0

I have been hit by a virus, i noticed the virus infection during the setup of infectious scam app. It installed so many other apps and registry keys, the usual viral changes.

i was able to clean my pc so far, but there's one file left in the system32/drivers folder ... eyfmunxx.sys file

i can't find the corresponding service in the list of services, and i suspect it's the reasonthat trustedinstaller is being invoked after everytime i clean my pc and somehow without even internet access, two viral processes "winsrv.exe" and "winxsrv.exe" are recreated in my windows folder...

Anyway, i think that's the only thing left if i remove this .sys file i'll be able to completely remove this infection. The problem is, for this particular file, i'm not even able to take ownership of it. Everything is access denied, from copying it, renaming it, deleting it of course... as well as trying to view permissions or change permission to the extent of not being able to take ownership.

I mean how can such a file get so much priority in my windows? Or is it cheating locking resources or something like interrupting intentionally to disallow any way for windows to deal with it?

I still have two other solutions, system restore, or get some other booting system and connect to the harddisk and delete while windows is down.

I'm asking here maybe there's another solution, coz usually this type of virus might corrupt/infect system restore.

I tried unlocker, didn't help, it doesn't show any open handle on it.

Any ideas?

marked as duplicate by Ramhound, DavidPostill windows-7 Mar 3 '18 at 18:07

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • that's not an exact duplicate, it's a file that you can't delete or take permission due to the viral thing, but it's about how to remove the file, it has nothing to do with the duplicate link. It's about how is the file being locked, but no one answered so far. – LolaRun Mar 4 '18 at 12:05
  • The final easy working solution was to insert a windows dvd (in my case windows 7) ->repair, then cancel all the system restore questions (coz i didn't have a restore point/image) and you will get a list advanced options at the end, one being "command prompt" and you're in heaven, with a command prompt on your disks without running your pc OS. and from there i deleted the file, now that i restarted, this driver was indeed the source of the problem, the viral winsrv.exe are no longer being created. One day i'll format my C:\ but not today – LolaRun Mar 6 '18 at 17:30
1

If you are really shure that you need to delete it then you can use a linux live USB, like Linux Mint or Ubuntu linux, you can also try using a USB bootable disk, select Troubleshoot > Advanced Options > Command Prompt and delete the file using the command console

I would try using a linux USB because it wont load any windows files at all

https://community.linuxmint.com/tutorial/view/744

  • yeah i was in the process of doing that, but couldn't find a dispensable usb, anyway i'm going for openbsd? what do you think – LolaRun Mar 3 '18 at 8:07
  • Any linux distro will do... you should use the more familiar you are with, i was recommending ubuntu or mint because those are the more used and easier to understand for users that have never used linux before – Chico3001 Mar 3 '18 at 8:09
  • i had a very hard time to mount and install ntfs coz i couldn't get an internet connection on the USB OS :) – LolaRun Mar 6 '18 at 17:17
0

Boot into safe mode and then delete eyfmunxx.sys. To boot to safe mode:

  1. Restart your computer
  2. Rapidly hit the F8 key
  3. Press the key and then press Enter
  4. Now delete that file

This way, only critical drivers are loaded. I don't think Windows will think that file is a critical driver.

  • did that , didn't work, same "access denied" restriction. – LolaRun Mar 4 '18 at 12:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.