Persistent file - won't erase

"Ed Cregger" <ecregger RemoveThis @bellsouff.net> wrote in message
news:8tZvj.81051$Mu4.51510@bignews7.bellsouth.net...
> AVG Free Anti-Virus is telling me that my computer is infected with
> the following file: Update_0801_KB281717.exe.
>
> I've tried to "heal" this file and I've tried to "quarantine" this
> file via AVG's anti-virus. No go. I've tried to delete it from Windows
> via My Computer. Nope. Access denied. I've even tried to get rid of it
> via DOS. Nada. Again, access denied. I have administrator's rights and
> I've turned off all remote permissions.
>
> Any ideas?
>
> I've even wondered if I just have a bad loading of the AVG program.
>
Have you found this file on your machine ?.
If you have, open it with Wordpad, and have a look thro`
it to see if you can find any text.
You might learn something about it.
AVG sometimes finds false positives.
 >> Stay informed about: Persistent file - won't erase 

On Sat, 23 Feb 2008 13:20:01 -0500, "Ed Cregger"
<ecregger.RemoveThis@bellsouff.net> put finger to keyboard and composed:

>AVG Free Anti-Virus is telling me that my computer is
>infected with the following file: Update_0801_KB281717.exe.

You can upload it to this site for analysis by several AV programs:
http://www.virustotal.com/

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.
 >> Stay informed about: Persistent file - won't erase 

Franc Zabkar <fzabkar RemoveThis @iinternode.on.net> wrote in
news:5qa1s3dd5cpmnuomkrh98de62e9vogv1t7@4ax.com:

> On Sat, 23 Feb 2008 13:20:01 -0500, "Ed Cregger"
> <ecregger RemoveThis @bellsouff.net> put finger to keyboard and composed:
>
>>AVG Free Anti-Virus is telling me that my computer is
>>infected with the following file: Update_0801_KB281717.exe.
>
> You can upload it to this site for analysis by several AV programs:
> http://www.virustotal.com/

Another online virus scanner:
http://virusscan.jotti.org/

--
pcbldrNinetyEight
 >> Stay informed about: Persistent file - won't erase 

Ed Cregger wrote:
> AVG Free Anti-Virus is telling me that my computer is
> infected with the following file: Update_0801_KB281717.exe.
>
> I've tried to "heal" this file and I've tried to
> "quarantine" this file via AVG's anti-virus. No go. I've
> tried to delete it from Windows via My Computer. Nope.
> Access denied. I've even tried to get rid of it via DOS.
> Nada. Again, access denied. I have administrator's rights
> and I've turned off all remote permissions.
>
> Any ideas?
>
> I've even wondered if I just have a bad loading of the AVG
> program.
>
> TIA
>
>
> Ed Cregger
>

When you went to the Microsoft site, were you able to find
a KB281717 ? I'm not getting a match on that number. And I
looked a few places.

It would help, if AVG would give you the "common name" for
the infection, as then you could look elsewhere for a fix.
Something like "trojan.downloader.nilage" or whatever. The
AV companies usually come up with pet names for them.

My Linux CDs here, only mount NTFS read-only. There is at least
one NTFS project, that offers read/write access. As far as I know,
NTFS is not fully documented, which is why efforts to support it,
may not be perfect. FAT32 support is much more common in Linux
distros.

And even if you do manage to mount the disk read/write, and are
ready to delete the file in question, it is possible that even
Linux will respect the permissions on the file. I don't know
if there is enough documentation on NTFS, to figure out why.

Good luck with your extermination efforts.

Paul
 >> Stay informed about: Persistent file - won't erase 

"Paul" <nospam DeleteThis @needed.com> wrote in message news:fpril5$mps$1@aioe.org...
> Ed Cregger wrote:
>> AVG Free Anti-Virus is telling me that my computer is infected with the
>> following file: Update_0801_KB281717.exe.
>>
>> I've tried to "heal" this file and I've tried to "quarantine" this file
>> via AVG's anti-virus. No go. I've tried to delete it from Windows via My
>> Computer. Nope. Access denied. I've even tried to get rid of it via DOS.
>> Nada. Again, access denied. I have administrator's rights and I've turned
>> off all remote permissions.
>>
>> Any ideas?
>>
>> I've even wondered if I just have a bad loading of the AVG program.
>>
>> TIA
>>
>>
>> Ed Cregger
>
> When you went to the Microsoft site, were you able to find
> a KB281717 ? I'm not getting a match on that number. And I
> looked a few places.
>
> It would help, if AVG would give you the "common name" for
> the infection, as then you could look elsewhere for a fix.
> Something like "trojan.downloader.nilage" or whatever. The
> AV companies usually come up with pet names for them.
>
> My Linux CDs here, only mount NTFS read-only. There is at least
> one NTFS project, that offers read/write access. As far as I know,
> NTFS is not fully documented, which is why efforts to support it,
> may not be perfect. FAT32 support is much more common in Linux
> distros.
>
> And even if you do manage to mount the disk read/write, and are
> ready to delete the file in question, it is possible that even
> Linux will respect the permissions on the file. I don't know
> if there is enough documentation on NTFS, to figure out why.
>
> Good luck with your extermination efforts.
>
> Paul

-------------


Thanks, Paul and everyone else that replied. Much appreciated.

