🚀 go-pugleaf

In article <s7JTvIBA9754EwGe@pigsonthewing.demon.co.uk>, Andy Mabbett
<andy@pigsonthewing.demon.co.uk> writes
>In article <zzFF4.6513$Q5.23128@stones>, William Allen
><mail@mayfly13.fsnet.co.uk> writes

<snip>

>>Now you have to start clearing up the mess the
>>trojan left.  You could try an AV scanner to do this (**NOT** the one
>>that got you in this mess), 
>
>Norton (which was the software use din this case) now reports that
>Subseven is still infecting c:\WINDOWS\MSREXE.EXE, which it cannot fix;
>it recommends deleting this file. The file cannot be deleted (nor even
>renamed, as a backup) as it is "in use by Windows". Will Sophos Sweep
>fix it (I won't have chance to try that until tomorrow night), or is
>there some other solution.
>
You can delete anything at all from a native DOS prompt (i.e. when you
boot into DOS rather than running it within Windows).

Boot to DOS Prompt via control key

enter:

CD windows  

The file may be hidden, write protected etc, so unset the attributes:

ATTRIB -H -S -R  msrexe.exe

Now, better safe than sorry, rename it:

REN msrexe.exe msrexe.bad

This way you can reverse the thing if necessary, but the file should
probably be consigned to perdition....

<snip>

-- 
Tom