Safe mode and deleting infected files

[zillah]

My computer has been infected with spyware, I tried to rename some infected fiels in the "WINNT\System32\lyfoctrs.dll" directory, while a PC is booting in safe mode. But I received this error message:

" Can not rename lyfoctrs.dll : There has been a sharing violation.

The source or destination file may be in use".

When I checked the running processes , I could not find that name (lyfoctrs.dll) running in the memory!!!

What should I do with this case, and similar other cases?

[techniquefreak]

How do you know it's spyware - have you tried some antispyware programs like ad-aware se or spysweeper ... ?

[zillah]

How do you know it's spyware - have you tried some antispyware programs like ad-aware se or spysweeper

Yes, I have tried,,,,,,,,,,,,,,even if it not spy ware, this what I meant by :

and similar other cases?

My concern who to remove it ?

[techniquefreak]

Zillah - I'm sure many people here'd like to lend a hand - but more info is needed - first of all the obvious question - are you logged on as an administrator - ... ?

[Kelsenellenelvian]

google for unlocker and use it to unlock those files.

[zillah]

Zillah - I'm sure many people here'd like to lend a hand -

I have no doubt about this

but more info is needed

Sory for that, I will be happy to provide all the informtion

first of all the obvious question - are you logged on as an administrator - ... ?

yes

Edited October 13, 2005 by zillah

[techniquefreak]

Follow k's advice - try that unlocker thingie -

http://ccollomb.free.fr/unlocker/unlocker1.7.3.exe

- if that's unsuccessfull - boot from a floppy boot diskette to dos and delete the file from here.

Hope this helps

Edited October 14, 2005 by techniquefreak