TechSpot

Cannot Delete File?

By merfman
Feb 25, 2008
  1. Hi, I'm new to this site. and need some help.

    I'm not sure if this is the right place to put this.

    My computer had some spyware, that i finally got rid of, but now it says that sbmdl.dll is trying to access a folder.

    So i search for the folder and found what is in the folder. Now when i go to delete the stuff in the folder i get a message that says:

    Cannot Delete sbmdl: It is being used by another person or program.
    Close any programs that might be using the file and try again.

    I don't currently have any files that i am aware of, but I'm still unable to delete this. Can anybody give me a few hints or some suggestions on how to delete these files.
     
  2. kritius

    kritius TS Guru Posts: 2,084

    Have you tried deleting it in safe mode?
     
  3. merfman

    merfman TS Rookie Topic Starter Posts: 58

    Yes i tried that first, then i used KillBox, and got rid of 3 of the 5 files that i needed to delete, but the other 2 can't be deleted in "KillBox"
     
  4. CCT

    CCT TS Evangelist Posts: 2,653   +6

    To use HijackThis to remove a stubborn file:

    Clearly identify the file(s) you want to delete and write down the COMPLETE path, eg, C:\Documents and Settings\MOM\Local Settings\Temp\filename


    Start HijackThis,

    click on the bottom option 'none of the above, just start the program'

    click on the bottom right hand option 'config'

    click on the top right hand option 'Misc tools'

    click on the 'delete a file on reboot..' box

    CAREFULLY work your way through the selection process to the file you want to delete and click on it

    Shut down and Reboot
     
  5. merfman

    merfman TS Rookie Topic Starter Posts: 58

    To be completely honest, I'm new here and I'm not too sure what Hijack This is? can you please explain how you use it? thanks
     
  6. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Ok, well if you are infected, and you are new to computers, you should not be attempting remove malware without detailed instructions. First of all, removing the file is only half the battle - it more than likely is in your registry. That file is associated with a nasty little trojan that downloads and installs additional malware on the user's machine.

    Please follow Viruses/Spyware/Malware, preliminary removal instructions in order and post the requested logs in this thread

    We need
    1)hijackthis log
    2)Combofix log
    3)Avg log

    If you get stuck anywhere along the way STOP and ask for help here in this thread.

    This thread is for the use of merfman only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. merfman

    merfman TS Rookie Topic Starter Posts: 58

    I've run into a little problem. On STEP 7, the SS&D Link will not load for me. My internet is connected and working fine, the link will not load though. is there anyway around this?
     
  8. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    You can proceed to step 8. Their servers are down tonight. Hopefully it will be back up soon.

    This thread is for the use of merfman only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. merfman

    merfman TS Rookie Topic Starter Posts: 58

    Alright..I just downloaded the CCleaner. and when i clicked 'Run Cleaner' it says,
    This process will permantly delete files from your system.

    What do i do?
     
  10. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Click yes or ok

    Crap Cleaner
    • Download from HERE
    • Close all browsers.
    • Run the programme and make sure all the boxes are ticked under the Windows and Applications tabs, Also check All Advanced tabs(except for the Old prefetch Data option, this should be unticked)
    • Click the run cleaner button. Do this several times
    • Confirm that it will permanently remove files from your computer

    This thread is for the use of merfman only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. merfman

    merfman TS Rookie Topic Starter Posts: 58

    I just finished STEP 10. i just have a question.

    Once i complete all these steps, and if it removes the problem, will i be able to delete all the programs/applications that i have downloaded onto my computer, or will i need them later on?
     
  12. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    I will give you instructions how to remove most of them, but you should keep an anti-virus, a firewall, spybot, and adaware.

    Spybot has some neat features also that I can show you that will help your computer to boot up faster.
     
  13. merfman

    merfman TS Rookie Topic Starter Posts: 58

    Alright. Thank-you, i am currently on STEP 10. Its running the VundoFix Scan. Its taking a while to complete
     
  14. merfman

    merfman TS Rookie Topic Starter Posts: 58

    Just a question,

    What is a Rootkit?
     
  15. kritius

    kritius TS Guru Posts: 2,084

  16. jobeard

    jobeard TS Ambassador Posts: 9,322   +621

    the message is correct; FIND the program running, kill it and then delete.

