Printable View
Someone once referred me to a software application similar to killbox that deletes undeltable files I think via dos, but not sure, Does anyone know the name of this software ?? I don't think it was DelinvFile either. I think it started with a V (but not vundo fix)
Thanks...
The site is down at the moment, but have a look at DiamondCS
I think they have a delete on reboot tool?
Edit: it is called "DelLater"
I thought that m$ had a tool that will delete a file that is in use upon reboot. It was in the resource kit or support tools? I had to use it to get rid of a corrupt user profile that wouldn't allow me to delete it due to it being in use.
The name escapes me at the moment and scrolling through the list of tools doesn't make it pop out at me. I'm pretty sure it was Windows 2000 Server that I as having problems with at the time...
I suppose you could always boot to some WinPE or *nix boot CD, mount the file system and delete it there?
You can try something like: http://www.snapfiles.com/get/removereboot.html
Oh and hijackthis has a tool built into it to do that too...
unlocker
He is talking about a product that can be found at http://ccollomb.free.fr/unlocker/ It never used to work for me but its probably better now. It basically kills what ever process has the file open then deletes it. Cool concept
Thanks very much for your help everyone, but none of these programs are working. I tried killbox, DelinvFile, GiPo@MoveOnBoot, delreb (which wouldn't run and gave me a script error), and unlocker1.8.5, but none can help me get rid of this file called mdelk.exe which has actually replicated itself into the killbox folder so now it exists twice and cannot be deleted.
I took a screen shot of my problem, and trust me I have tried everything in my power to get rid of this so far. Only 2 programs actually identify it, but cannot get rid of it. My spy Sweeper from webroot didn't spot it at all. Only spyware doctor and xoftspy.
http://www.boredinnc.net/ftp/SCREENS...REENSHOTS.html
Basically it's a Email-Worm.Bagle or W32.Beagle.dp
It tells me that I am infected here
Infection - HKEY_USERS\S-1-5-21-4244836623-3323935454-545560717-1007\Software\Microsoft\Windows\CurrentVersion\Run, german.exe
So in closing I need an extreme measure here to try and delete that file mdelk.exe Can anyone help ?
The easy solution: Backup and reinstall.
The worthwhile solution: Where exactly is the virus supposedly located? When you try to delete it from there, is that when you get the "file is in use" error?
Probably stupid question, but have you tried deleting it in Safe Mode?
Also try using BartPE to boot into the box, so if you can delete it that way...
no I have not tried safe mode yet because I figured it wouldn't let me in anyways because this virus is a tough one it seems to not let me run spybot at all and it doesn't let me install certain applications such as bit defender or Sophos etc etc. I will look into BartPE right now though. The virus which I think to be the virus is located in windows\system32 folder (mdelk.exe) and yes I get the following message"cannot delete mdelk:cannot read from the source file or disk" so it doesn't actually say file is in use...
So again I appreciate your efforts. I'll try to boot in safe mode and see if that helps any...
it won't let me boot up in safe mode it keeps resetting itself
That's not a good sign...Ok, that narrows down our choices.
Have you tried BartPE yet? That'd be by next course of action.
If that doesn't work, do a Windows repair install.
not yet but I guess I'll try now thanks
I am so frustrated because I don't kn0w how to use that PE builder or whatever and also I lost all of my audio drivers so I had to spend the last 3 hours trying to recover those, which I still haven't.
I appreciate your help a lot though, but I wish there was a way that this mess can just be cleaned up somehow with the wave of a magic wand.
Jus dunno where to begin...
Google a bit on BartPE. It's MUCH easier to use than it looks, really. I used it for the first time maybe a month ago, was able to figure it out within an hour after doing some research. Basically the steps:
1) Have a valid Windows install package handy.
2) Convert it with BartPE.
3) Burn to disk.
Now there are more details to it than that, but you can read up on it and figure out the rest.
Why is it taking so long to recover drivers? Are you going to the hardware manufacturers' sites and downloading the latest versions?
