[a-lil-lost]

Hi all wizards,

I have a major problem with the following 3 files on my system:

C:\WINDOWS\SYSTEM\cisvvc.exe
C:\WINDOWS\SYSTEM\rdsndin.exe
C:\WINDOWS\SYSTEM\ntfsnlpa.exe

They are causing fake virus-message pop-ups and are Trojan-related as far as I know. I have run a dozen anti-virus, anti-spyware and cleanup tools (incl. the ones recommended on GeeksToGo) but to no success.

These *.exe files are extremely resistant and furthermore do not show up in the FileExplorer. I need to know, if I can delete them (if possible). So the question is:

Are these 3 files:
(a) actual system files (corrupted by a virus) that need to be repaired or are they
(b) new virus/Trojan files that can be deleted?

Thanks a million for your help!

[Advertisements]

They don't show up in my win98 machine so they aren't used by Windows. In a case like this you can make a zipped copy of them and delete the originals to see what happens. If one is needed by something important just unzip it. It's possible that your spywatchers are spying on each other.

[Tyger]

They don't show up in my win98 machine so they aren't used by Windows. In a case like this you can make a zipped copy of them and delete the originals to see what happens. If one is needed by something important just unzip it. It's possible that your spywatchers are spying on each other.

[a-lil-lost]

Thanks Tyger,

I only managed to delete one of the files:

C:\WINDOWS\SYSTEM\cisvvc.exe [deleted]

Trying to delete the other two:

C:\WINDOWS\SYSTEM\rdsndin.exe
C:\WINDOWS\SYSTEM\ntfsnlpa.exe

results in this message: "File is used by Windows and cannot be deleted". I don't know if that's true though (and from what you said I understand it isn't).

The problem is that since these files are invisible in the FileExplorer I don't know how I could create a zipped backup copy anyway. Do you have a tip how to delete the remaining two files in spite of the "cannot be deleted" message (worst case scenario: without backup)?

Thanks a million, a-lil-lost

[Tyger]

You can make them visible by going to Folder Options and choosing Show All Files, then hit Apply, After you've made your zipped copies you can delete then by going into ms-dos mode, just choose restart in ms-dos instead of shutdown. When the dos prompt comes up just add

del C:\WINDOWS\SYSTEM\ntfsnlpa.exe

and hit enter. Same for the other one. Presto-bango you're free.

[a-lil-lost]

Thanks a bunch, Tyger,

Quick question though (I'm a semi-virgin in PC operating terms):

How do I restart in DOS-mode? And I assume making a zipped backup copy means: copy file, then compress/zip?

Thanks a million

[Tyger]

Just make a zipped copy of the file so that when you unzip it it will have the same filename. To get to DOS just go to Start>Shut Down and when the box comes up choose MS-DOS mode instead of shutdown.

[a-lil-lost]

Hi again, Tyger,

The three *.exe files (see again below) are really quite "devious". I checked under folder options, where "show all files" is active/applied and yet these files do not show up. I know thought that they are/were there.
(As a test I went to a download page [some anti-spy tool] and chose the C:\WINDOWS\SYSTEM folder as download destination, where the malicious *.exe files in question are shown as existing. [I then cancelled the download.])

C:\WINDOWS\SYSTEM\cisvvc.exe
C:\WINDOWS\SYSTEM\rdsndin.exe
C:\WINDOWS\SYSTEM\ntfsnlpa.exe

Since they were still invisible I didn't manage to create a zipped backup and tried deleting them nevertheless:

I did the DOS reboot and deleted the files (not sure if successful??) as you recommended but wasn't sure which command to use next to start Windows so I shut off the PC and restarted. Stupid question: Which command do I use after the del C:\WINDOWS...exe commands to start the PC or shut it down again?

The procedure seems unsuccessful though since a check with Spybot S&D repeatedly turns up two entries:
EffectiveBandToolbar and
FindSpy.A
After erasing those entries, rebooting and going online they reappear again and again.

Can you help please? Thanks a million, Tyger

Best regards, a-lil-lost