cannot delete msinstl.exe virus/trojan

Discussion in 'Virus Information' started by =?Utf-8?B?c2Fya2Fy?=, May 23, 2005.

  1. i have got MSINSTL.exe virus in my "c:/ documents and settings/all user/
    documents " folder. But it does not allow me to access the content , delete
    or copy it.

    How do I get rid of it?

    I have tried
    1. to do so in safe mode.
    2. command line
     
    =?Utf-8?B?c2Fya2Fy?=, May 23, 2005
    #1
    1. Advertisements

  2. From: "sarkar" <>

    |
    | i have got MSINSTL.exe virus in my "c:/ documents and settings/all user/
    | documents " folder. But it does not allow me to access the content , delete
    | or copy it.
    |
    | How do I get rid of it?
    |
    | I have tried
    | 1. to do so in safe mode.
    | 2. command line
    |


    I can't fully tell but it looks like the fully qualified path is..

    C:\Documents and Settings\All Users\Documents\MSINSTL.EXE

    The instructions I suggest NEED to use the fully qualified path to; MSINSTL.EXE

    Dump the contents of the IE Temporary Internet Folder cache (TIF)
    Start --> Settings --> Control Panel --> Internet Options --> Delete Files

    Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
    Tools --> Options --> Privacy --> Cache --> Clear


    Download CLEAN.EXE from the URL --
    http://www.ik-cs.com/programs/virtools/clean.exe

    It is a self-extracting ZIP file that contains the Kixtart Script Interpreter
    { http://kixtart.org Kixtart is CareWare } three batch files, two Kixtart scripts, two Link
    (.lnk) files and a PDF instruction file.

    GETFILES.BAT -- For downloading (FTP) the files needed to run the McAfee Command Line
    Scanner. You may have to disable your FireWall or allow FTP.EXE to go through your FireWall
    to allow the FTP utility to download the needed files

    CLEAN.BAT -- For running within Windows after running c:\mcafee\GetFiles.BAT. If you choose
    to scan again at a future date, run this batch file. It will automatically check the date
    of the McAfee DAT files and if it is a couple of days old, it will download (FTP) the latest
    signature files and install them before performing the scan.

    DOSCLEAN.BAT -- For use on a Win9x/ME PC or on a Win2K/WinXP PC that is using FAT32 after
    you have booted from an Emergency Boot Disk or DOS disk and have already executed;
    c:\mcafee\GetFiles.BAT from within Windows. DOS disk boot images can be obtained from;
    http://www.bootdisk.com/bootdisk.htm

    I need you to perform the following...

    Execute; CLEAN.EXE
    Choose; Unzip
    Choose; Close

    Execute; c:\mcafee\GetFiles.BAT
    { or Double-click on 'GetFiles Link' in c:\mcafee }

    Download Pocket KillBox
    http://www.bleepingcomputer.com/files/spyware/KillBox.zip

    Extract killbox.exe from the ZIP file.
    Execute; KillBox.exe

    Click on Tools --> Select; Delete Temp Files.

    Choose; OK

    In the Full Path of File to Delete box, type the entire following line exactly

    C:\Documents and Settings\All Users\Documents\MSINSTL.EXE

    Select; Replace on Reboot
    put a check in the box "Use Dummy"
    Click The Red circle and a white X
    When prompted to Replace on Reboot, click YES
    If prompted to Reboot Now, Click YES
    Allow the PC to shutdown


    Reboot the PC into Safe Mode [F8 key during boot]

    Shutdown as many applications as possible !
    It would also help for you to read - "How to perform a clean boot in Windows XP"
    http://support.microsoft.com/kb/310353

    Execute; c:\mcafee\CLEAN.BAT
    { or Double-click on 'Clean Link' in c:\mcafee }

    A final report in HTML format called C:\mcafee\ScanReport.HTML will be generated. At the
    end of the scan, it will be displayed in your browser (Opera, FireFox or Internet Explorer).
    It is suggested that you move the report out of c:\mcafee before performing another scan.
    It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML
    report for each session.


    * * * Please report back your results * * *
     
    David H. Lipman, May 23, 2005
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.