1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Virus has left a locked file

Discussion in 'Virus & Other Malware Removal' started by NWarner, Feb 21, 2006.

Thread Status:
Not open for further replies.
  1. NWarner

    NWarner Thread Starter

    Nov 18, 2003
    My father's computer got a virus called Trojan.Alemod as well as a few other worms.

    I feel like the computer is mostly clean now and the only remaining corrupt file is C:\Windows\System32\Wininet.dll

    SAV tells me repeatedly that it is infected with a virus and then cannot quarantine or delete it. I cannot manually move or delete it or overwrite it with a copy of the file from my computer nor is it labeled as read only.

    What utility or command do I need to run to be able to bypass this 'lock' on the file? I seem to have avoided the need for a reformat at this point and would hate to do so only to recover this one file. I might ignore the problem except that the anti-spyware program and SAV cannot seem to connect to download updates.
  2. MFDnNC


    Sep 7, 2004
    You will need to boot to safe mode and navigate to the C:\Windows\System32
    folder and rename the infected wininet.dll file to wininet.old then go to the
    C:\Windows\System32\dllcache folder and copy the wininet.dll file there then
    paste it in the system32 folder replacing the infected one you renamed.
    After it has been replaced restart your computer and then delete the
    wininet.old file.
    Click here to download HJTsetup.exe: http://www.thespykiller.co.uk/files/HJTSetup.exe
    Save HJTsetup.exe to your desktop.

    Double click on the HJTsetup.exe icon on your desktop.
    By default it will install to C:\Program Files\Hijack This.
    Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
    Put a check by Create a desktop icon then click Next again.
    Continue to follow the rest of the prompts from there.
    At the final dialogue box click Finish and it will launch Hijack This.
    Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    Click Save to save the log file and then the log will open in notepad.
    Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    Come back here to this thread and Paste the log in your next reply.
    DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
  3. NWarner

    NWarner Thread Starter

    Nov 18, 2003
    Thank you for your previous response... In the excitement of getting my father back online I forgot to come back to say it worked.

    Since then, he has received no additional virus warnings or the like, but he can no longer access sites that require a secure connection (purchasing, accoutn status, etc.). Could it be that using the fresh DLL file had another effect on Windows' ability to go to secure web sites?

    Thanks again!
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/444497

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice