Can I safely delete this file?

[dOrKuS]

hey all, i know this is probably not the right forum but you OT'ers are the only ones up at this hour. i just got some virus where my homepage has been changed from about:blank to some other site, and i can't change it back. so i installed norton anti-v and it came up w/ one infected file that it can't quarantine. it's MSWINUPD.EXE. i assume it's the windows update exec, not too much detective work there, can i delete it?

 

[Johnnie]

looks like a virus file

 

[S0me1X]

In Windows 2000, the windows update exec is named "wupdmgr.exe"

 

[dOrKuS]

ouch, i deleted it and clicked "finish"

NAV tells me your computer is still infected with viruses and then it closes....time for another scan!

 

[S0me1X]

forgot to add... i don't see a mswinupd.exe in my windows 2000 partition.

 

[rutchtkim]

I would delete all infected files if possible, u can always re-extract them from cab files

 

[dOrKuS]

ok, i can't delete the file either. the virus name is "backdoor.mosuc"

NAV says it's in the WINNT folder but when i do a search on the drive the file does not show up

 

[n0cmonkey]

Backup Format Reinstall Restore.

Maybe next time you will be more careful about what you do on your machine.

 

[ricerx]

<< ok, i can't delete the file either. the virus name is "backdoor.mosuc"

NAV says it's in the WINNT folder but when i do a search on the drive the file does not show up >>

]

the file may be hidden. go to your windows explorer (not IE) and select tools, folder options, view. then check "show hidden files and folders" and uncheck "hide protected operating system files" now see if it's there.

 

[dOrKuS]

thanks ricerx, i didn't think about the "hide protected operating system files option"

after 10 NAV popups every 1/2 second i finally was able to delete it, just ran another scan and no viruses showed up

i still can't change my homepage back to blank

guess a reboot wouldn't hurt, see ya in a few

 

[dOrKuS]

welp, rebooting didn't fix it, though i wasn't too hopeful. thank god i ghosted an image of the drive before this happened. if you get any ideas please lmk, here or pm. goodnight all

 

[ricerx]

no problem dOrKuS. it's always the simplest things we all forget. here's a link to symantecs site about your virus and how to correctly remove it.

NAV good luck and happy holidays

 

[yakko]

It is part of Mosucker.