PumpkinPieman
PumpkinPieman
Quote:
Original post by Aaron71771
One othe rnote, if you download MadrakMove and burn it to a CD, use a slow write speed on your cd burner. I usually turn mine down to 4x, takes forever but you greatly reduce your chances of getting a corrupt write to the CD.
This isn't 1995, the chance of getting a corrupt CD with a half decent \ good CD burner today is next to nil. I've made over 200 burns at 24x, only one failed the check and it could have been largely my fault.
Aaron71771
Aaron71771
Pumpkin,

Well, when I copied the three mandrake v.10 ISO's to CD from my hard drive, those I copied at CDRW full speed always had problems when installing Linux from them. Those I copied at a slow speed worked with zero problems. Maybe I have a bad run of CD's, who knows. For me - it was worth it to wait longer on the burn then to worry about getting/dealing with installer errors.


XYZ didn't specify which OS he was running, but if he is using NTFS then I don't think he can access the files on his hard drive with a bootable floppy.
Skoron
Skoron
Quote:
Original post by PnP Bios
or, just get a boot disk for ms dos. boot off that, get to the c: drive, and go happy with the del command.

How/where can i get this boot disk?
Aaron71771
Aaron71771
Usually you go to the control panel, select "add/remove" programs, and click on the "Widows Setup" tab. From there you can create an emergency boot disk.

Which OS are you rinning? 98/ME/XP/2000?
CrimsonSun
CrimsonSun
Please, for the love of God, get this very _VERY_ helpful utility called KillBox. When you run Killbox, all you haveto do put in the address of the file on your computer and Killbox automatically stops the program that uses that file and deletes it.

I will see if I can find a link to a location where you can download it...and will edit this post with it.

EDIT -- I belive this is it -- KILLBOX DOWNLOAD
Skoron
Skoron
Thank you CrimsonSun :)

One question. That program has an option to close explorer.exe before killing the file. That's the desktop right? Why will it make it easier to delete the file now that the desktoped is closed?
And if anyone has downloaded the file, we don't need to extract the file before we use it right?

Aaron71771, i am on XP and i didn't find that "Windows Setup".
Should i download one from here?

And when i boot from the floppy disk drive i'll be able to go to c:\ and delete the file? I doubt about it, but anyways. What command do you use to delete a file?

Thanks :)
Aaron71771
Aaron71771
To make an XP boot floppy try this?

I would rename the file to something different, maybe from proqi32.dll to proqi32.old or something. Then, after you verify everything still works, say a few days from after renaming it, you could delete it.
Skoron
Skoron
Quote:
Original post by Aaron71771
To make an XP boot floppy try this?

I would rename the file to something different, maybe from proqi32.dll to proqi32.old or something. Then, after you verify everything still works, say a few days from after renaming it, you could delete it.
I am not sure what to do in that link. What about the link i posted?
Aaron71771
Aaron71771
Skoron,

You can use the link you posted if you want to create Windows XP setup disk to reinstall Windows XP from scratch.


First you should find out what type of file system you are using in Windows XP.

Go to "my computer" and right click on your "C:\" drive (which I assume is the same drive that has the file you are interested in removing...)

From the pop-up menu select properties.

On the properties menu, under the "general" tab (usually the default one) look for the line that says "File System". It should say either "NTFS" or "FAT" (or FAT32, FAT16, or just FAT). What's it say?
Skoron
Skoron
Aaron, i want to boot up from a floppy disk, go to c:\ and delete something. How can i do that? The link i posted isn't what i am looking for?

>On the properties menu, under the "general" tab (usually the default one) look for the line that says "File System". It should say either "NTFS" or "FAT" (or FAT32, FAT16, or just FAT). What's it say?

Why do you need to know that? What's that?
Aaron71771
Aaron71771
Quote:
Aaron, i want to boot up from a floppy disk, go to c:\ and delete something. How can i do that? The link i posted isn't what i am looking for?


I understand that

Quote:
>On the properties menu, under the "general" tab (usually the default one) look for the line that says "File System". It should say either "NTFS" or "FAT" (or FAT32, FAT16, or just FAT). What's it say?

Why do you need to know that? What's that?


There are a couple different file systems that Windows uses. Win95/98/ME use FAT type (or FAT32), NT/2000/XP can use FAT or the more secure and faster NT File System (NTFS)

With a FAT file system you can create a DOS boot disk, browse to the file and delete it. Very easy.

If you are using an NTFS sytems however, you can not load the NTFS from a floppy because it's about 2mb - which wont fit on a floppy disk. You also cannot boot from a FAT floppy (DOS) and access an NTFS file system.

If I had to guess, since you are using XP, I'd say you have a NTFS system which means that you are not going to be able to access your systems C:\ drive using a DOS floppy

You might want to try something like this http://www.nu2.nu/pebuilder/ It will make a bootable CD-ROM with the minimum XP features that will allow you to access your NTFS partition and do file maintenance. Think of it as a portable OS.

Also, I would strongly recommend you rename to file and not delete it. That way, if you discover you need it, you can just rename it back to the original name. If you figure out you really don't need the file, after a trial period, you could then delete the renamed file.
Skoron
Skoron
Quote:
Original post by Aaron71771
Quote:
Aaron, i want to boot up from a floppy disk, go to c:\ and delete something. How can i do that? The link i posted isn't what i am looking for?


I understand that

Quote:
>On the properties menu, under the "general" tab (usually the default one) look for the line that says "File System". It should say either "NTFS" or "FAT" (or FAT32, FAT16, or just FAT). What's it say?

Why do you need to know that? What's that?


There are a couple different file systems that Windows uses. Win95/98/ME use FAT type (or FAT32), NT/2000/XP can use FAT or the more secure and faster NT File System (NTFS)

With a FAT file system you can create a DOS boot disk, browse to the file and delete it. Very easy.

If you are using an NTFS sytems however, you can not load the NTFS from a floppy because it's about 2mb - which wont fit on a floppy disk. You also cannot boot from a FAT floppy (DOS) and access an NTFS file system.

If I had to guess, since you are using XP, I'd say you have a NTFS system which means that you are not going to be able to access your systems C:\ drive using a DOS floppy

You might want to try something like this http://www.nu2.nu/pebuilder/ It will make a bootable CD-ROM with the minimum XP features that will allow you to access your NTFS partition and do file maintenance. Think of it as a portable OS.

Also, I would strongly recommend you rename to file and not delete it. That way, if you discover you need it, you can just rename it back to the original name. If you figure out you really don't need the file, after a trial period, you could then delete the renamed file.


Thank you, but there are certain unclear things in your post :(

> If you are using an NTFS sytems however, you can not load the NTFS from a floppy

I don't get this. Why. First of all, what do you mean with load the "NTFS from a floppy". Load what?The file system? The file, what?

And why the link i posted doesn't contain what i am looking for?

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.

Sign in to reply to this topic.