Windows Forum

Ask something
Discussion Locked

infected C:\WINNT\SYSTEM32\KERNEL.EXE

0 helpful
9 replies

by danno

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

mY C:\WINNT\SYSTEM32\KERNEL.EXE FILE ON THE NT 40 SERVER IS INFECTED BY A BACKDOOR TORJAN AND THE NORTON FAILED TO CLEAN IT.mY QUESTION IS
A-HOW DO I CLEAN IT OR REPLACE IT WITHOUT EBDENGARING THE SERVER(sql).

THANKS.

9 replies

by gunnersixz

Try trendmicro's free onlince scanner. It will try to clean it. If that does not work can you replace it from backup? Can you get the system to boot? Just check the date and time of the file and stop all services and restore. You can always replacethat file let me know how it goes

by bkinsey1

kernel32.exe is just a virus/trojan file, and isn't cleanable. Delete it (or let a cleanup utility do it for you). The kernel32 file that is part of Windows is a .dll, not an .exe

by hberkhoff

You cannot delete the file because it is in use, but you can rename it. After renaming re-apply the current servicepack for exchange. the KERNEL.EXE will be replaced by the servicepack.

This discussion is closed to new replies.