I can't delete, clean or quarantine the Trojan file EXPLOIT-ANIfile?

Question

Because it says it is write-protected? What can I do to get rid of it?
I use Windows XP Home Edition. Thanks.

Answer that works gets 10 points.

Answer 1

Oh cripes don't do what that other guy said and try to run the file!

The reason that you can't delete it is because Trojans are really tricky things.

When a program on your computer is running, it keeps a list of files it's using and you can't delete those files.

So, what a trojan does, is, when your computer starts up, it adds itself to that list of an important running program that you can't stop. So a trojan is not something you can remove manually.

Unfortunately removing trojans can be pretty tricky and multi step. The only truly reliable information I know about trojans is to go to this support forum and go through the steps on this page one at a time:
http://forums.majorgeeks.com/showthread.php?t=35407

This is expert advice, and if you follow it and still have a problem, then the guys at major geeks will be happy to go through and help you personally.

Answer 2

If an attempt is made to view an ANI file containing this exploit, the viewing application will crash and it will keep holding the ANI file open - that's why it cannot be renamed or deleted.

To fix the problem, install the Unlocker from the link below. It's a shell extension. Then, in Windows Explorer, right-click on the offending ANI file and select Unlocker from the menu that pops up. Then follow the instructions to unlock and delete the file.

Answer 3

Trojans are not that bad, it all depends whop designed it. The worst was worm that got me several years ago, I had to literally blank out total memory to rid that bastard. You learn as you go.

Close all your doors trap it and wash it out. Keep in mind that if that trojan gets into your system at full impact....the result can be nasty and the cure is one big mess for an amateur.

Answer 4

This file is associated with a SmitFraud Trojan and need a special program to remove it. These two site have free Smitfraud removal programs and procedures. This should get rid of it for you.

http://www.internetinspiration.co.uk/roguefix.htm

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

This Smitfraud can add other garbage, so I recommend you do these steps and run these additional programs to ensure your computer is clean.

This procedure works for all Malware. Use any AntiVirus or AntiSpy program you choose.

Download and Update Ewido (now called the AVG Antispyware). Do not run:

http://www.ewido.net/en/download/...

Download AdAware SE and update. Do the setup. Do not run:

http://www.filehippo.com/download_ad-aware/

AdAware SE Setup:

1. Select "use custom scanning options" then select "customize". Make sure the following options are enabled: "scan within archives," "scan active processes," "scan registry," "deep scan registry," "scan my IE favorites for banned URLs," "scan my Hosts file."

2. Select the "tweak" option. Under "scanning engine," make sure "unload recognized processes and modules during scan" is enabled. Enable "scan registry for all users instead of current users."

3. Under "cleaning engine" turn on "always try to unload modulesâ€Â¦," "during removal unload explorer and IE if necessary," "let windows remove files in use at next restart," and "delete quarantined items after restoring."

4. Use the "select drives and folders to scan" option to ensure that your entire hard drive is scanned (if you have more than one hard drive, scan all of them (of course, do not include floppy and CD/DVD).


TEMPORARILY SHOW HIDDEN FILES AND FOLDERS.

1. Click Start, and then click Control Panel.

2. Click Appearance and Themes, and then click Folder Options.

3. On the View tab, under Hidden files and folders, click "Show hidden files and folders", and clear(uncheck) the "Hide protected operating system files" check box.

IMPORTANT: Files are hidden by Windows for a very good reason. It is not wise to experiment with these files. Unfortunately, to successfully remove modern spyware we must turn this protection off temporarily. Please turn the protection back on when you have finished cleaning your system.


EMPTY INTERNET EXPLORER BROWSER CACHE:

1. On the Internet Explorer Tools menu, click Internet Options.

2. On the General tab, in the Temporary Internet Files section, click the Delete Files button. Select the Delete all offline content check box in the confirmation dialogue box that appears, click OK. Click OK again.

RESTART IN SAFE MODE:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.



START THE SCAN WITH YOUR ANTI-VIRUS OR ANTI-SPYWARE PROGRAM.


When the scan and removal are completed REBOOT COMPUTER. This will restart you in normal mode. DON'T FORGET TO RESET HIDDEN FILES AND FOLDERS.


NEW RESTORE POINT.

The RESTORE POINTS may be infected with the Malware and cannot be used.

HERE'S HOW:

1. Click Start, and then click Control Panel.

2. Click Performance and Maintenance, click System, and then click on the System Restore tab.

3. Select the Turn Off System Restore check box, click Apply, then restart your computer.

4. Return to the System Restore Tab and turn System Restore back on.


TO SET A NEW RESTORE POINT:

1. Click the Start button.

2. Point to Programs, then navigate to Accessories, then System Tools, then click System Restore.

3. Choose Create a restore point, and then click Next.

4. In the Restore point description box, type a name for your restore point, and then click Next.

5. Click OK.

NOTE: If you are using Windows XP Service Pack 2 (SP2) and are unable to access the Internet after removing Malware, there is a command that may fix the problem. It works by resetting the winsock catalogue. Click on Start, then Run and type CMD in the box. Click OK. Type "netsh winsock reset" (no quotes)into the DOS window that appears.

Answer 5

right click->properties->uncheck read only

if you haven't tried on your own to find the file, forget my instructions and just double click on the file and run it if it's an exe. that'll probably sort you out.

Answer 6

use spyware doctor download it from www.downloads.com and install it and update it then go to www.serials.ws and get a key for it and activate it DONT ACTIVATE IT BEFORE UPDATIN IT and scan good luck