Cant delete virus file

[Ramoki]

After installing AVG Free I keep getting a pop up message about Threat Detected while opening Windows\System32 bcmbbcm.dll. It's identified as virus Obfustat.JDZ. I cannot Delete, Rename, Move or Copy the file - in Windows or Command Prompt or Safe Mode. I can't remove the references to it in the Registry. I can't Kill it. The "Move on Boot" program doesn't work. I can't get past the administrator password on the Windows CD repair. (I tried resetting and eliminating the password to no avail). I disabled everything at Selective Start-up, but I still can't delete it. There is only one reference to it on the Net, and it's translated. I don't know what it does, but it's annoying. I've already wasted too many hours trying to get rid of it. Help!!!

[staffsMike]

Back up and reformat?

[Ramoki]

Back up and reformat?

I have 50 GB of data on a laptop. I'd rather not do that. Why is there no info about the file on any other AV site? Even AVI's site has no record of it on their own site even though their program identifies it. Is it a false positive? It was modified within minutes of the AVG install.

[Saracen]

Apparently, it's a false positive coming from the heuristic scan capability in AVG. There's other threads about it, such as .... http://forums.hexus.net/showthread.php?p=1145529

Oh, and if you Google for Obfustat without the file extension, you'll get hits all over the place on variants of your message.

[djfluff]

If you upload it to these guys, they should be able to tell you ... http://www.virustotal.com/

[Ramoki]

First I had to change file attribute using CACLS & BUILTIN in Safe Mode with Command Prompt. Then I was able to to copy it to another location and change it's extension before I could upload it. The results showed multiple hits (mostly Trojans) from various AV programs. But when I went to the sites and did a search on the file name, they had no info!!! Now I see why shops just do backup and reformat. Problem is it's son's computer just home from service with nearly 50 GB of movies, music, games etc. He wants to use our home network. He's going to have to live with pop-up message. I'm going to use my extra router to connect him and firewall him from network - as soon as I learn how to do it. Where is a good link to instructions for connecting two routers?

Thanks

[peterb]

Hve you updated your copy of AVG?

[Ramoki]

Hve you updated your copy of AVG?

Yes. Latest version with latest update. Also up to date Adaware and Spybot.

[djfluff]

Sounds a bit loopy, but have you tried going into safe mode & disabling all your av/spyware programs before attempting to delete the file ? Quite often AV programs will prevent access to infected files, to stop them causing damage, but this also stops you deleting the file.
Make sure you have turned of 'system restore', as this keeps a backup of your system files, including virus filled dll's . If your data is really important to you, you should get an external HDD to back the files onto when you can. Good luck btw.

[Ramoki]

Sounds a bit loopy, but have you tried going into safe mode & disabling all your av/spyware programs before attempting to delete the file ? Quite often AV programs will prevent access to infected files, to stop them causing damage, but this also stops you deleting the file.
Make sure you have turned of 'system restore', as this keeps a backup of your system files, including virus filled dll's . If your data is really important to you, you should get an external HDD to back the files onto when you can. Good luck btw.

I removed and reinstalled AVG - AGAIN. Then I defragged the HD (took almost 24 hrs!!) No more pop-ups. I can now copy it in Windows and scanning it with AVG shows no threat. I can't stand it!! Linux and Apple are looking better all the time.

Thanks to all who offered advice.