HELP! W32.Pinfi HOW TO REMOVE!!

windows ME Hp  

W32.Pinfi <-- DIsabled all anti virus, firewall, and other software, and is taking over hard drive i need urgent HELP!!! est. time left 1 hr.!!!!!!


Pc Expert2007
LVL 1
PC-Expert2007Asked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
Alien3Connect With a Mentor Commented:
I had this virus before and I never had to reformat.

This tut is written for Norton Anti-Virus system-administrator users using Windows XP.

1. Press CTRL+ALT+DELETE and close as much as processes as possible. Like Winamp, MSN, IRC and any other filename you find suspicious.

2. Open your NAV and make sure it still works properly. If it doesn't it's probably touched by the virus, so uninstall it, and install it again.

3. Reboot in SAFE MODE (for Windows XP user: Goto START > RUN and type in "msconfig". Press enter. On the "Boot.ini" tab check the "/SAFEMODE" option. Press OK and if it asks for reboot, do it.)

4. Start your NAV and do a full system scan. This may take a while. It will repair all the EXE's (in good cases) but one or more .tmp files are still infected and failed to repair: Quarantine them and delete them after that in the Quarantined Items list. The virus should now be totally removed from your PC.

5. Reboot in NORMAL MODE (for Windows XP user: Goto START > RUN and type in "msconfig". Press enter. On the "Boot.ini" tab uncheck the "/SAFEMODE" option. Press OK and if it asks for reboot, do it.)

6. Use regedit.exe to delete the key "PINF" located in " HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre
ntVersion\Explorer"

0
 
nicoricCommented:
Did you try starting in safemode and doing a search and deleting any files associated with it?
0
 
nicoricCommented:
Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode (Windows 95/98/Me/2000/XP) of VGA mode (Windows NT).
Run a full system scan and repair all the files detected as W32.Pinfi.
Reverse the value that the virus added to the registry.

0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
nicoricCommented:
please disregard first solution as it affects .exe files.
0
 
PC-Expert2007Author Commented:
I have found the virus Main part, but i cant delete it,  i have tried refabercating the hard drive, windows ME it's self. its stuck right in the Explorer folder, the most important folder, once i download any anti virus, WIN PINFI destorys the important files of the antivirus I went in SAFE mode, and it went undetected and i could not remove it, it is boosting my MB of Ram to the maximem amount which is 900 Mb by idleing, Any comments?
0
 
Big5250Commented:
Not sure which of these steps you have tried:

http://securityresponse.symantec.com/avcenter/venc/data/w32.pinfi.html
0
 
KgenisCommented:
PC-Expert2007, I could write you a tool to remove the virus if you like. Then all you would have to do is run it in safe-mode. However, from what I've read. The virus seems to be remaining in memory via a registry key. Following these steps from Big5250's link above will remove it from memory. After that you should only have to delete the folder it creates.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit, and then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer


In the right pane, delete the value: PINF
Exit the Registry Editor.

After this, run a search on your computer by clicking Start - Search - Find file or folders.
0
 
KgenisCommented:
in the containing text field type tmp. If your computer finds a file which is made up of: [3 random letters][4 random hexadecimal digits].tmp - delete it and restart. Make sure you have removed the registry key and re-logged on to remove the virus from resident memory.

Greetz.
Matt.
0
All Courses

From novice to tech pro — start learning today.