Keeps saying "some program using it". How to delete??

The "msagent" directory itself is a valid part of Windows, so don't delete other files there. It is used to display those animated icons (such as the dog when you do a search for files, or the Office paper-clip). See:

 http://www.microsoft.com/msagent/default.asp

OK, I can see why some people may not consider that feature all that useful :)

To check what program might be using a file, you can use FileMon:

 http://www.sysinternals.com/Utilities/Filemon.html

However, it is for somewhat advanced users. It is probably much better initially to run HijackThis amd see what might be infecting your system.

Greetings, letsk77!

To go along with what r-k said, download HijackThis

http://www.hijackthis.de/

Run the program and you will find many entries. Most are OK. Post the log at the Hijackthis forum and clcik Anaylze, Save.  Post a link to the saved list here.

In the analyzed log, have HJT remove all items marked "Nasty" and "Unnecessarily".

Look at the items marked "Possibly Nasty" and "Unknown".  If you do not recognized them, have HJT delete them.

Cheers!

Thanks r-k. Below is the log for HJT scan, and I can see one of the line is
O20 - Winlogon Notify: dllav - C:\WINDOWS\msagent\dllav.dll
which is the file I want to delete (dllav.dll). So what next? Should I try check this box O20 and "Fix checked"?

By the way, i can't see the security tab coz I'm using XP pro, but when I go to Tool>Folder Options, I can see my "Use simple file sharing" option is not checked already.
----------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 9:06:48 AM, on 7/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\it2\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 45234
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\msagent\dllav.dll
O3 - Toolbar: (no name) - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - (no file)
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [5rHNeh6jQ] C:\WINDOWS\deiqby.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DVDXGhost] C:\Program Files\DVD Ghost\DVDGhost.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office PRO\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O20 - Winlogon Notify: dllav - C:\WINDOWS\msagent\dllav.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Here is a link to the analyzed log

http://hijackthis.de/logfiles/0b4f363c74f459d68497a926695f7254.html

Have HJT remove all items marked  and "Unnecessarily".

Look at the items marked "Possibly Nasty" and "Unknown".  If you do not recognized them, have HJT delete them.

At least one of the unknown is the file you referred to.  Look at the other unkown items.

O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\msagent\dllav.dll

Have HJT remove this BHO and any other ones you find.

Actually, that dllav.dll occurs in two places in your HijackThis log. Use HiJackThis to try and fix both those entries.

Then, reboot, and run HijackThis again, and see if the entries are still gone. If so, you should be able to delete the dllav.dll file itself.

As an aside: Are you saying that you have XP Pro, and you have un-checked the "simple file sharing" option, and you still don't see a security tab when you look at the Properties of any file?

I would also suggested removing the two O3 Toolbars, plus the O23 r_server.exe service.

The rest looks OK.

thanks war1. I didn't see any "remove" or "delete" button, only "fix checked". Is that how you delete the checked file? I tried to check the two "Unnecessarily" toolbar, and two "unknown" BHO dllav and Winlogon dllav file. When I click at "fix checked", it only delete the two toolbar
O3 - Toolbar: (no name) - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - (no file)
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)

The BHO and Winlogon file still appear after I reboot and scan again:
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\msagent\dllav.dll
O20 - Winlogon Notify: dllav - C:\WINDOWS\msagent\dllav.dll

To r-k, yes, I didn't see the security tab, so I go to the folder option hoping to uncheck the "use simple file sharing" check box. But when I open the folder option, i found that it was already unchecked!

further assistance needed! Thank you!

It came back.  Try deleted the file in C:\WINDOWS\msagent\dllav.dll in Safe Mode.

I would suggest downloading and using Killbox to try and get rid of that file. You can download from: http://www.scancomplete.com/download/killbox/

Instructions for using it are also there.

There is a slight chance the file may come back even after that. So reboot and see if it does come back. In that case post back for further advice.

Re. the missing Security Tab, it might be that your disk is formatted not for NTFS, but FAT32. When you get a chance, can you confirm that by opening "My Computer", then right-click on the C: drive and select "Properties". Under the "General" tab, the item "File System" should show what type of disk format you have. NTFS allows setting permissions on files, FAT and FAT32 do not.

r-k, yes, my file system is FAT32, not NTFS. Ok, i'll try the Killbox

war1, i tried before go into Safe Mode to delete it, but it still give me same message "...it is being used by another person or program...". You mean after use the HJT to fix the file, I try to go Safe mode and delete again?? Somehow I feel that the result will still be the same. But I'll still try it though.

r-k, i just tried to use KillBox. I browse to the full path of that file C:\Windows\msagent\dllav.dll. When I click at the delete file button, it waits a while and give me a message "This file could not be deleted"!!

