Bling.exe

Hi,
Here's my problem.
I've got a PC with Windows XP (SP1) and Explorer 6.0.
AV : Avast 4.0
Modem connection : 56Kb
A few days ago, I discovered 2 virus : bat-zapchast.c which put a
c.bat in my system32 directory, and worm-rbot.lk which put a
sysentry.exe file in the same directory. Each time I connected on the
net, after a few minutes, my PC stopped completely, no answer for
anything. I had to reboot. After a while, new problems appeared :
impossibility to go on my yahoo mail, several pages completely
strange...
After disabling the system restore, and rebooting in minimal safe
mode, I could erase the two files I had found (not with my AV but with
Secuser.com)and delete the items inside the Registry (with regedit). I
found a strange line in my system boot instructions about a crsss.exe
file (not csrss but crsss). I put it out.
I finally found a bling.exe file in the system32 directory. I knew it
was linked to the virus and tried to erase it. Impossible. I received
a message : "this file is currently used by another program or
application. Close this program and then erase it." I tried to find
which program or application used bling.exe. But no match anywhere,
nor in the registry. Even in safeboot, same message.
How can I do ?
Did you encounter the same problem ?
Thank you for your answers.

Sahmaz

sahmaz.RemoveThis@yahoo.fr (Sahmaz) wrote in message news:<e1ad9bae.0409131338.7944b1b7.RemoveThis@posting.google.com>...
> Hi,
> Here's my problem.
> I've got a PC with Windows XP (SP1) and Explorer 6.0.
> AV : Avast 4.0
> Modem connection : 56Kb
> A few days ago, I discovered 2 virus : bat-zapchast.c which put a
> c.bat in my system32 directory, and worm-rbot.lk which put a
> sysentry.exe file in the same directory. Each time I connected on the
> net, after a few minutes, my PC stopped completely, no answer for
> anything. I had to reboot. After a while, new problems appeared :
> impossibility to go on my yahoo mail, several pages completely
> strange...
> After disabling the system restore, and rebooting in minimal safe
> mode, I could erase the two files I had found (not with my AV but with
> Secuser.com)and delete the items inside the Registry (with regedit). I
> found a strange line in my system boot instructions about a crsss.exe
> file (not csrss but crsss). I put it out.
> I finally found a bling.exe file in the system32 directory. I knew it
> was linked to the virus and tried to erase it. Impossible. I received
> a message : "this file is currently used by another program or
> application. Close this program and then erase it." I tried to find
> which program or application used bling.exe. But no match anywhere,
> nor in the registry. Even in safeboot, same message.
> How can I do ?
> Did you encounter the same problem ?
> Thank you for your answers.
>
> Sahmaz

If you look in your taskmanager look for a process running named
FTP.EXE and kill it. This should allow you to delete the file.