Solved

Malware virus lich.sys removal

Posted on 2009-07-01
3
577 Views
Last Modified: 2013-12-09
Does anyone know how I can manually remove the lich.sys malware from Windows XP PC?  I have Symantec Antivirus loaded, and it finds the virus, but doesn't remove it.
0
Comment
Question by:rhender9
  • 2
3 Comments
 
LVL 47

Expert Comment

by:rpggamergirl
Comment Utility
Does Symantec gives you the location of the virus? e.g., C:\lich.sys

Use MalwareBytes or even better Combofix and show us the Combofix log.
Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
0
 
LVL 47

Expert Comment

by:rpggamergirl
Comment Utility
I'd say use Combofix as the driver/service is already in its database.
ZZZdrv_lich
ZZZsvc_lich
0
 
LVL 13

Accepted Solution

by:
JeremySBrown earned 500 total points
Comment Utility
Try scanning with Dr. Web Anti-Virus as well.
http://www.freedrweb.com/
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

These are on the increase and getting more common these days. Users who use the Google search engine may complain of having their search redirected to unwanted sites, regardless of what browser is used. This happens when the system is infected with…
Malware seems to be getting smarter and smarter. If you are having trouble being able to launch your malware removal tools such as (and recommended): MalwareBytes, HiJackThis, ComboFix, etc. you can try some of the workarounds listed below. 1. Ma…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now