[Psuedo_mE]

Just need to know how to remove a directory on a WinXP system.

I've tried rmdir, rmdir -r, rmdir -rf, and it tells me:
"The system cannot find the file specified."
"The directory is not empty."

I've tried rm, rm -r, rm -rf and it tells me:
"'rm' is not recognized as an internal or external command, etc"

I know the directory isn't empty, it contains an infected .dll, that windows will not let me delete. I've closed down explorer.exe and have been trying to delete it through the command prompt to no avail. The directory is meaningless so getting rid of the entire thing isn't a problem, but it won't let me see the hidden file (tcpbin.dll), or delete the directory it's in.

Any help would be appreciated. I tried the malware forum about a week ago, and all I got was views, nobody helped at all.

BTW, I did unregister the .dll before any attempts at deletion.

[Advertisements]

Download MoveOnBoot from the following link:
http://www.snapfiles...moveonboot.html

Before Installing it.
Open Control Panel -> Folder Options.
Click the View tab.
Choose the Show hidden files and folders option.
Disable(un-check) the Hide proptected operating System Files" option


Install and open MoveOnBoot.
Click Next> on the Introduction page.
Now click the "..." button.
Goto x:\Recycled (where x: is the drive-letter, where the file was intially stored before deletion)
Choose your desired file and click "Next"
Choose the delete option.
Click "Start".

[dsenette]

Download MoveOnBoot from the following link:
http://www.snapfiles...moveonboot.html

Before Installing it.
Open Control Panel -> Folder Options.
Click the View tab.
Choose the Show hidden files and folders option.
Disable(un-check) the Hide proptected operating System Files" option


Install and open MoveOnBoot.
Click Next> on the Introduction page.
Now click the "..." button.
Goto x:\Recycled (where x: is the drive-letter, where the file was intially stored before deletion)
Choose your desired file and click "Next"
Choose the delete option.
Click "Start".

[Psuedo_mE]

Downloaded the program and ran it twice. File is still there.

In HJT it shows up as a:

O20 - Winlogon Notify: tcpbin - C:\WINDOWS\Web\WALLPA~1\tcpbin.dll

So either it's more stubborn than MOB or it's being replaced right after it gets deleted.

Let me know what you think.

[OwNt]

Hello, Psuedo_mE.

Please follow the instructions on this link, then post a fresh hijackthis log in the malwhere removal forum.