Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Are these essential system files? :


  • Please log in to reply

#1
a-lil-lost

a-lil-lost

    New Member

  • Member
  • Pip
  • 5 posts
Hi all wizards,

I have a major problem with the following 3 files on my system:

C:\WINDOWS\SYSTEM\cisvvc.exe
C:\WINDOWS\SYSTEM\rdsndin.exe
C:\WINDOWS\SYSTEM\ntfsnlpa.exe
:tazz:

They are causing fake virus-message pop-ups and are Trojan-related as far as I know. I have run a dozen anti-virus, anti-spyware and cleanup tools (incl. the ones recommended on GeeksToGo) but to no success.

These *.exe files are extremely resistant and furthermore do not show up in the FileExplorer. I need to know, if I can delete them (if possible). So the question is:

Are these 3 files:
(a) actual system files (corrupted by a virus) that need to be repaired or are they
(b) new virus/Trojan files that can be deleted?


Thanks a million for your help! ;)
  • 0

Advertisements


#2
Tyger

Tyger

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,896 posts
They don't show up in my win98 machine so they aren't used by Windows. In a case like this you can make a zipped copy of them and delete the originals to see what happens. If one is needed by something important just unzip it. It's possible that your spywatchers are spying on each other.
  • 0

#3
a-lil-lost

a-lil-lost

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thanks Tyger,

I only managed to delete one of the files:

C:\WINDOWS\SYSTEM\cisvvc.exe [deleted]

Trying to delete the other two:

C:\WINDOWS\SYSTEM\rdsndin.exe
C:\WINDOWS\SYSTEM\ntfsnlpa.exe


results in this message: "File is used by Windows and cannot be deleted". I don't know if that's true though (and from what you said I understand it isn't).

The problem is that since these files are invisible in the FileExplorer I don't know how I could create a zipped backup copy anyway. Do you have a tip how to delete the remaining two files in spite of the "cannot be deleted" message (worst case scenario: without backup)?

Thanks a million, a-lil-lost
  • 0

#4
Tyger

Tyger

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,896 posts
You can make them visible by going to Folder Options and choosing Show All Files, then hit Apply, After you've made your zipped copies you can delete then by going into ms-dos mode, just choose restart in ms-dos instead of shutdown. When the dos prompt comes up just add

del C:\WINDOWS\SYSTEM\ntfsnlpa.exe

and hit enter. Same for the other one. Presto-bango you're free.
  • 0

#5
a-lil-lost

a-lil-lost

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Thanks a bunch, Tyger,

Quick question though (I'm a semi-virgin in PC operating terms): :tazz:

How do I restart in DOS-mode? And I assume making a zipped backup copy means: copy file, then compress/zip?

Thanks a million ;)
  • 0

#6
Tyger

Tyger

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,896 posts
Just make a zipped copy of the file so that when you unzip it it will have the same filename. To get to DOS just go to Start>Shut Down and when the box comes up choose MS-DOS mode instead of shutdown.
  • 0

#7
a-lil-lost

a-lil-lost

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hi again, Tyger,

The three *.exe files (see again below) are really quite "devious". I checked under folder options, where "show all files" is active/applied and yet these files do not show up. I know thought that they are/were there.
(As a test I went to a download page [some anti-spy tool] and chose the C:\WINDOWS\SYSTEM folder as download destination, where the malicious *.exe files in question are shown as existing. [I then cancelled the download.])

C:\WINDOWS\SYSTEM\cisvvc.exe
C:\WINDOWS\SYSTEM\rdsndin.exe
C:\WINDOWS\SYSTEM\ntfsnlpa.exe


Since they were still invisible I didn't manage to create a zipped backup and tried deleting them nevertheless:

I did the DOS reboot and deleted the files (not sure if successful??) as you recommended but wasn't sure which command to use next to start Windows :tazz: so I shut off the PC and restarted. Stupid question: Which command do I use after the del C:\WINDOWS...exe commands to start the PC or shut it down again?

The procedure seems unsuccessful though since a check with Spybot S&D repeatedly turns up two entries:
EffectiveBandToolbar and
FindSpy.A
After erasing those entries, rebooting and going online they reappear again and again.

Can you help please? Thanks a million, Tyger ;)

Best regards, a-lil-lost
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP