Member Avatar for Dapo

Hi. My computer has a file in C://Windows called 'wndllsys.exe' This file, since it's licated there, runs on startup every time. Selective startup will not work (Automatically re-ads itself to the accept list). Now the file simply brings up a window with some.. Er... Rude text, and gived the option to close or 'ok'. Either one shuts down the computer. All I need to know is if there's a way to delete this exe file while it's running, or somehow quarantine it. The program does not display itself in the CTRL-ALT-DELETE menu. Any help is much appreciated.

PS - I do have Norton Antivirus 2005, but it does not detect the file and I do not see an option to quaranteen any random file. I am running on Windows 98.

  • 3 Contributors
  • 2 Replies
  • 483 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

As reports, a file called wndllsys.exe placed in C:\Windows that auto-starts and forces shutdown is almost certainly a persistent infection; Norton 2005 failing to flag it on a Windows 98 machine makes an offline removal approach necessary. 's idea to operate from outside the running Windows environment and 's Safe Mode suggestion are both sensible starting points, but they need a few safety and follow-up steps to avoid the file simply reappearing.

A safe immediate workflow is: disconnect the PC from networks, boot from a clean pre-Windows environment (Windows 98 Startup Disk or a bootable rescue CD), then break the executable's autorun without running it. From the pre-boot prompt, clear hidden/system attributes and rename the file so any existing autorun entry no longer finds it. Example commands (run only from the offline prompt):

attrib -s -h wndllsys.exe
ren wndllsys.exe wndllsys.bak

Renaming leaves a copy available for offline scanning or analysis without letting the original name be relaunched. After that, inspect and clean the usual persistence locations: the StartUp folder; the Run keys in the registry (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run); and win.ini / system.ini for any load/run entries. Export any registry keys before editing. If the file returns after reboot, another component (driver, VxD, scheduled task, or a hidden process) is recreating it.

Finally, scan the disk with up-to-date on-demand or bootable rescue scanners and rootkit detectors from a clean medium. If removal cannot be confirmed or system stability is damaged, backup personal data to removable media and perform a clean reinstall. A saved startup/autostart log (HijackThis-style) is the typical artifact volunteers in the Viruses, Spyware and other Nasties forum review for deeper diagnosis.

Recommended Answers

All 2 Replies

Member Avatar for Thong_Ispector

Exit Windows to DOS mode... Will not work in a DOS window

or Boot into command prompt only... F8 on power up...

Manually delete the file...

At the C:\ prompt

Type: cd windows then ENTER
It responds C:\WINDOWS

Type: del <name of file> then ENTER

Reboot

Member Avatar for DMR

You can probably also delete the file when booted into Safe Mode; it's most likely that the file won't be running in Safe Mode.

There's a larger issue though: you're obviously infected, and it's highly likely that the wndllsys.exe file is not the only "unwanted guest" on your system. You should have a read through the threads in our Viruses, Spyware, and other Nasties forum to find out how to check your system for further infections. If you find that you need more help along those lines, please start a new thread in that forum, as that is where we deal with those sorts of issues.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.