Member Avatar for Saddlefall

OK, my comp is infected with this nasty virus. I don't think its very harmful, but its annying as hell. It's the W32.pinfi virus... and my norton AntiVirus 2004 PRO...(PRO, yeah right) can't remove it... Norton gets all the other files, but there is a .tmp file that seems invincible. Nothing has access to it, I can't delete it, and if I have norton autoprotect on, it keeps nagging about the same damn file without being able to do anything with it at all...

I just formatted today, I thought I would get rid of it, but as stupid as I am, I copied in some files and stuff from cd's I burnt before I formatted... I must have got that virus again that way... lol

Anyways, any help would be greatly appreciated.

  • 2 Contributors
  • 2 Replies
  • 120 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by Saddlefall

Dani AI

Generated

A few practical steps that usually remove a stubborn W32.Pinfi-style .tmp file and stop reinfection.

— because you copied files back from discs after the reinstall, the infection very likely came with those files. ’s vendor-doc suggestion is a good direction; many removal routines only fully work when run from outside the infected Windows session. The goal is to remove the file while nothing on the machine has it open, then clean any persistence points so it cannot restart.

Try this workflow (in order):

  1. Boot from external media. Use a bootable rescue environment (vendor rescue CD/USB or Windows install/repair console) so Windows is not running the malware. From that environment remove the file with forced attributes cleared:
attrib -s -h -r "C:\full\path\to\file.tmp"
del /f /a "C:\full\path\to\file.tmp"
  1. If the file is locked inside a running process, identify the handle from a clean boot or another machine using Process Explorer / Handle (Sysinternals). Stop the offending process and then delete the file. From a running Windows session you can try:
tasklist | findstr /i pinfi
taskkill /f /im suspect.exe

  1. Remove persistence. Check startup entries and scheduled tasks (Autoruns is ideal). Search for recently created executables, autorun.inf on removable media, and any suspicious services.

  2. Clean your backups before restoring. Scan burned CDs and any copied files on a separate, fully patched machine or with the rescue environment before bringing them back. Restore only personal data (documents, pictures), not executables, scripts, or unknown installers.

If the file still returns after offline removal, a full wipe and clean install (then restoring only scanned data) is the most reliable fix. If any of these steps feel risky, professional help is advisable to avoid data loss.

Recommended Answers

All 2 Replies

Member Avatar for DaveSW

Turn off system restore:

Then try again.

Member Avatar for Saddlefall

I just decided to format over agian, and install norton anitvirus FIRST, then hopefully prevent any virus fron entering my system... If I still get the virus, I'm gonna try that removal procedure symantec suggested.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.