What a stubborn file!!!

Did you try to delete the file in Safe Mode?

war1, i tried but failed. I tried both "Safe Mode" and "Safe Mode with Command Prompt". In Safe Mode, it gives me same message "some other program using it...". In Safe Mode with Command Prompt, it says "cannot delete the file".

By the way, I use the Filemon.exe that r-k recommend, and I can see it is this program Winlogon.exe that using the stupid dllav.dll file. Below is the log.

WINLOGON.EXE:504      OPEN      C:\WINDOWS\msagent\dllav.dll      SUCCESS      Options: Open  Access: All      
WINLOGON.EXE:504      QUERY INFORMATION      C:\WINDOWS\msagent\dllav.dll      SUCCESS      FileFsVolumeInformation      
WINLOGON.EXE:504      QUERY INFORMATION      C:\WINDOWS\msagent\dllav.dll      SUCCESS      FileInternalInformation      
WINLOGON.EXE:504      QUERY INFORMATION      C:\WINDOWS\msagent\dllav.dll      SUCCESS      Length: 419348      
WINLOGON.EXE:504      CLOSE      C:\WINDOWS\msagent\dllav.dll      SUCCESS            

I can see every few minutes it will go through this process "Winlogon.exe Open dllav.dll> Query dllav.dll> Close dllav.dll". I checked on this winlogon.exe, and i found that this is crucial for windows system. I tried to rename this winlogon.exe to winlogon.ex1, I cannot reboot into my windows anymore!!! Luckily I have the XP Pro CD, and able to go into the command prompt, and rename back to .exe.

Seems like i can't do anything to this winlogon.exe. Then how am I going to stop this file from using the stupid dllav.dll, and hence let me delete it???

I wish I could increase the points, but this is all I have. I definitely owe you guys one if you could help me go through this.

hey r-k, I found that the File Monitor is quite a good software to track the dll file usage. Thanks!!

Do a search for the file in registry, win.ini file, and temp folders, and delete it if you find the file.

Don't delete or rename Winlogon.exe, that is a crucial Windows file. Instead try one of the following:


(1) Boot into safe mode with command prompt. Then CD to the \windows\msagent folder, a nd delete the file as follows:

 cd \windows\msagent
 atrrib -s -h dllav.dll
 del dllav.dll

and then reboot.

OR

(2) Open the Registry editor (Start -> Run -> regedit), then browse on over to the following key:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

within that if you open each subkey, you will find one that references dllav.dll. Delete that sub-key. Don't delete the wrong key!

Next, still within Regedit, lolcate the following key:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

and within that, there should be a sub-key named: {B8B55274-0F9A-41E5-9067-A3539BD9E860}. Delete that sub-key, don't delete the wrong ones!

Finally, reboot, and after that you should be able to delete the dllav.dll file.

There is also a third way, which I can suggest if all the above haven't fixed it yet.

Minor change to the above. The atrrib command should really be:

  attrib -r -s -h dllav.dll

r-k, i hate to say...actually i tried both ways before you tell me. The Safe mode with command prompt, I did use the attrib -r -h -s dllav.dll before using del dllav.dll. But it still give me "The process cannot access the file because it is being used by another process".

Regedit thing, I search through the whole registry (F3 F3 F3) for this "dllav.dll" file. I backup every key and then delete it. But whenever after I reboot, those deleted registry key will be back into the same place!!! Below are the keys I delete:

[HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dllav]

Right after I delete these keys, I go to the directory c:\windows\msagent hoping to delete the dllav.dll, after it gives me "another program using it" message, i went back to check the registry, it is again inside the same location.

I notice that in the keys you deleted, it does not include the second one I suggested:
>>>
Next, still within Regedit, lolcate the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

and within that, there should be a sub-key named: {B8B55274-0F9A-41E5-9067-A3539BD9E860}. Delete that sub-key, don't delete the wrong ones!
<<<

You have to delete both keys, otherwise one will recreate the other. The other key to delete is:
>>>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dllav]
<<<

You have to delete both keys, then reboot, then delete the dllav.dll file itself from disk.

However, if the above does not fix it, then it is possible there is another program running that is recreating these keys. I noticed a program named SOUNDMAN.EXE running, which is a bit suspicious. Can you locate it in the c:\windows folder, right-click on it, select "Properties", then the "Version" tab. It should tell you who the author of that program is. Please post it here.

Second, can you do the following:

Open a Command Window, then:

> tasklist /svc > list.txt

this will save a list of running processes in a text file named list.txt. Please use Notepad to cut and paste that list here. Thanks.

