Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 709
  • Last Modified:

HELP! W32.Pinfi HOW TO REMOVE!!

windows ME Hp  

W32.Pinfi <-- DIsabled all anti virus, firewall, and other software, and is taking over hard drive i need urgent HELP!!! est. time left 1 hr.!!!!!!


Pc Expert2007
0
PC-Expert2007
Asked:
PC-Expert2007
1 Solution
 
nicoricCommented:
Did you try starting in safemode and doing a search and deleting any files associated with it?
0
 
nicoricCommented:
Disable System Restore (Windows Me/XP).
Update the virus definitions.
Restart the computer in Safe mode (Windows 95/98/Me/2000/XP) of VGA mode (Windows NT).
Run a full system scan and repair all the files detected as W32.Pinfi.
Reverse the value that the virus added to the registry.

0
 
nicoricCommented:
please disregard first solution as it affects .exe files.
0
Improved Protection from Phishing Attacks

WatchGuard DNSWatch reduces malware infections by detecting and blocking malicious DNS requests, improving your ability to protect employees from phishing attacks. Learn more about our newest service included in Total Security Suite today!

 
PC-Expert2007Author Commented:
I have found the virus Main part, but i cant delete it,  i have tried refabercating the hard drive, windows ME it's self. its stuck right in the Explorer folder, the most important folder, once i download any anti virus, WIN PINFI destorys the important files of the antivirus I went in SAFE mode, and it went undetected and i could not remove it, it is boosting my MB of Ram to the maximem amount which is 900 Mb by idleing, Any comments?
0
 
Big5250Commented:
Not sure which of these steps you have tried:

http://securityresponse.symantec.com/avcenter/venc/data/w32.pinfi.html
0
 
KgenisCommented:
PC-Expert2007, I could write you a tool to remove the virus if you like. Then all you would have to do is run it in safe-mode. However, from what I've read. The virus seems to be remaining in memory via a registry key. Following these steps from Big5250's link above will remove it from memory. After that you should only have to delete the folder it creates.

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit, and then click OK. (The Registry Editor opens.)
Navigate to the key:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer


In the right pane, delete the value: PINF
Exit the Registry Editor.

After this, run a search on your computer by clicking Start - Search - Find file or folders.
0
 
KgenisCommented:
in the containing text field type tmp. If your computer finds a file which is made up of: [3 random letters][4 random hexadecimal digits].tmp - delete it and restart. Make sure you have removed the registry key and re-logged on to remove the virus from resident memory.

Greetz.
Matt.
0
 
Alien3Commented:
I had this virus before and I never had to reformat.

This tut is written for Norton Anti-Virus system-administrator users using Windows XP.

1. Press CTRL+ALT+DELETE and close as much as processes as possible. Like Winamp, MSN, IRC and any other filename you find suspicious.

2. Open your NAV and make sure it still works properly. If it doesn't it's probably touched by the virus, so uninstall it, and install it again.

3. Reboot in SAFE MODE (for Windows XP user: Goto START > RUN and type in "msconfig". Press enter. On the "Boot.ini" tab check the "/SAFEMODE" option. Press OK and if it asks for reboot, do it.)

4. Start your NAV and do a full system scan. This may take a while. It will repair all the EXE's (in good cases) but one or more .tmp files are still infected and failed to repair: Quarantine them and delete them after that in the Quarantined Items list. The virus should now be totally removed from your PC.

5. Reboot in NORMAL MODE (for Windows XP user: Goto START > RUN and type in "msconfig". Press enter. On the "Boot.ini" tab uncheck the "/SAFEMODE" option. Press OK and if it asks for reboot, do it.)

6. Use regedit.exe to delete the key "PINF" located in " HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre
ntVersion\Explorer"

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Building an Effective Phishing Protection Program

Join Director of Product Management Todd OBoyle on April 26th as he covers the key elements of a phishing protection program. Whether you’re an old hat at phishing education or considering starting a program -- we'll discuss critical components that should be in any program.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now