Every time I try to even read the file with another viewer (yes, I have
found the file on my C: drive), I get access denied, regardless of the
program I am using to view it. Even the online virus detectors suggested by
some are not able to look at it, delete it, copy it or anything you can
think of that one can normally do.

A year or two ago, I caught some malware residing in the MBR and managed to
replace the existing MBR. Unfortunately, I no longer remember how to do that
procedure, nor do I have the intellectual capacity these days to figure it
out again (bad health). I guess I'll just have to live with it.

Thanks to all for trying to help.

Ed Cregger
 >> Stay informed about: Persistent file - won't erase 

"Ed Cregger" <ecregger DeleteThis @bellsouff.net> wrote...
>
> Every time I try to even read the file with another viewer (yes, I have found
> the file on my C: drive), I get access denied, regardless of the program I am
> using to view it. Even the online virus detectors suggested by some are not
> able to look at it, delete it, copy it or anything you can think of that one
> can normally do.
>
> A year or two ago, I caught some malware residing in the MBR and managed to
> replace the existing MBR. Unfortunately, I no longer remember how to do that
> procedure, nor do I have the intellectual capacity these days to figure it out
> again (bad health). I guess I'll just have to live with it.

Please, do NOT just "live with it"!!! There are many other ways to work to
eliminate it:

Boot in Safe Mode, find and delete it.

Boot from the Win CD, go to the Recovery Console, find and delete it.

Boot from a Live Linux CD, Bart PE, or other diagnostic CD, find and delete
it.

Run chkdsk /mbr from the Win CD or Safe Mode.
 >> Stay informed about: Persistent file - won't erase 

Kill it under safe mode or, second alternative, kill it on reboot with
HiJackThis.
Make sure however that this file isn't used by the system. For example, some
protection software hide their modules in stealth mode to ptotect them from
attacks. The name of the exe is randomly chosen at every windows session.
I guess that your attempts under DOS were from a dos session under XP.
Correct ?
Boot on a true DOS formatted diskette instead. If your disk file system is
NTFS, noway unfortunately for you with DOS.

Keep us informed.

"Ed Cregger" <ecregger.DeleteThis@bellsouff.net> a écrit dans le message de news:
Jblwj.92991$rc2.16389@bignews1.bellsouth.net...
>
> "Paul" <nospam.DeleteThis@needed.com> wrote in message news:fpril5$mps$1@aioe.org...
> > Ed Cregger wrote:
> >> AVG Free Anti-Virus is telling me that my computer is infected with the
> >> following file: Update_0801_KB281717.exe.
> >>
> >> I've tried to "heal" this file and I've tried to "quarantine" this file
> >> via AVG's anti-virus. No go. I've tried to delete it from Windows via
My
> >> Computer. Nope. Access denied. I've even tried to get rid of it via
DOS.
> >> Nada. Again, access denied. I have administrator's rights and I've
turned
> >> off all remote permissions.
> >>
> >> Any ideas?
> >>
> >> I've even wondered if I just have a bad loading of the AVG program.
> >>
> >> TIA
> >>
> >>
> >> Ed Cregger
> >
> > When you went to the Microsoft site, were you able to find
> > a KB281717 ? I'm not getting a match on that number. And I
> > looked a few places.
> >
> > It would help, if AVG would give you the "common name" for
> > the infection, as then you could look elsewhere for a fix.
> > Something like "trojan.downloader.nilage" or whatever. The
> > AV companies usually come up with pet names for them.
> >
> > My Linux CDs here, only mount NTFS read-only. There is at least
> > one NTFS project, that offers read/write access. As far as I know,
> > NTFS is not fully documented, which is why efforts to support it,
> > may not be perfect. FAT32 support is much more common in Linux
> > distros.
> >
> > And even if you do manage to mount the disk read/write, and are
> > ready to delete the file in question, it is possible that even
> > Linux will respect the permissions on the file. I don't know
> > if there is enough documentation on NTFS, to figure out why.
> >
> > Good luck with your extermination efforts.
> >
> > Paul
>
> -------------
>
>
> Thanks, Paul and everyone else that replied. Much appreciated.
>
> Every time I try to even read the file with another viewer (yes, I have
> found the file on my C: drive), I get access denied, regardless of the
> program I am using to view it. Even the online virus detectors suggested
by
> some are not able to look at it, delete it, copy it or anything you can
> think of that one can normally do.
>
> A year or two ago, I caught some malware residing in the MBR and managed
to
> replace the existing MBR. Unfortunately, I no longer remember how to do
that
> procedure, nor do I have the intellectual capacity these days to figure it
> out again (bad health). I guess I'll just have to live with it.
>
> Thanks to all for trying to help.
>
> Ed Cregger
>
>
 >> Stay informed about: Persistent file - won't erase 

