Force-deleting files

Question

I am having an ongoing problem with the Welchia worm being installed on my computer (despite protection from Norton Internet Security). Something keeps creating a temporary internet files folder in my Windows directory, and placing infected files there. Among these is an index.dat file, which may actually be responsible for reinstalling the virus every time I delete it.

When I attempt to delete this directory, I am prevented by doing so. There is a statement that "another user or program is using the file." Is there a way to force Windows XP to delete the file anyway?

Annie70 · Answer

When you worked on deleting the virus did you turn off System Restore? You can try this to delete those dat files. 1. Shut down your computer>restart>continually press F8 for the advanced boot options. 2. Select Safe Mode with Command Prompt. Log on as adminstrator. 3. Type CD\    (This will take you to a C Prompt). 4. Type 'del index.dat /s'  (note:space after del and dat) ( Do not type the quotes). 5. Press Enter. Wait...it may take a few minutes. When you are returned to the C Prompt again this process should be done. Type Exit. 6. To get out of safe Mode: Ctrl+Alt+Delete>go to Shutdown>Restart.

Annie70 · Answer

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

Did you use a removal tool to rid your computer of this worm? Do you have all the Critical Updates form the Microsoft Site?

Bill Levinson · Answer

Yes, I have System Restore off. The worm nonetheless keeps reappearing when I access the Internet. (I also have Norton Internet Security blocking the ports that the worm normally uses.)

Annie70 · Answer

http://v4.windowsupdate.microsoft.com/en/default.asp See if you can get to the Microsoft Update page from here.

Annie70 · Answer

Bill, You might want to start a new thread at the Virus Information forum and give as much information as possible. There are some great gurus in that forum that may be able to shed some light on this problem.

Bill Levinson · Answer

Yes, I ran Symantec's worm removal tool. I tried to get the Microsoft update but was directed to a page (at Microsoft's site) totally unrelated to what I had requested.

Windows General

Force-deleting files

Was this post helpful?