cannot delete/rename folder on ntfs (xpsp2)

[Chai]

Originally Posted by Adrian Wong

Err... What folders are they? They could be in use by some application you are using.. or just running in the background.

Read the last post.

[peaz]

Originally Posted by Chai

Read the last post.

he must have opened the thread but just only replied to it

Wow
"Win32.Fidcop.A infects executable files larger than 524288 bytes. It does this by scanning random fixed media (hard drives, flash drives etc.) In order not to attract attention it doesn't infect files in folders that have the following string in their paths: "win", "program files", "documents and", "_restore", "music". Another restriction is that infected executables must be for the i386 architecture and have an standard image base (0x400000).

Method of infection: replaces a part of the first section with some of it's code (aprox. 1.5Kbytes). The other code is packed in overlay. This part creates a temporary dll file (ex. 90.tmp) and then runs it using rundll32.exe. This dll is the main virus body and has the role to infect other files and run the original file. The Win32.Fidcop.A hides two cabinet files in it's body."

[Chai]

Originally Posted by peaz

he must have opened the thread but just only replied to it

Wow
"Win32.Fidcop.A infects executable files larger than 524288 bytes. It does this by scanning random fixed media (hard drives, flash drives etc.) In order not to attract attention it doesn't infect files in folders that have the following string in their paths: "win", "program files", "documents and", "_restore", "music". Another restriction is that infected executables must be for the i386 architecture and have an standard image base (0x400000).

Method of infection: replaces a part of the first section with some of it's code (aprox. 1.5Kbytes). The other code is packed in overlay. This part creates a temporary dll file (ex. 90.tmp) and then runs it using rundll32.exe. This dll is the main virus body and has the role to infect other files and run the original file. The Win32.Fidcop.A hides two cabinet files in it's body."

Haha...I saw his thread, but I couldn't really help him.

[Adrian Wong]

Originally Posted by Chai

Read the last post.

Argghhh... How come I missed the other posts???