Infection by test.exe, how to delete a file [FIXED]

Post by **DNR** » 10 Jan 2009, 21:57

dude, re-read this thread so we don't waste time. Process Explorer is in the downloads section here, use the search feature.

DNR

Insection · Post by **Insection** » 10 Jan 2009, 22:24

Ok i fixed, thanks to everyone for your help.

I found out it was somehow hooked to explorer.exe

So in cmd i did

cd desktop
tskill explorer
del test.exe
start explorer

_____

Again thanks to everyone for their help

Post by **DNR** » 10 Jan 2009, 23:42

awesome.
Process explorer would be good for finding out what is running, try the right click menu>properties>Threads>Stack on any running process.

So example I can see what all is used by the process/application:
ntkrnlpa.exe!KiDeliverApc+0xb3
ntdll.dll!KiFastSystemCallRet
MFC71.DLL!Ordinal1106+0x18

Get used to using the process explorer, it is more surgical than taskman.
Watch your computer startup, put the processexplorer.exe in your startup folder.

DNR

Insection · Post by **Insection** » 13 Jan 2009, 22:47

thanks for the clarification DNR