Infected file - NOD32 can find, but not clean!

[Terry Sleeper]

Hello from Manchester, UK.

Does anyone know how I can get rid of this infected file?:

C:\Windows\System32\Process.exe - Win32/PrcView application - error while deleting (Access denied)

The "clean" and the "delete" buttons only give: "Error while cleaning - access denied". This leaves the third and last option - "Leave". Obviously, this is not satisfactory. How can I remove this file?

Terry.

[Fajo]

Originally Posted by Terry Sleeper

Hello from Manchester, UK.

Does anyone know how I can get rid of this infected file?:

C:\Windows\System32\Process.exe - Win32/PrcView application - error while deleting (Access denied)

The "clean" and the "delete" buttons only give: "Error while cleaning - access denied". This leaves the third and last option - "Leave". Obviously, this is not satisfactory. How can I remove this file?

Terry.

Try ending the task in the task manager if its running then run the scan again. May or may not work but worth a try.

[dr pan k]

use ultimate process manager and portable killbox. (google them) both free..

[lodore]

hello terry sleeper,
can you post a screenshot?
i assume you are using nod32 version 2.7?
make sure you have your license code username and password avaliable before you do the following.
just go to www.eset.com login with username and password and download nod32 3.0
if so it is a good idea to uninstall reboot and install version 3
then update it and run a scan.
it should be able to clean it.

[Kosak]

Hello!

Terry, have you used "SDFix" before?

[Marcos]

Win32/PrcView application is a legit tool that can be used kill running processes. I guess it can't be deleted because it's in use. There are legit cleaners that have it bundled and use it to kill running malware.

[Terry Sleeper]

Thanks for the replies.

1. I will try the Task Manager option.
2. ditto ultimate process manager and portable killbox.
3. I am using NOD32 version 3.0.650.0. Will try to post a screenshot, but everything is slowing down!
4. I have used SDFix before - many moons ago!
5. Am now getting pop-ups from gambling websites.

Terry.

[Marcos]

A log from ESET SysIspector would shed more light. Please send it to samples[at]eset.com with this thread's url in the subject.

[Kosak]

Originally Posted by Terry Sleeper

4. I have used SDFix before - many moons ago!

So, part of this cleaning tool - process.exe will be detected. Check this log:

Scan Log
Version of virus signature database: 3247 (20080707)
Date: 7. 7. 2008  Time: 22:22:11
Scanned disks, folders and files: D:\SDFix.exe
D:\SDFix.exe » RAR » SDFix\apps\Process.exe - Win32/PrcView application
Number of scanned objects: 83
Number of threats found: 1
Number of cleaned objects: 0
Time of completion: 22:22:15  Total scanning time: 4 sec (00:00:04)

[Terry Sleeper]

Marcos:

Thanks - have taken your advice.

Kosak:

Sorry - I don't understand. And everything is grindingly slow now . . .

T.

[Kosak]

Process.exe will be probably part of SDFix.

You are infected with adware. Wait for ESET's response.

[Terry Sleeper]

Dear All:

Thanks for your help and suggestions.

I did manage to clean everything with help from Bill Castner at AUMHA Forums.

Terry.