Page 3 of 3 FirstFirst 123
Results 21 to 28 of 28

Thread: Trojan and cant delete 2 files?

  1. Quote Originally Posted by bandit
    With this, I would be able to delete it?
    Yeah, I was still editing my post to add that and it's "attrib -r -s -h *.*". Looks like there was no problem all along just that smartftp has "view all files" enabled and your Windows is still set to "Do not show hidden files and folders" (its default setting).
    Last edited by NightWolve; 19 Jan 2005 at 10:40 AM.
    "Don't be a pansy." - James

  2. Quote Originally Posted by NightWolve
    That's fine, just add the flag to deactivate the system attribute. The full command you should run then is "attrib -r -s -h *.*". Run "attrib -s *.*" by itself first if it complains. Finally, run "DEL CAMBO1Y7." and "DEL CARHZFIK.".

    Btw, with explorer itself, you can enable it so all files are viewable and delete from there. Open up explorer, and goto Tools -> "Folder Options" -> View Tab then where it says "Hidden files and folders" check the below radio button for "Show hidden files and folders". Course, you should be able to see them in explorer now that you removed the hidden attribute at the command prompt.
    The attrib -r -s -h *.*, deactivates the system attribute? If so, I did that and it said

    "Unable to change attribute - c: \Documents and Settings\Owner\Desktop\CAMBO1Y7."
    "Unable to change attribute - c: \Documents and Settings\Owner\Desktop\CARHZFIK."

    I did the windows explorer and I dont see the images..only that Thumbs.db but I deleted it.

    Did a dir and its not shown.
    Last edited by bandit; 19 Jan 2005 at 05:23 PM.

  3. Quote Originally Posted by bandit
    The attrib -r -s -h *.*, deactivates the system attribute? If so, I did that and it said

    "Unable to change attribute - c: \Documents and Settings\Owner\Desktop\CAMBO1Y7."
    "Unable to change attribute - c: \Documents and Settings\Owner\Desktop\CARHZFIK."

    I did the windows explorer and I dont see the images..only that Thumbs.db but I deleted it.

    Did a dir and its not shown.
    Ok, something better to try. DEL supports parameters for file attributes as well. In that same folder, run "DEL CAMBO1Y7. /a rsha" and "DEL CARHZFIK. /a rsha". The /a rsha tells it the file can have readonly, system, hidden and/or archive attributes set. With the 'h', DEL should be able to find it and won't report "file not found." If it says can't delete, some application running in the background has a lock on those files. I'd use TaskMan to kill some processes that don't look familiar and try deleting again if that happens. Clean up your Run Registry key too.
    Last edited by NightWolve; 19 Jan 2005 at 07:17 PM.
    "Don't be a pansy." - James

  4. Quote Originally Posted by NightWolve
    Ok, something better to try. DEL supports parameters for file attributes as well. In that same folder, run "DEL CAMBO1Y7. /a rsha" and "DEL CARHZFIK. /a rsha". The /a rsha tells it the file can have readonly, system, hidden and/or archive attributes set. With the 'h', DEL should be able to find it and won't report "file not found." If it says can't delete, some application running in the background has a lock on those files. I'd use TaskMan to kill some processes that don't look familiar and try deleting again if that happens. Clean up your Run Registry key too.
    Tried what you mentioned with the /a. No luck. It says it cant be found. How I go about cleaning up my Run Registry Keys?

  5. Isn't it Run, RunOnce and something else? In RegEdit, you go to something like LOCAL/CURRENT_USER/MICROSOFT/WINDOWS/CURRENTVERSION and there's a bunch of keys in there under the folders I mentioned. Someone else probably knows it better.

    Those are some stubborn files you have there. Did you try Safe Mode?

  6. Quote Originally Posted by Mike
    Isn't it Run, RunOnce and something else? In RegEdit, you go to something like LOCAL/CURRENT_USER/MICROSOFT/WINDOWS/CURRENTVERSION and there's a bunch of keys in there under the folders I mentioned. Someone else probably knows it better.

    Those are some stubborn files you have there. Did you try Safe Mode?
    Nope. Never did it in Safe Mode. Then again, I dont remember how to do it on XP Pro (yes..I'm that computer illiterate). Would it work on Safe Mode? I'll wait and see what NightWolve has to say..

    Again, thanks to those trying to help.

  7. God, this is getting annoying. If DEL reported "not found" even then, those files cannot physically exist. You still get "Not resetting system file - c: \Documents and Settings\Owner\Desktop\CAMBO1Y7." with the attrib command? Also, something like "DEL CAMBO1* /a rsha" using a wildcard is worth a try.

    But yeah, good idea, Mike. Reboot your machine and after you get past the firmware messages, keep hitting F8 around that time. You'll get to a boot menu that'll allow you to go into safemode (if you don't, you missed it and need to reboot to try again). Do everything again while booted in safe mode. I'll wait for your results.

    Also, might wanna run a "chkdsk c: /f /x" for HDD maintenance. It'll probably ask you to schedule a disk check for the next reboot, so you choose 'y'. Not that I think this will help, but it won't hurt. I'm about out of ideas. But if your virus checker found that you're clean, and no other real issues, give it up.
    Last edited by NightWolve; 19 Jan 2005 at 10:34 PM.
    "Don't be a pansy." - James

  8. Quote Originally Posted by NightWolve
    God, this is getting annoying. If DEL reported "not found" even then, those files cannot physically exist. You still get "Not resetting system file - c: \Documents and Settings\Owner\Desktop\CAMBO1Y7." with the attrib command? Also, something like "DEL CAMBO1* /a rsha" using a wildcard is worth a try.

    But yeah, good idea, Mike. Reboot your machine and after you get past the firmware messages, keep hitting F8 around that time. You'll get to a boot menu that'll allow you to go into safemode (if you don't, you missed it and need to reboot to try again). Do everything again while booted in safe mode. I'll wait for your results.

    Also, might wanna run a "chkdsk c: /f /x" for HDD maintenance. It'll probably ask you to schedule a disk check for the next reboot, so you choose 'y'. Not that I think this will help, but it won't hurt. I'm about out of ideas. But if your virus checker found that you're clean, and no other real issues, give it up.
    YAY!!!!!!!!!!!!!!!!!!!!!!!

    I did the "del cambo1* /a rsha" and it didnt give me no error messages. Then i tried "del carhzf* /a rsha" and the same thing happened. When i went to do the "attrib -h", none of that "not resetting" or whatever bullcrap showed up. But just to be safe..I opened up SmartFTP and WALA!~ Its not in the local browser!!!!!

    Thanks alot NightWolve and everyone else who tried to solve this annoying and stupid problem. I was going to give up if the last thing didnt work. So as long it wasnt a virus, thats what more is important..but the fact of having something there just kinda irks me.

    Again, thanks for all the help. Hopefully, this doesnt happen again. If it does, I'll have to look back at this thread..and if its like 10 years later..i'll be coming back. HAHAHAH!!!

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
Games.com logo