    IF it shows up in task manager, then this is easy
    IF it's a service, it will still show up
    IF it's a rootkit, then you need a rootkit removal tool like
    http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
     
  17. merfman

    merfman TS Rookie Topic Starter Posts: 58

    Alright, im on STEP 15. i need a little bit of a better walkthrough..i have the HighJack This shortcut icon on my desktop. I saved the logs from ComboFix and AVG. What do i do now??
     
  18. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Highjackthis Instructions
    • Launch Hijackthis by doubleclicking the icon.
    • Select Scan now and save a log
    • After the scan is complete please attach your log onto the forums using the paper clip icon above your reply.
      ***Under no circumstances should you add any items to the HJT ignore list. Under no circumstances should you change the directory that highjackthis downloads to. Under no circumstances should you Fix anything without specific instruction to do so. Under no circumstances should you click any buttons other that specified in the directions including AnalyzeThis!***
     
  19. merfman

    merfman TS Rookie Topic Starter Posts: 58

    here is the Highjack this log
     
  20. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    can you also please attach C:\Combofix.txt
     
  21. merfman

    merfman TS Rookie Topic Starter Posts: 58

    here they are
     
  22. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Looks like that got them as you will see in the highjackthis log (file missing)

    Please go to Start -> Control Panel -> Add/Remove programs
    uninstall the following if there:
    NetProject


    Launch Hijackthis again -> select System Scan only
    Put a check mark next to the following:
    R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: e404mgr Class - {A3D76B96-30B9-4DCC-9B3D-D12E31280D29} - C:\Program Files\Helper\1203801059.dll (file missing)
    O2 - BHO: (no name) - {C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} - C:\Program Files\NetProject\sbmdl.dll (file missing)
    O3 - Toolbar: Web Application - {81705D67-3F73-4983-859B-97D0922E5ABE} - C:\Program Files\NetProject\wamdl.dll (file missing)
    O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
    O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.explorertool.net/redirect.php (file missing)
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: PICgrabber - {4964E240-D53C-11D5-BDA9-444553540000} - C:\Program Files\PICgrabber\PICGRABBER.EXE (file missing) (HKCU)
    O9 - Extra 'Tools' menuitem: PICgrabber - Movie&Image Search/Download Software - {4964E240-D53C-11D5-BDA9-444553540000} - C:\Program Files\PICgrabber\PICGRABBER.EXE (file missing) (HKCU)


    Select Fix Checked

    Close Hijackthis

    Restart the computer

    Run Hijackthis again and save a log. Attach the new log in your next reply
     
  23. merfman

    merfman TS Rookie Topic Starter Posts: 58

    just finished what you said to do here is the second log.
     
  24. Blind Dragon

    Blind Dragon TS Evangelist Posts: 3,908

    Update your Java Runtime Environment
    • Click the following link
      Java Runtime Environment 6 Update 4
    • The 4th option down is the one you want
    • After the download locate and double click the installer jre-6u4-windows-i586-p-iftw.exe
    • Go to Start-> Control Panel-> add/remove programs (Programs and features), and uninstall any old versions except Java 6 Update 4


    Go To Start -> Run -> Type in exactly Combofix /u
    *uninstalls combofix
    *removes quarantine
    *removes vundofix backups
    *creates a fresh restore point.

    You can remove Hijackthis through add/remove programs.
    And most of the other tools through dragging to recycle bin

    As I said before you should keep 1 antivirus program (I think I saw you had norton) I don't recommend Norton but if you are happy with it, keep it. If you would like to completely uninstall norton and install AVG let me know and I can post how.

    Keep a firewall -> Zone Alarm, Comodo, Kerio

    Keep Spybot and Adaware.

    Instead of using windows to control items that load when you boot your computer an easy way is to use spybot S&D. Go to Mode and select advanced. then expand tools in the left pane, then double click system startup uncheck items that don't need to be started everytime you turn on your computer. If you don't know what something is you can post here or google for it. Don't uncheck anything in green.

    If you have any more problems please use this thread

    This thread is for the use of merfman only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  25. merfman

    merfman TS Rookie Topic Starter Posts: 58


    THANK-YOU for all the help, the computer seems to be running fine now
    THANK-YOU
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...