winfree.exe is infected 1

[TechInNeed]

Winfree.exe in \windows\system32 directory is infected witha virus. Is it safe to delete this file?

 

[smah]

According to my search results, it looks like winfree.exe is a utility to convert html to other formats like pdf and such. I doubt it was included with any version of windows, but post your windows version, so someone can check to be sure.

 

[KimberTech]

What virus did it tell you winfree was infected with?

Members of Tek-Tips provide answers to questions based on the information given. For the best answers, post detailed descriptions of the issue. Use the search features of the site to see if your issue was already addressed in another thread.

 

[TechInNeed]

Sorry for the late reponse.

Smah
I am using Small Business Server (Windows 2000)

KimberTech
According to F-Secure see below for examples of the report. When I try to rename, delete or disinfect the files in question, it is not successful. It says that the files are located inside an archive. Please advise.

C:\WINNT\system32\winfree.exe\tftp8675 Infection: is a destructive program
C:\WINNT\system32\winfree.exe\winhelper.exe Infection: is a security risk or a "backdoor" program
C:\WINNT\system32\winfree.exe\WinOS.hlp Infection: Backdoor.IRC.Cloner
C:\WINNT\system32\winfree.exe\Advisory.nfo Infection: Backdoor.IRC.Flood.a
C:\WINNT\system32\winfree.exe\OS32.ini Infection: IRC-Worm.Froze
C:\WINNT\system32\winfree.exe\pnc.exe Infection: is a security risk or a
"backdoor" program

 

[smah]

Ahh..Winfree.exe is a folder name. Can you delete or rename the entire folder?

 

[TechInNeed]

It is not a folder.
It is a file.
I have navigated to the specified location/path and verified that it is indeed a file and not a folder.
The exact error message when I try to delete, disinfect OR rename the file is
"The Object could not be accessed. The file is located inside an archive"

 

[smah]

OK, so the winfree.exe is an archive of some sort (like a .zip or .cab file) that contains some infected files. Can you start the machine in command prompt only mode?

If so, navigate to C:\WINNT\System32 and type:
Del winfree.*

 

[jrbarnett]

An archive is normally a file that contains others, such as a zip, arc or lzh file even if the extension is something else. Try setting F-Secure to avoid scanning archives then see if you can access it (be sure to turn it back on afterwards though).

Another way to try and delete it is to use the command prompt and Deltree copied from Win9x (be very careful if you don't know how to use this).

John

 

[TechInNeed]

I will try both approaches after hours to avoid any sort of downtime.
Btw, is this file ok to delete?

 

[smah]

I expect it is - no workstation version of Windows comes with that archive in the System32 folder. I don't know for sure about SBS, but even if you have the application that converts html to some other format, it shouldn't be critical to windows and could probably be reinstalled.

 

[TechInNeed]

Thanks man for all your help and thansk to everyone as well. I will try this tonight and keep you all posted.

 

[smah]

I just searched a little differently than before and found this:

http://omak.com/Ray/.

Maybe someone installed this utility. If needed, it certainly could be installed again.

 

[TechInNeed]

Update:
Well, my main concern with removing this file was that it may have been a critical file. By performing searches and be advised in this posting, I went ahead and delete the file. I was not able to delete the file through F-Secure, but I was however able to delete it through Windows Explorer. I will reboot the system and then execute another scan.

Thanks again for all your help.

 

[TechInNeed]

Thanks smah