Also, I'd worry about the drivers last. As long as you can boot into the thing somehow, work on the infection first. If you can't fix that, working on drivers is nothing but a waste of precious hours.
Unfortunately, you're beyond a quick easy fix. The only quick fix is to backup and reinstall Windows.
Do you see the process (mdelk.exe) running in task manager?
Cheers:
/edit
As well, I found this, it might be worth a try:
http://www.theeldergeek.com/delete_undeletable_file.htm
ok i have good news kinda I was able to not only delete that file but also delete other things that came up on xoftspy as well as spyware doctor. I played around with 2 programs one was called Un h-a-c-k Me 4.6 Build 285 by Greatis Software and another one called RegRun Reanimator 5.6.5.930
Don't ask me how I did it, but all the obvious remnants of the virus seem to be gone for the time being. The only concern I have was that my IP had changed since what it was 2 days ago for some reason.
The only other stupid thing I did was accidentally delete my audio drivers in with that Reanimator program, so the virus didn't cause it, it was human error.
I visited a live tech at HP and they referred me direct downloads for the audio drivers, but I am still amiss on that thus far.
It's been quite a long tiring day off from work spent on recovering from a massive virtual computer depletion right before my very green Irish eyes, and I want to extend my thanks yet again to you guys for taking the time to help.
I hope that whatever I did is a solid enough resolution for your closure on this virial worm issue, yet I still am challenged by getting my audio drivers back and I'll even give an LOL for that...
Quote:
Originally Posted by DjM
Awesome I will use that concept should I need it again (hopefully not) in the future... thank you I bookmarked it...
Ok, fixing drivers should be relatively simple.
What kind of hp do you have, and what all are you missing drivers for?
I spoke with a tech help person earlier, and was instructed to download sp26792, & sp33566 audio drivers for my COMPAQ PRESARIO SR2020NX, however even after I installed them, I am still without an audio device.
Winamp gave me error message
Bad DirectSound driver Error code 88780078
Then the tech told me to install this
ftp://202.65.194.212/pc/audio/WDM_R184.exe
Still no luck
k here's what I did for COMPAQ PRESARIO SR2020NX
XP Home Edition
Fall 2006 Original Realtek High Definition Audio Drivers
Download sp26792
ftp://ftp.hp.com/pub/softlib/softwar...-1/sp26792.exe
========================================================
Universal Audio Architecture UAA High Def Bus Driver
Download sp32646
ftp://ftp.hp.com/pub/softpaq/sp32501-33000/sp32646.exe
Universal Audio Architecture UAA High Def Bus Driver
========================================================
It told me in order to install 26792 that I needed UAA first, but even after I installed the UAA it gave me the same message so I dunno why it isn't working plus also it is next to impossible to uninstall the realtek high def drivers even if I wanted to.
Frustrated again...
Try this one...
"Stupid word filter"
The site is life wear fishnetser
http://lifewear fishnetser.com/software/hard-drives/the-windows-file-shredder-211357.php
Code:
@echo off
echo .* * *W A R N I N G * * *
echo .
echo .The File(s)/Folders(s) Will Be Permanently Deleted!
echo .
echo .Press CTRL-C to Abort and Terminate Batch Job Or...
echo .
pause
sdelete -p 4 -s %1
pause
Save the file as "shred.bat" on your desktop right next to your Recycling Bin. Now just drag and drop those sensitive files onto the icon to make them disappear forever!
Hehehe...
Word filter: "wear fishnets" = "h-a-c-k-o-r" minus the "-". :D
I'm still pushing to change to "fluffy bunny".
Is it? wear fishnetsor
So it is! must be just looking for the first part:D
did you also search the registry for the file name that you were having trouble with? A lot of times these replicating files bury themselves in the registry. You need to make sure you remove it from RunOnce too.
I would delete all files in the prefetch
this issue was resolved plz close thread... thanks all