Hai i’m new in using comodo,today when i scan my usb i found a virus conficker type,and i cant remove it with comodo,it’s said “Not all the threats have been succesfully quarantined!” ,and the comodo want to restart my computer (i’ve restart my computer but the virus still in there) what should i do?any suggestion?
Conflicker as such is never cleaned by COMODO, it was a long persisting problem.
If you are an advanced user and know some system tweaking, here is how you can delete it.
In Explorer Folder options
Enable “Show Hidden Files”
Disable “Hide Protected Operating System Files”
Disable “Use Simple File Sharing”
Now, you can see the folder containing KIDO virus in Windows Explorer.
Right click on the folder, go to Properties–Security
Add a new user “Everyone” and give “Full Permissions”, you may need to go to “Advanced” and check “apply to all sub folders” too. Click OK.
Now, you can either scan it with CIS, so that it identifies and deletes the sample. or You can simply select the file and delete it.
Do not forget to delete the “autorun.inf” file in the root of the usb drive, which is also associated with the same conflicker virus, although CIS may or may not show it as malware.
i’ve do like your said,but i still cannot delete the file(i’ve success delete the autorun)btw what is CIS? ,and the comodo keep want me to restart the computer,should i restart it?
Yes i able to see the .vmx file in the folder,when i trying to delete it it’s said “access is denied,make sure the disk is not full protected and the file is not currently in use.”
sometimes, the commandline is the only thing that works.
The easiest would be to plug the usb to a linux os and then delete the suspect file. Or you can
go to command prompt.
Now input “attrib -s -h -r -a .” without the quotes (. means any file name with any extension. In other words, all files and folders).
Then “del virusname.extension autorun.inf”.
If the host is already infected, it will be a bit more difficult.
Find the suspect file. This should be the priority so you could easily delete all instances. Autoruns, startup lists, and MSConfig can help you. Don’t delete anything. Just find out where they are. Usually there are three copies of the file. In the users folder, in the main drive, and in other drives present.
Reboot in safe mode and repeat the process above (command prompt to deleting). To be on the safe side, run ccleaner and clean previous system restore images.
Or if safe mode is unavailable,
go to command prompt.
Input “tasklist” and identify the virus image name.
Now input “taskkill /f /t imagename” to forcefully kill the virus from the process and all other processes launched by the virus.
Now you can proceed to cleaning/deleting the virus.
In other cases, the steps are less complicated. Simply go to Tools > Options > View tab, untick Hide extensions for known file types, then apply. Now remove the extensions of the virus(es) and replace it with something like *.quarantine or *.p4l8!3. Reboot. Locate the renamed files then delete. Reboot again then use a registry cleaner and an antivirus scanner to remove leftovers.
