Solved

HELP! W32.Pinfi HOW TO REMOVE!!

Posted on 2004-08-23
10
690 Views
Last Modified: 2012-06-22
windows ME Hp  

W32.Pinfi <-- DIsabled all anti virus, firewall, and other software, and is taking over hard drive i need urgent HELP!!! est. time left 1 hr.!!!!!!


Pc Expert2007
0
Comment
Question by:PC-Expert2007
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
10 Comments
 

Expert Comment

by:nicoric
ID: 11869892
Did you try starting in safemode and doing a search and deleting any files associated with it?
0
 

Expert Comment

by:nicoric
ID: 11869958
Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode (Windows 95/98/Me/2000/XP) of VGA mode (Windows NT).
Run a full system scan and repair all the files detected as W32.Pinfi.
Reverse the value that the virus added to the registry.

0
 

Expert Comment

by:nicoric
ID: 11870133
please disregard first solution as it affects .exe files.
0
Guide to Performance: Optimization & Monitoring

Nowadays, monitoring is a mixture of tools, systems, and codes—making it a very complex process. And with this complexity, comes variables for failure. Get DZone’s new Guide to Performance to learn how to proactively find these variables and solve them before a disruption occurs.

 
LVL 1

Author Comment

by:PC-Expert2007
ID: 11874209
I have found the virus Main part, but i cant delete it,  i have tried refabercating the hard drive, windows ME it's self. its stuck right in the Explorer folder, the most important folder, once i download any anti virus, WIN PINFI destorys the important files of the antivirus I went in SAFE mode, and it went undetected and i could not remove it, it is boosting my MB of Ram to the maximem amount which is 900 Mb by idleing, Any comments?
0
 
LVL 5

Expert Comment

by:Big5250
ID: 11874768
Not sure which of these steps you have tried:

http://securityresponse.symantec.com/avcenter/venc/data/w32.pinfi.html
0
 

Expert Comment

by:Kgenis
ID: 11883053
PC-Expert2007, I could write you a tool to remove the virus if you like. Then all you would have to do is run it in safe-mode. However, from what I've read. The virus seems to be remaining in memory via a registry key. Following these steps from Big5250's link above will remove it from memory. After that you should only have to delete the folder it creates.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit, and then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer


In the right pane, delete the value: PINF
Exit the Registry Editor.

After this, run a search on your computer by clicking Start - Search - Find file or folders.
0
 

Expert Comment

by:Kgenis
ID: 11883087
in the containing text field type tmp. If your computer finds a file which is made up of: [3 random letters][4 random hexadecimal digits].tmp - delete it and restart. Make sure you have removed the registry key and re-logged on to remove the virus from resident memory.

Greetz.
Matt.
0
 
LVL 1

Accepted Solution

by:
Alien3 earned 25 total points
ID: 11927811
I had this virus before and I never had to reformat.

This tut is written for Norton Anti-Virus system-administrator users using Windows XP.

1. Press CTRL+ALT+DELETE and close as much as processes as possible. Like Winamp, MSN, IRC and any other filename you find suspicious.

2. Open your NAV and make sure it still works properly. If it doesn't it's probably touched by the virus, so uninstall it, and install it again.

3. Reboot in SAFE MODE (for Windows XP user: Goto START > RUN and type in "msconfig". Press enter. On the "Boot.ini" tab check the "/SAFEMODE" option. Press OK and if it asks for reboot, do it.)

4. Start your NAV and do a full system scan. This may take a while. It will repair all the EXE's (in good cases) but one or more .tmp files are still infected and failed to repair: Quarantine them and delete them after that in the Quarantined Items list. The virus should now be totally removed from your PC.

5. Reboot in NORMAL MODE (for Windows XP user: Goto START > RUN and type in "msconfig". Press enter. On the "Boot.ini" tab uncheck the "/SAFEMODE" option. Press OK and if it asks for reboot, do it.)

6. Use regedit.exe to delete the key "PINF" located in " HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre
ntVersion\Explorer"

0

Featured Post

SuperAntiSpyware Licenses Discounted by 25% !

Exclusive offer to Experts Exchange Members!
Buy SuperAntiSpyware License(s) from us and save 25% on the regular purchase price.
- Includes Full SuperAntiSpyware Vendor Support Entitlements
- Your Subscription does not begin until you activate your license
- Buy for your friends

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There's a lot of hype surrounding blockchain technology. Here's how it works and some of the novel ways it' s now being used - including for data protection.
A hard and fast method for reducing Active Directory Administrators members.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question