Annoying Winupdate Virus

[Scubar]

i recently got the winupdate virus and although its a very easy virus to get of i cant seem to work out how to reset the properties of the System32 folder. i have tried going into its properties but when i get there the hidden checkbox is selected and disabled so im unable to unhide it again. i did try setting its attribs in cmd but that didnt seem to work either. was hoping someone else has any ideas of how to fix this.

[Nepali]

update ur antivirus>>

for me

kaspersky works great

[Scubar]

dont use antivirus as ive never needed to. i killed the virus str8 away and removed all traces of it. i just cant seem to work out how to get the system32 folder back from having its attribs changed.

[Hatefulsorrow]

You can always do either a system restore or a windows repair. But as far as the files within the system32 directory, what do you mean by "get their attributes back?" Meaning that they have lost their system attribute or a hidden attribute or what? There is a command line command that lets you set the attributes of a file but I don't know if it works for more then one file at a time. Check out the switches. To see open a command window. And type:

attrib /?

The thing is that each file in the windows system32 subfolder has different attributes. So setting all of the file's to the same may cause a very serious problem. But then again it may not. No way to tell without trying.

It may not be worth the hastle to do it by hand, hence the idea's of system restore or windows repair. If you use system restore you might get the virus back, so all your effort might be for not.

On the other hand, if you use windows repair you have to redownload and reinstall any and all windows updates that you have gotten sence the last time you formated your harddrive.

It's a toss up.

Hope this helps,

Hatefulsorrow

[DL.]

Try this in a batch-file:

attrib -s /S /D "%systemroot%\System32"
attrib -s /S /D "%systemroot%\System32\*"

This removes the "system"-attribute which prevents you from changing attributes in file- or folder-properties.

The first line removes the attribute from the system32 folder and the second one removes it from all files and folders in that folder and all subfolders.

As previously mentioned you can use the /? switch to get more info.

You can use -h in addition to -s i the batch to remove the system attribute and unhide all files and folders.

Edited September 7, 2005 by DL.

[Scubar]

thanks the batch file worked, i just had to make it -s -h. i did try that in cmd before but i was doing it attrib -s -h C:\windows\sytem32 but it didnt work

[DL.]

I use that method to be able to unhide and remove files and folders with hidden and/or system attributes as part of my cleanup. It took some experimenting to find that out, luckily I did it quite recently.