Virus in MS Dos

  JoJoh 18:24 22 Sep 03
Locked

I have found that my MS Dos has a file called instit.bat that relates to a virus that I have eliminated elsewhere. I have tried to delete this in Dos but it is saying that it is read only. This virus starts every time that i boot the machine. Any ideas how I can delete this file in DOS as i am sure that this is causing the problem.

  expertec 18:27 22 Sep 03
  JoJoh 10:59 23 Sep 03

Thanks for the link. I have tried this and run all of the suggestions including the fix. I am still finding that when the computer is re-started the virus returns. I am now lost as to how to fix this. I have taken the computer off of the network as I have isolated this workstation as the root of the overall problem.

I have even searched the whole of the registry for the know virus words i.e instit.bat,svr32,institu,brasil,marco,gustavved
ithen deleted all references to them and still the virus returns.

I have just ryn the symantec opera fix and even after that the virus was still found in the registry. I need to re-connect this workstation to our network but loathe to do it until I am sure that the virus has gone. Has anyone got any further suggestions?

  JoJoh 11:01 23 Sep 03

Sorry - I did not put in the link,it came automatically. One further point, I need to isolate where is the exe for the virus once the computer re-starts.

  Jester2K II 12:36 23 Sep 03

click here

Before disinfecting, shut down any internet connection.

Editing win.ini

At the taskbar, right-click Start and select Explore. Search for Win.ini in the Windows folder and open it in Notepad. Search for any references to the files you deleted. Delete the references.

Editing the registry

You will also need to delete the following registry key.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE key:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

and delete any references to INSTIT.BAT.

Close the registry editor.

Reboot your computer.

  johnnyrocker 13:10 23 Sep 03

if you are running me or xp you would need to disable system restore before cleansing or it will re occur on re boot
cheers.
johnny.

  JoJoh 13:13 23 Sep 03

Thanks for this. I have already followed all of the suggestions from Sophos and Symantec however at boot up it seems as if the virus re-starts.The
strange thing is that the virus is not in the run folder. It seems to be hiding somewhere else.

It has been suggested that i start in safe mode and then run the symantec fix. I am going to try this now. Thanks for your suggestions.

  JoJoh 13:14 23 Sep 03

Sorry forgot to say that I am running win 98. Also
that all of my 98 computers were originally infected and that the virus has gone from all machines apart from this one workstation.

  Jester2K II 14:41 23 Sep 03

Yes. If you read my post above it might be in the win.ini file too. Have you checked there??

Editing win.ini

At the taskbar, right-click Start and select Explore. Search for Win.ini in the Windows folder and open it in Notepad. Search for any references to the files you deleted. Delete the references.

  JoJoh 22:24 23 Sep 03

Yes I have looked everywhere logical - win.ini
registry,msconfig etc etc.I cannot seem to get rid of it. The symantec fix does not work

  woodchip 22:47 23 Sep 03

Any file, if it is a file in DOS can also be seen in Win98. If it's a entry in a file then you have problems. Only things that I would then suggest is run SFC and restore every file that as changed from the original Win98 files this may stop a program working unless you reload it over the top. The last and sure way is a format and reinstall. You also need to make sure that it is not on any disc's so that it's reloaded

This thread is now locked and can not be replied to.

Amazon Fire HD 8 review: A brilliant combination of function and value – with one massive caveat

1995-2015: How technology has changed the world in 20 years

How to create an introvert-friendly workplace

iPhone 7 review: Enhanced cameras, a refreshed design and water resistance make the iPhone 7 an…