can not delete a file. 2

[cb49747]

I'm running xp pro sp1 and norton anti virus. Norton said I had a worm in file c:\windows\system32\hlps.dll but said it could delete the file. using windows explorer I can not find the file. I am showing all hidden files as well. However from a dos prompt I can go to the directory c:\windows\system32 and see the file hlps.dll but when I try to delete it, it says that the file is locked and I do not have permission to delete it. I'm logged in with administrator rights.

Any suggestions on how I can remove this file?

Chris BUrger

 

[tfg13]

Have you ensured that any processes that may be associated with this "virus" have ended? With task manager, see if there are any "suspicious" processes running, and end them (check Google to make sure they are not legit processes before ending them).
Have you also tried to run Ad-aware/Spybot? These may be able to take care of this as well.

 

[gpalmer711]

Follow the instructions in: What are Good Virus/Spyware?Update/Firewall Practices? faq779-5240

If still no joy then take a look at the del later software from:

http://www.diamondcs.com.au/index.php?page=products

Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk

 

[R3bo0t]

hi,

you can use the REGSVR32 command

Open a dos command prompt by typing CMD in the Run box.
there you navigate to the directory containing the *.DLL
( c:\windows\system32\ in your case)
Now you type "REGSVR32 hlps.dll" and hit ENTER

The DLL will now be unloaded and you will be able to delete it.

An other option is to kill the explorer.exe task with the taskmanager and restart it by clicking on New Task. This option van be used to delete In Use *.AVI files when they are corrupted.

Greetz

 

[cb49747]

R3bo0t,

Kudos to you, it worked great.

Chris Burger

 

[MasterofNone]

R3bo0t

Just incase you are not aware.

The avi issue has apparently been addressed in SP2, but there is also a registry change which stops explorer locking up the corrupted avi.

 

[R3bo0t]

Thx, that I didn't know.

 

[gpalmer711]

The registry key in question is below, remove the following registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87D62D94-71B3-4b9a-9489-5FE6850DC73E}\InProcServer32

This will prevent Explorer from loading shmedia.dll in response to file property queries on these files.

Greg Palmer
Free Software for Adminstrators

http://www.palmersoft.co.uk