Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trouble Removing Virus


  • Please log in to reply
4 replies to this topic

#1 sweet_disaster

sweet_disaster

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:20 AM

Posted 17 July 2006 - 04:43 PM

Hi all,

I am new here and I am having some trouble removing a virus from my computer. My Norton Antiviurs Auto Protect Scan found the following threat:

Scan type: Auto-Protect Scan
Event: Threat Found!
Threat: Downloader
File: C:\WINDOWS\system32\csr017.dll
Location: C:\WINDOWS\system32
Action taken: Clean failed : Quarantine failed : Access denied
Date found: Monday, July 17, 2006 5:33:34 PM


So I tried to remove the infected file by disabling system restore and then restarting the computer in Safe Mode. However, when I try to delete the file, I got the error message "Error Deleting File. Cannot delete csr017.dll. It is used by another person/program."

Hmm..what to do? :thumbsup:

Thanks in advance!

BC AdBot (Login to Remove)

 


#2 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:10:20 AM

Posted 17 July 2006 - 05:03 PM

Hi sweet_disaster,
Have you run any anti malware scans?
if not......
Please download Ewido anti-spyware 4; it is a 30 day trial version of the program.
  • Install ewido security suite
  • Ewido will automatically run at the end.
  • The program will now open to the main screen.
  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  • You will need to update ewido to the latest definition files.
    • On the top row of the main screen click update.
    • Then click on "Start Update".
  • The update will start and a progress bar will show the updates being installed.
    (the status bar at the top will display ("Update successful")
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates
Don't run it yet.

Reboot into SAFE MODE
By pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode.

Open Ewido anti-malware
Click on the scanner button in the top row.
  • Click Complete System Scan and the scan will begin.
  • During the scan it will prompt you to clean files, click OK
  • When the scan is finished, look at the bottom left of the screen and click the "Save Scan Report" button.
  • Click on "Save Report As".
  • Save the report to your desktop
Close Ewido

Please reboot back to normal mode.

If you are still getting this problem after this.....
Post a HijackThis log to the appropriate forum .... instructions are Here
Then one of the experts will deal with your log. ( it might be helpfull if you include your saved copy of the ewido log as well)

BBPP6nz.png


#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,056 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:20 AM

Posted 18 July 2006 - 06:51 AM

The .dll file your trying to remove is probably related to a bad .exe file. DLL files are small programs dynamically linked with larger programs that uses them during program execution rather than being compiled with the main program. As such they are locked and considered as in use by another program so they cannot be deleted easily. If Ewido finds and removes the .exe then deletion of the .dll should work.

If not there are other tools available.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 sweet_disaster

sweet_disaster
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:20 AM

Posted 18 July 2006 - 10:05 AM

Thanks a lot!
I have tried Adaware and Spybot S&D, but they didn't seem to have worked (althought they did find other stuff on my computer..)

I will give that program a try!

#5 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:10:20 AM

Posted 18 July 2006 - 10:16 AM

Just so that you know..... Ewido will take a lot longer to complete it's search than either AdAware or Spybot.
So be prepared :thumbsup:

BBPP6nz.png





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users