kaspersky cant delete

catford

kaspersky found the same infected file on my pc as avast but neither can remove or delete it.the problem is -rootkit.win32.agent.q.is this because i'm only using trial versions?? this virus is driving me nuts i never know if i'm going to get booted or not!!!

-TangleFoot-

Last time I checked avast! was free for home use... but that's besides the point. Apparently, the best way to get rid of a so-called 'root kit' is to format and reinstall. This just isn't your week, is it?

Here's what I could dredge up about this particular nasty with a quick Google:

• Kaspersky Labs Forum -> trojan rootkit.win32.agent.q
• eTrust Spyware Encyclopedia - TrojanDownloader.Win32.Agent.q

Have you tried an online scanner, such as Housecall or Panda ActiveScan? The former is pretty good at dealing with trojan software.

There was also a post concerning free eTrust anti-virus and anti-spyware software recently... aha! Here it is. They're not the latest versions though, so I'm not entirely sure whether they'll deal with it either.

catford

your not wrong tanglefoot! its been a s**t week and its going from bad to worse!I've looked at your post and read some of the info- not good news- so tomorrow we begin.thanx again . " time for a nightcap --a big one"

catford

re ran the antivirus scan today but it will not remove rootkit win 32 because ,--"you have no access rights or access is denied" i dont understand this? how do i get access rights then??what do i need to change??help please???

-TangleFoot-

Hmm... apart from the format and reinstall, I haven't the foggiest what would work for sure, but you could try running a virus scan from a LiveCD such as the Ultimate Boot CD or UBCD4Win.

blinky

Try running Kasperky in safe mode. It probably cannot delete the file as it's running.

catford

I e mailed kaspersky support who said to scan in safe mode--that still found virus but put it in the back up cos its write protected.what does that mean??

T4i

Write protected means you cant alter/modify/delete the file. Its read-only.

Do you know where and what the write protected file is called?

catford

they are the 2 files with problems 1-C:\prog files\wpssqsrt\ZMQCBkBL.dll 2-C:\winnit\sys32\driver\winik.sys---this has trojan rootkit agent q. so who/what can alter these files apart from a reformat.??

T4i

format is the last resort.....we are far too knowlageable on here for that to happen

Anyway back to the question.....anybody?

T4i

Try this...

In safe-mode open cmd/command. Go to the folder the file is in.
1) C:\prog files\wpssqsrt\
2) C:\winnit\sys32\driver\

At the prompt type:
1) attrib -r -s ZMQCBkBL.dll
this will remove readonly and system file attributes from the file. then try to delete it by typing
del ZMQCBkBL.dll

Same for 2).

If that doesnt work you may need something like http://www.sysinternals.com/ntw2k/freeware/procexp.shtml to see whats using the .dll and .sys file.

Are you running XP?