Options

need help w/ bestfriends.scr

Unknown
edited July 2004 in Spyware & Virus Removal
i was following the steps with your bestfriends.scr removal guide, when i came to a step that i can't do. after identifying the files that was causing the virus, i then rebooted in safe mode and tried to run "cmd". but, my computer doesn't recognize that program, or something because i can't access it. help?

Comments

  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited July 2004
    type "Command" instead of "cmd".
  • TheSmJTheSmJ
    edited July 2004
    Perhaps I could modify the guide a bit for use with W9x OSes...
  • oxiclean
    edited July 2004
    thanks guys!
  • oxiclean
    edited July 2004
    okay, on step 8, part 2 of the updated removal guide...
    i entered "cd %systemroot%\system32" (excluding quotation marks)
    ..and i get: invalid directory (?)

    also, the evil files that i found via HJT are:

    C: \windows\system\MSGINAV.EXE

    HKLM\..\Run:[Microsoft Gina V Encryption] MSGINAV.EXE

    HKCU\..\RunOnce:[Microsoft Gina V Encryption] MSGINAV.EXE

    now, after i get the step 8, part 2 problem solved, my question is, do i type the entire file names (step 8, part 3), including the C:, HKLM, HKCU, and all the stuff in the brackets?
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited July 2004
    just the short name (msginav.exe)

    and try just c:\windows or c:\windows\system\ instead of \system32.
  • TheSmJTheSmJ
    edited July 2004
    You could also do a search for these files (Start > Search > Files and Folders). Or, you could go into Windows Explorer, go into the System32 directory, and delete the files from there.

    I'm working on a Batch file which would do all of this for you... dunno when it will be done though as my batch file making skills have gone 8 years unused...
Sign In or Register to comment.