deleteing c:\windows/system32\explorer.exe

[enrineer55]

symantec says the file explorer.exe is infected and cant be quarinteened or deleted. can i delete this file (c:\windows\system32\explorer.exe) where symantec says its located or will it make the system unusable.

the computer im working on shows the file in the system32 folder but the one im using to connect here
doesnt show one there.

if my research is right it should be ok, but as i dont have access to the install cd (if there is any on this dell) i dont want to crash it.

i'm hoping some of the more knowledgable people here will be able to help out.

thanks in advance

pete

edit xp with all sp's, symantec, adaware, spybot all up to date

 

[Relayer]

what virus is it?

 

[enrineer55]

w32.spybot.worm

ther was 300+ infected files plus popup and spyware and some other viruses but this is the last one i cant delete

thanks

 

[dawks]

Did you go to Symantec's, Nortons, or McAfee's site and look for a virus removal tool for your virus?

You should be able to safely delete that file, but note that there is probably a copy of it stored in C:\Windows\System32\dllcache also. Its there for Windows File Protection.

Deleting either one or both of the files while windows is running wont really work. Windows will just copy that file back to either spot.

The best bet is to use a virus removal tool for the specific virus. Or, use the Windows XP CD to boot into the recovery console (by pressing R after Windows Setup has started) then log in, and delete BOTH of the explorer.exe's in \System32\ and \System32\dllcache\

Explorer.exe is the Windows GUI, but is installed and ran from C:\Windows\explorer.exe by default and NOT C:\Windows\System32\.

 

[enrineer55]

will i be able to make it work if i slave the hard drive in another computer and either delete it or use noton to delete it? ive got another computer with xp using ntsf with a removeable hd rack that i use for file transfers that doesnt have much on it.

also norton doesnt have a removal tool for this.

thanks again

 

[Relayer]

http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

 

[enrineer55]

well, still trying to delete the file windows/ system32/explorer.exe.

norton cant delete it and i cant remove it in safe mode.

i can enable a recovery console on this machine but cant seem to get there on the infected machine. i get so far and it asks for a floppy. im going to make a startup disk for that machine if i can and see if that wiill work.

and thanks for the input so far

as an after thought im using a xp pro disk to try to access the recovery console on an xp home machine as thats all i have available

success, i think untill i do another scan

i ran a program called trojan remover on just that file and it deleted it.
and thanks again for all the input

enrineer55