silja.exe Help!!

[Poena69]

I was wondering if anyone could give me a step by step guide on how to delete this virus.

I can see the virus in C:\Documents and Settings\Administrator\Application Data - silja.exe and i cannot delete it, even in safe mode, it says it being used access is denied. (In Safe Mode)
And i don't see any strange procceses running while in safe mode.
prevx picks it up but doesn't remove it.
In Regestry editer i deleted most of what i could find of this virus, but still no .....

Once you plug in you memory stick or external hdd, the drive gets infected and show the memory stick as a folder in My Computer, i know how to remove the virus from the memory sticks and hdd, but not the computer itself.

I've even searched everything about it in google, got some info, but doesn't really help.

Anyone with help on how to remove this virus, please

[Ron2K]

This is usually the point where I would bite the bullet and do a wipe and reinstall - and then be more cautious next time.

Welcome to the forums, by the way.

[Poena69]

Aggg, i'm begining to see that, just the hassle of doing that, got this virus on 3 laptops...
anyway thanks...

[Tribble]

Dumb question - have you checked the files attributes?

[Poena69]

no?

[Synthesis]

First, try Unlocker
Install it, then it has a right-click extension (right click on silja.exe) to "unlock" the file by killing all processes using it so you should be able to delete it, rename it, whatever.

If that fails, download and run Combofix
Be sure to disable all antivirus and firewalls before running it.
I can guarentee 99% that this will work and sort out other problems as well.

See how this goes, then we can go from here.

[Poena69]

Thanks I'll give it ago tonight,, at work at moment, Thanks.

[Sojourn]

Had this at the office, dropped a new image on the laptop = fix.

[Poena69]

First, try Unlocker
Install it, then it has a right-click extension (right click on silja.exe) to "unlock" the file by killing all processes using it so you should be able to delete it, rename it, whatever.

If that fails, download and run Combofix
Be sure to disable all antivirus and firewalls before running it.
I can guarentee 99% that this will work and sort out other problems as well.

See how this goes, then we can go from here.

Thanks very much, been struggling and searching about this thing for the past month. shot