Using BartPE to delete a troublesome .dll file

[+Mystic MVC]

A computer 234234234

[+Warwagon MVC]

  On 26/01/2010 at 17:25, Mystic said:

A computer I'm working on had a run in with some spyware and/or virus. Got it mostly cleaned up but there is still one troublesome dll file that cannot be deleted (bzhcwcio2.dll). A friend suggested I use his BartPE disk to boot into an offline environment where I would be able to delete the file. The problem is that I have no idea how to run the program at all. How hard is it to delete a file while using BartPE?

Not very hard. Bartpe is just like a bootable version of windows. The basic build you do doesn't include a lot, not even an explorer shell, so that makes browsing the computer a little hard. You could still do it via the run box. If you were add a plugin like Xpe before you build the disc, then that would give you an explorer shell.

[+BudMan MVC]

You could also just use any linux liveCD to do this.. For example Damn small linux is a 50MB download you burn to a CD, boot and do whatever you want. Or for that matter just boot your OS install media and go to a recovery console should allow you delete the now non loaded dll.

But also any decent malware cleaner should delete it for you - malwarebytes comes to mind.. Even if it does not directly delete the -- it should correct what is loading it so that you can delete it.

Another option would be just booting into safe mode -- which would hopefully keep the dll from being loaded, and then again allow you to delete it.

Burt sure a BartPE or even WinPE is a way to boot a limited version of windows off the CD and then sure you can delete whatever you want off the OS drive.

[Joel]

Another suggestion is to make yourself a UBCD4WIN CD with stuff like MBAM and SuperAntiSpyware on it, and use that. You still get your Explorer to manually delete stuff, plus malware tools if you need them.

[+Mystic MVC]

34

[Subject Delta]

I had a problem like this once, I had to trawl through and delete all the registry entries, and the DLL in safe mode, otherwise the DLL just kept re-adding itself (I think there was some malware elsewhere as well) so i'd recommend a precautionary scan, just to make sure it is all gone.