Help me delete this file please

SexyGreyFox · 23 Nov 2008 at 21:23

I have a file that is giving me loads of problems and its called hgGwTMee.dll.
I started a thread a while ago about Firefox being hijacked and this is the file.

I've booted into safe mode and it won't delete.
I've booted with Knoppix but it won't let me delete files.
I thought I had an NTFS reader that I can boot in with but I can't get at my drives with it.
I've shut everything down in my Task Manager that I'm allowed to but it still doesn't go out of memory so I can delete it.
Hiijack tries to delete it but fails.

Any ideas before I remove the hard drive and put it in another machine?

pmbuzz · 23 Nov 2008 at 21:25

There's an app called "Unlocker"

http://ccollomb.free.fr/unlocker/

MarcLister · 24 Nov 2008 at 02:07

Unlocker as said. It should delete the file for you. You might need to unlock whatever is "handling" it so to speak. Sometimes there are files that Unlocker can't delete there and then but is able to delete when you restart.

SexyGreyFox · 24 Nov 2008 at 07:51

Unlocker won't touch it.
Whenever I click to shut something down the computer turns off.
My problem is finding the process to empty it out of memory so I can delete it.

bledd · 24 Nov 2008 at 10:29

the only google result is this thread, so it's a randomly named bad dll..

i'd do a full clean...

disable system restore
run..

ccleaner slim
nod32 av trial
spybot s&d
http://www.malwarebytes.org/ and malware bytes

then restart, and run hijackthis, and post the hijackthis log on here and on hijackthis.de for reference

add me to msn if you want mate

, in trust

SexyGreyFox · 24 Nov 2008 at 13:21

It will take me 5 minutes to put the hard drive in another computer and just delete the file but it will upset me because I like to fix software problems without cheating.

Does anybody know of a good DOS NTFS reader for free?

bledd · 24 Nov 2008 at 13:23

mate if it's running (which it is) then it's likely there's more to it than just that.. i'd go through what i said

IAmATeaf · 24 Nov 2008 at 14:37

Have you searched through the registry? It looks like it's daisy chained itself onto WinLogon so you won't be able to unlock the file but searching through the registry might show you where it appears so that you can reset the entries back to the way they were.

OCdude · 24 Nov 2008 at 15:59

Try using Process explorer to find the open handle on that file, close the handle, then delete the file?

SexyGreyFox · 24 Nov 2008 at 16:34

OCdude said:
Try using Process explorer to find the open handle on that file, close the handle, then delete the file?

Looking forward to that.
Downloaded but going to College so will try later.
Thanks

OCdude · 24 Nov 2008 at 16:42

I use process explorer a lot... awesome app (i find that Explorer.exe leaves open handles on movie files (.avi etc) which prevents me from deleting them... REALLY annoying... but this app can sort all that with no probs!

Download link here: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

SexyGreyFox · 24 Nov 2008 at 20:27

OCdude said:
Try using Process explorer to find the open handle on that file, close the handle, then delete the file?

It had attached to 4 different things including Winlogon which meant when I killed it XP would shut down.
Killing a couple of the others somehow I managed to change the name of it but it still wouldn't let me delete it.
After a reboot I was able to delete the file.
I was then able to go into the Registry using the wonderful JV16 and delete all the entries there.

Thanks for that little beauty.