We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

Malware virus lich.sys removal

rhender9
rhender9 asked
on
Medium Priority
608 Views
Last Modified: 2013-12-09
Does anyone know how I can manually remove the lich.sys malware from Windows XP PC?  I have Symantec Antivirus loaded, and it finds the virus, but doesn't remove it.
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2007

Commented:
Does Symantec gives you the location of the virus? e.g., C:\lich.sys

Use MalwareBytes or even better Combofix and show us the Combofix log.
Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
CERTIFIED EXPERT
Top Expert 2007

Commented:
I'd say use Combofix as the driver/service is already in its database.
ZZZdrv_lich
ZZZsvc_lich
Unlock this solution with a free trial preview.
(No credit card required)
Get Preview
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a free trial preview!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.