I did delete the explorer browser helper key also, but still the dllav.dll was re-created.

Soundman.exe version tab info is as follows:
Version: 5.1.0.0
Description: Realtek Sound Manager

Other information
Comment: Realtek AC97 Audio Sound Manager
Company: Realtek Semiconductor Corp
File Version: 5.1.00
Internal Name: ALSM Tray
Language: English (United States)
Original File Name: ALSMTray.exe
Product Name: Realtek Sound Manager
Product Version: 5.1.00

Tasklist info is as follows:
Image Name                   PID   Services                                    
========================= ======
System Idle Process            0   N/A                                          
System                              4   N/A                                          
SMSS.EXE                       320  N/A                                          
CSRSS.EXE                     480  N/A                                          
WINLOGON.EXE               504  N/A                                          
SERVICES.EXE                548   Eventlog, PlugPlay                          
LSASS.EXE                     560   PolicyAgent, ProtectedStorage, SamSs        
SVCHOST.EXE                700   DcomLaunch, TermService                      
SVCHOST.EXE                768   RpcSs                                        
SVCHOST.EXE                836   AudioSrv, BITS, CryptSvc, Dhcp, dmserver,    
                                             ERSvc, EventSystem,                          
                                             FastUserSwitchingCompatibility, helpsvc,    
                                             lanmanserver, lanmanworkstation, Netman,    
                                             Nla, RasMan, Schedule, seclogon, SENS,      
                                             SharedAccess, ShellHWDetection, TapiSrv,    
                                             Themes, TrkWks, W32Time, winmgmt,wscsvc,    
                                             wuauserv, WZCSVC                            
SVCHOST.EXE                892   Dnscache                                    
SVCHOST.EXE                924   LmHosts, RemoteRegistry, SSDPSRV, WebClient  
ccSetMgr.exe                1084   ccSetMgr                                    
ccEvtMgr.exe                 1152   ccEvtMgr                                    
SPOOLSV.EXE               1280   Spooler                                      
DefWatch.exe                1604  DefWatch                                    
MDM.EXE                     1640   MDM                                          
Rtvscan.exe                  1704  Symantec AntiVirus                          
ALG.EXE                        188   ALG                                          
EXPLORER.EXE             1376   N/A                                          
SOUNDMAN.EXE           1580   N/A                                          
igfxtray.exe                  1712   N/A                                          
hkcmd.exe                   1680   N/A                                          
gcasServ.exe               1600   N/A                                          
jusched.exe                 1792   N/A                                          
ccApp.exe                   1928   N/A                                          
VPTray.exe                  1092   N/A                                          
PDVDServ.exe               604   N/A                                          
msnmsgr.exe                956   N/A                                          
CTFMON.EXE                336   N/A                                          
gcasDtServ.exe             248   N/A                                          
IEXPLORE.EXE              2440  N/A                                          
OUTLOOK.EXE              2628  N/A                                          
winword.exe                2756  N/A                                          
IEXPLORE.EXE              3388  N/A                                          
cmd.exe                      3708  N/A                                          
wmiprvse.exe              3912  N/A                                          
tasklist.exe                    208  N/A                                          

The SOUNDMAN.EXE is a legit application, so you can leave that alone.

Interestingly, there seems to be nothing wrong with anything you've sent except those two registry entries that are referencing dllav.dll, i.e:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
and
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dllav

I would have expected that if you delete both of these entries, and then reboot, it should then allow you to delete dllav.dll itself. However, your experience is otherwise (are you quite sure you deleted _both_ before rebooting?)

Given that, you can try the next step, which is to start your computer from the XP CD in "recovery console mode", then delete dllav.dll, then start in normal mode.
The steps for entering recovery console mode are described here:
 http://www.wown.com/j_helmig/wxprcons.htm

Basically you end up in a DOS-like window, after which you can use "cd..." to move to the windows/masagent folder, then delete the file, i.e.:

 cd \windows\msagent
 attrib -s -h -r dllav.dll
 del dllav.dll

and then reboot in normal mode.

After that you can check whether the file is really gone. Hopefully it will be.

