Member Avatar for Gizmo78

I got a a file on my PC that just won´t leave

It keeps saying "This file is in use by a program or another user"

I tried safe mode. It says the same thing
I tried "Hijack This" remove on reboot. It just makes HijackThis.exe process 99% CPU, so it cant work.
If I click on the file it makes explorer.exe process 99% CPU

I have tried scanning it with Norton Antivirus. Comes up clean
Giant Antispyware Beta. Comes up Clean
Ad-Aware SE Pro. Comes up Clean
All of them updated. exept AVI files dont affect running processes. 680.31 MB if I remember correctly, can't get any info on it. Got it through P2P Sharing. I know there is alot of crap on there but I always scan all files before opening them or use bitzi-web so I thought I was safe. That just wasn't the case this time.

Computer is working slow all the time. It happened after I clicked on the file for the first time. I am hoping that I don't have to Format my harddrives.

I Have had virusses on my PC before but nothing like this one.

If anyone has a suggestion about what might help or has tried something similar please let me know.

  • 2 Contributors
  • 4 Replies
  • 122 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by jaishankar

Dani AI

Generated

Nice outcome: ’s move to a minimal boot environment cleared the immediate problem and confirms the file was being held by an active process (Explorer or a helper). ’s pointer toward an unlocking tool was on the right track. The next steps are to verify there are no hidden persistence mechanisms left and to make sure backups and other machines are not infected.

Short cleanup checklist (order matters)

  • Isolate the PC from the network to avoid lateral spread.
  • From a command prompt on the affected machine (or from rescue media), remove any file attributes then delete the file:
attrib -s -h -r "C:\path\to\suspicious.file"
del /f /q "C:\path\to\suspicious.file"
  • If the file is "in use", find the owning handle with Sysinternals Handle or Process Explorer and stop the process before deleting:
    handle.exe suspicious.file
taskkill /PID 1234 /F

Deeper verification

  • Use Autoruns (Sysinternals) to review and disable unknown entries in Run/RunOnce, services and scheduled tasks. Also examine:
    • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • Scheduled tasks (use schtasks /query /fo LIST /v and delete suspicious ones)
  • Run dedicated rootkit checks (GMER, TDSSKiller) and an offline rescue scan (bootable AV rescue media or Windows Defender Offline) to find components that hide while Windows runs.

Recovery and prevention

  • Upload the suspicious file to VirusTotal before deleting if possible (multi-engine scan).
  • Backup personal documents to external media, scan that media from a known-clean system before restoring. Change passwords from a clean device.
  • If persistence/rootkit components remain or critical system files are altered, prefer a full wipe and reinstall; restore only scanned data.

Future precautions

  • Treat P2P executables as high risk. Use a VM or sandbox for unknown binaries, enable on-access scanning, and show file extensions to avoid double-extension tricks.

Recommended Answers

All 4 Replies

Member Avatar for Gizmo78

I need a way to make Windows delete it on reboot by just typing the path cause this virus is smart it notices everything

I have to click open when I use HijackThis, and thats when all hell breakes loose
Are there any programs available that can do that ??
Would it help to ad the HijackThis Scan Logfile to the tread ??
If anyone needs more specific info just ask

Member Avatar for jaishankar

I need a way to make Windows delete it on reboot by just typing the path cause this virus is smart it notices everything

I have to click open when I use HijackThis, and thats when all hell breakes loose
Are there any programs available that can do that ??
Would it help to ad the HijackThis Scan Logfile to the tread ??
If anyone needs more specific info just ask

Hi,
There's a small utility "Unlocker" with which u can delete the files which refuse to be deleted

Just install it and right click on the file which u wanna delete and click on unlock now a window will open, select the entry in the box and click on unlock all now u can delete the file

Member Avatar for Gizmo78

Couldn't find the "unlocker". Don't really know in what program U meant, but I managed to solve the problem on my own.

Since the Windows "explorer.exe" process was worst infected by the virus, I needed to start up without using windows.

By starting up repeatedly pressing the F8 button, I got a bunch of choices. One was start up in safe mode with command prompt. The benefit with that is that only a few processes are running not including explorer.exe, so it was no problem at all removing the virus using the prompt.

Sometimes it's better to go back to basics :D

Member Avatar for jaishankar

Couldn't find the "unlocker". Don't really know in what program U meant, but I managed to solve the problem on my own.

Since the Windows "explorer.exe" process was worst infected by the virus, I needed to start up without using windows.

By starting up repeatedly pressing the F8 button, I got a bunch of choices. One was start up in safe mode with command prompt. The benefit with that is that only a few processes are running not including explorer.exe, so it was no problem at all removing the virus using the prompt.

Sometimes it's better to go back to basics :D

Iam glad that u solved the problem
By pressing F8 during startup u will enter into safe mode which is a diagnostic mode. Here u can delete the files safely, and sorry for that i didnt mention about it

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.