"John Weiss" <jrweiss98155NOSPAM.DeleteThis@NOSPAM.comcast.net> wrote
in message
news:pq-dnRb2hf6sjl_anZ2dnUVZ_vHinZ2d@comcast.com...
> "Ed Cregger" <ecregger.DeleteThis@bellsouff.net> wrote...
>>
>> Every time I try to even read the file with another
>> viewer (yes, I have found the file on my C: drive), I get
>> access denied, regardless of the program I am using to
>> view it. Even the online virus detectors suggested by
>> some are not able to look at it, delete it, copy it or
>> anything you can think of that one can normally do.
>>
>> A year or two ago, I caught some malware residing in the
>> MBR and managed to replace the existing MBR.
>> Unfortunately, I no longer remember how to do that
>> procedure, nor do I have the intellectual capacity these
>> days to figure it out again (bad health). I guess I'll
>> just have to live with it.
>
> Please, do NOT just "live with it"!!! There are many
> other ways to work to eliminate it:
>
> Boot in Safe Mode, find and delete it.
>
> Boot from the Win CD, go to the Recovery Console, find
> and delete it.
>
> Boot from a Live Linux CD, Bart PE, or other diagnostic
> CD, find and delete it.
>
> Run chkdsk /mbr from the Win CD or Safe Mode.

-------------

Thanks for the suggestions. Will give it my best.

Ed Cregger
 >> Stay informed about: Persistent file - won't erase 

"Ed Cregger" <ecregger RemoveThis @bellsouff.net> wrote...
>
>>
>> Please, do NOT just "live with it"!!! There are many other ways to work to
>> eliminate it:
>>
>> Boot in Safe Mode, find and delete it.
>>
>> Boot from the Win CD, go to the Recovery Console, find and delete it.
>>
>> Boot from a Live Linux CD, Bart PE, or other diagnostic CD, find and
>> delete it.
>>
>> Run chkdsk /mbr from the Win CD or Safe Mode.
>
> -------------
>
> Thanks for the suggestions. Will give it my best.

To add to those:

http://support.microsoft.com/kb/320081/en-us
 >> Stay informed about: Persistent file - won't erase 

I loaded Spyware Doctor plus Anti-Virus from PC Tools. It worked. I am
impressed.

Thanks to everyone for your suggestions. You're a great bunch of folks.


Ed Cregger


--------------------


"John Weiss" <jrweiss98155NOSPAM.DeleteThis@NOSPAM.comcast.net> wrote in message
news:qeednYeuxvUijF7anZ2dnUVZ_sednZ2d@comcast.com...
> "Ed Cregger" <ecregger.DeleteThis@bellsouff.net> wrote...
>>
>>>
>>> Please, do NOT just "live with it"!!! There are many other ways to work
>>> to eliminate it:
>>>
>>> Boot in Safe Mode, find and delete it.
>>>
>>> Boot from the Win CD, go to the Recovery Console, find and delete it.
>>>
>>> Boot from a Live Linux CD, Bart PE, or other diagnostic CD, find and
>>> delete it.
>>>
>>> Run chkdsk /mbr from the Win CD or Safe Mode.
>>
>> -------------
>>
>> Thanks for the suggestions. Will give it my best.
>
> To add to those:
>
> http://support.microsoft.com/kb/320081/en-us
>
>
 >> Stay informed about: Persistent file - won't erase 

Doh!

The damned thing just popped back into existence. I'll run
the program again and see if the latest updates helped
anything.


Ed Cregger


"Ed Cregger" <ecregger.RemoveThis@bellsouff.net> wrote in message
news:j_Kwj.94003$rc2.41566@bignews1.bellsouth.net...
>I loaded Spyware Doctor plus Anti-Virus from PC Tools. It
>worked. I am impressed.
>
> Thanks to everyone for your suggestions. You're a great
> bunch of folks.
>
>
> Ed Cregger
>
>
> --------------------
>
>
> "John Weiss" <jrweiss98155NOSPAM.RemoveThis@NOSPAM.comcast.net> wrote
> in message
> news:qeednYeuxvUijF7anZ2dnUVZ_sednZ2d@comcast.com...
>> "Ed Cregger" <ecregger.RemoveThis@bellsouff.net> wrote...
>>>
>>>>
>>>> Please, do NOT just "live with it"!!! There are many
>>>> other ways to work to eliminate it:
>>>>
>>>> Boot in Safe Mode, find and delete it.
>>>>
>>>> Boot from the Win CD, go to the Recovery Console,
>>>> find and delete it.
>>>>
>>>> Boot from a Live Linux CD, Bart PE, or other
>>>> diagnostic CD, find and delete it.
>>>>
>>>> Run chkdsk /mbr from the Win CD or Safe Mode.
>>>
>>> -------------
>>>
>>> Thanks for the suggestions. Will give it my best.
>>
>> To add to those:
>>
>> http://support.microsoft.com/kb/320081/en-us
>>
>>
>
>
 >> Stay informed about: Persistent file - won't erase