I'm sure I delete the things you asked me to. In fact, you asked me to delete two place in regedit, but I found several more other places that has dllav.dll and {B8B55274-0F9A-41E5-9067-A3539BD9E860}. Hopefully this info would give you more clues in troubleshooting:

I search through the whole registry for {B8B55274-0F9A-41E5-9067-A3539BD9E860} and it was found below places (some of them are key, some are subkey and some are value:
[HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[HKEY_CLASSES_ROOT\MSEvents.MSEvents.1\CLSID]
@="{B8B55274-0F9A-41E5-9067-A3539BD9E860}"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
@="MSEvents Object"
"AppID"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents.1\CLSID]
@="{B8B55274-0F9A-41E5-9067-A3539BD9E860}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[HKEY_USERS\S-1-5-21-1644491937-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

I search through the whole registry for dllav.dll, and it was found in below places:
[HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}\InprocServer32]
@="C:\\WINDOWS\\msagent\\dllav.dll"
"ThreadingModel"="apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}\InprocServer32]
@="C:\\WINDOWS\\msagent\\dllav.dll"
"ThreadingModel"="apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dllav]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\msagent\\dllav.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"


I basically delete ALL THESE, reboot, go to my computer C > WINDOWS > MSAGENT, click at dllav.dll, hit delete key, it still gives me the "other program using it", and when I go to regedit, ALL THESE back to the original place!!

Since it has something to do with winlogon.exe, is it because whenever I key in password and hit enter, all these keys is re-generate?? Coz whenever I start my XP, eventually i'll come to the choose user screen. I click at my user account, a password field will appear and i'll need to key in password. Is this process done by winlogon.exe?? Is this anything related to the issue??

Yes, the key:

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dllav

means that whenever you log-in, that particular program is called, so it becomes "in use" whenever you're logged in, and so cannot delete it.

Did you try my other tip about starting from the CD and then deleting the file? That should always work.

letsk77:

Hope you haven't given up. Try the following:

Start your computer from the XP CD in "recovery console mode", then delete dllav.dll, then start in normal mode.
The steps for entering recovery console mode are described here:
 http://www.wown.com/j_helmig/wxprcons.htm

Basically you end up in a DOS-like window, after which you can use "cd..." to move to the windows/masagent folder, then delete the file, i.e.:

 cd \windows\msagent
 attrib -s -h -r dllav.dll
 del dllav.dll

and then reboot in normal mode.

After that you can check whether the file is really gone. Hopefully it will be.

busy this few days. I think I tried that before as well. Remember, during the time when I rename the 'winlogon.exe' to winlogon.ex1, after I reboot, it keeps rebooting and won't reach the "logon" screen. I have no choice but use the XP CD to goes to the "DOS-like" windows to rename back the winlogon.exe. So since i'm there, i tried to delete the dllav.dll. But after I reboot back into the windows, i found that the file is not deleted.

Perhaps i'll try again later. But not these few days. Too busy on something else. Thanks for your assistance first. Appreciated much!

Some files regenerate itself.  Delete the dllav.dll file in DOS.   But instead of rebooting, do a hard shutdown of the computer. That is, shut the computer down, and remove the plug from the wall for at least 10 seconds.  Now after booting up, is the file gone?

It looks like there is some "hidden" process that is creating that file even after you delete it. I would suggest trying RootkitRevealer from:

 http://www.sysinternals.com/Utilities/RootkitRevealer.html

and scan your hard drives. If not sure how to interpret the output, cut and paste it here.

r-k, you said ""hidden" process that is creating that file even after you delete it", but i think i never tried deleted it successfully even once. Everytime when I tried to delete either it gives me "another program using it" or in DOS "The process cannot access the file...". The thing I manage to delete is those registry key, but the key was regenerate after reboot (some of them was regenerate after I hit "delete" on that file).

The RootKitRevealer i'll try later. Also, the hard shut down suggest by war1. But war1, again, I can't delete it even in DOS.

One of my friend do suggest me create a new profile and try to delete it. I'll also try that out later.

There's a program called IsUsedBy by MST Software (www.mstsoftware.com).  You can download the trial version, drag the file into the program, and it will tell you what process(s) are using the file.  Not sure if this will help you, but I've found it handy in a few instances.  If there is some program watching the file to see if it is ever deleted, this should detect it.

FETI

If all else fails, try this one:

http://www.diamondcs.com.au/index.php?page=dellater

r-k, finally i deleted in the recovery console. But I don't understand, i tried that before, but this time ok.

caza13, i did try the dellater.exe. I download the file, unzip it, then open the RUN menu, drag the dellater.exe into that run box, and then type full path file name behind it. Basically it looks like "C:\Documents and Settings\it2\desktop\temp\dellater.exe" C:\WINDOWS\msagent\dllav.dll
After i click RUN, it says "the file was marked to be deleted on reboot". After I restart, i go back to that location (C:\windows\msagent), i saw that the file is still there. But when i try to run the same command again in the RUN, it gives me "file not found". After yours is fail, then only i try r-k suggestion again. And weird enough, this time succeeded!

Thanks for all your effort!!!

Glad it finally worked. Thanks for the feedback.