# Undeletable trojan **URL:** \ **Category:** Factual Questions\ **Created:** [February 10, 2006, 11:06pm UTC](https://boards.straightdope.com/t/undeletable-trojan/343933 "2006-02-10T23:06:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Thinktank](https://avatars.discourse-cdn.com/v4/letter/t/6a8cbe/32.png) [@Thinktank](https://boards.straightdope.com/u/Thinktank)\ **Post date:** [February 10, 2006, 11:06pm UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/1 "2006-02-10T23:06:58Z")
K, I’ll make this quick… I ran Kaspersky’s scan and it found a file located at C:\_Restore\TEMP\A0007212.cpy. I’m using the ME OS. Anyway, I tracked this finle down but it always seems to be “in use” I rebooted in safe mode where it showed no process running other than Explorer in the CTRL/ALT/DLT window… I’ve got no idea how to find this file running and shut it down so I can delete it. Any ideas/guidance is welcome. ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [February 10, 2006, 11:11pm UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/2 "2006-02-10T23:11:18Z")
Download ZAP from [here and report back](http://helpdesk.kixtart.org/KixUtilsTasks.asp). ---
**Author:** ![pulykamell](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/pulykamell/32/3166_2.png) [@pulykamell](https://boards.straightdope.com/u/pulykamell)\ **Post date:** [February 10, 2006, 11:14pm UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/3 "2006-02-10T23:14:12Z")
> [@pulykamell](#): > > Download ZAP from [here and report back](http://helpdesk.kixtart.org/KixUtilsTasks.asp). Oh, crud…I don’t think that’ll work with ME. Can you navigate your way up to the directory in safe mode and delete it? If not, can you boot up in DOS and find your way to the file and remove it that way? ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [February 10, 2006, 11:38pm UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/4 "2006-02-10T23:38:37Z")
> [@pulykamell](#): > > Oh, crud…I don’t think that’ll work with ME. Can you navigate your way up to the directory in safe mode and delete it? If not, can you boot up in DOS and find your way to the file and remove it that way? or maybe killbox [http://www.bleepingcomputer.com/files/killbox.php](http://www.bleepingcomputer.com/files/killbox.php) ---
**Author:** ![Thinktank](https://avatars.discourse-cdn.com/v4/letter/t/6a8cbe/32.png) [@Thinktank](https://boards.straightdope.com/u/Thinktank)\ **Post date:** [February 11, 2006, 12:05am UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/5 "2006-02-11T00:05:43Z")
Well, yeah- ZAP didn’t zap anything with ME. I tried the safe mode suggestion already myself and beyond hitting “dir” at the dos prompt I really have very little knowledge of dos… so-o… what’s next… heheh ---
**Author:** ![Nanoda](https://avatars.discourse-cdn.com/v4/letter/n/ce73a5/32.png) [@Nanoda](https://boards.straightdope.com/u/Nanoda)\ **Post date:** [February 11, 2006, 12:23am UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/6 "2006-02-11T00:23:07Z")
Well, “cd” changes directory, and “del” deletes. Presuming you’re using _actual_ DOS mode (hit F8 at boot to select), it should be as simple as ```auto cd C:\_Restore\TEMP del A0007212.cpy ``` , assuming the \_Restore directory isn’t special somehow (I never used ME, thank Og). You might need to use attrib, but only if you get an error with the above. ---
**Author:** ![yoyodyne](https://avatars.discourse-cdn.com/v4/letter/y/a9a28c/32.png) [@yoyodyne](https://boards.straightdope.com/u/yoyodyne)\ **Post date:** [February 11, 2006, 2:52am UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/7 "2006-02-11T02:52:09Z")
[MS instructions](http://support.microsoft.com/default.aspx?scid=kb;en-us;263455) ---
**Author:** ![astro](https://avatars.discourse-cdn.com/v4/letter/a/9dc877/32.png) [@astro](https://boards.straightdope.com/u/astro)\ **Post date:** [February 11, 2006, 3:40am UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/8 "2006-02-11T03:40:10Z")
I generally run a series of scans 1: First I run a spyware scanner like ad aware or the [Microsoft spyware beta](http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en) scanner, and then an [anitvirus program like AVG](http://free.grisoft.com/doc/1) for the really basic stuff (none of these can really handle clever, deeply embedded stuff) 2: Run [Hijack This](http://www.majorgeeks.com/download3155.html) (freeware) and kill spyware crap that’s auto loading at bootup. 3: Finally if your worm is still hiding in the OS root at bootup use [blacklight F](http://www.f-secure.com/blacklight/try.shtml) in safe mode to root it out and kill it permanently. This tool shows hidden processes that load then hide in memory than even the task manager cannot reveal (which is how rootkits work) Items 2 and 3 require some knowledge as to what are likely valid OS processes and what are not. You may have to run any of these (free) tools multiple times to lock/cripple the worm or virus out of memory then kill it. ---
**Author:** ![Whack-a-Mole](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/whack-a-mole/32/141_2.png) [@Whack-a-Mole](https://boards.straightdope.com/u/Whack-a-Mole)\ **Post date:** [February 11, 2006, 5:07am UTC](https://boards.straightdope.com/t/undeletable-trojan/343933/9 "2006-02-11T05:07:38Z")
> [@astro](#): > > I3: Finally if your worm is still hiding in the OS root at bootup use [blacklight F](http://www.f-secure.com/blacklight/try.shtml) in safe mode to root it out and kill it permanently. This tool shows hidden processes that load then hide in memory than even the task manager cannot reveal (which is how rootkits work) Blacklight does not work on ME. > [@](#): > > Note: The F-Secure BlackLight Beta only works on 32-bit Windows 2000, Windows XP and Windows 2003 Server. The current F-Secure BlackLight beta does not work on Windows NT, 95, 98, ME, or 64-bit Windows. > > SOURCE: [Cyber security solutions for your home and business | F-Secure](http://www.f-secure.com/blacklight/try.shtml) I would really, really, really consider getting rid of ME altogether (not saying ME is the cause of this particular problem…just that ME frankly stinks).