Replace file while in memory

I've seen programs that can alter files while they are in memory. Basically I've run into some nasty viruses where I work, it's a win98 machine which complicates things, plus the fact that norton can't seem to find it/fix it (I think this was some script kiddies lame attempt to bring the system down). We do NOT have the time or resources to reformat each machine. So I'm desperately looking for a program that can delete files that are in memory, or at least alter them. (i'll run this from a batch file executed when they log into novell at bootup). I've looked around, but it seems to be a hacker kind of thing usually, and I'm not exactly up to par on everthing I'd need to use those programs. Anywho, if anyone has any experience, or good links, etc. It'd help me get this done quicker, otherwise I think i might be searching for a week. Thanks.

EWW... Novell! That have that garbage here at work and I loathe it. :shudder: Thank God we're moving off of the platform in less than a year. As for your problem, I'm fairly certain some versions of Norton offer a boot-time virus checker which should clean your system. Granted, if you're just doing something on log-in, it wouldn't work until the user actually reboots, but still. Short of that, I don't have any other ideas. Good luck.

i had to format 40+ boxes. I did one total setup, reformatted loaded windows and everything on it. Then ghosted the rest of the hard drives. Saved a little time, still a big job

>>i had to format 40+ boxes

yeah...try a little over 250...that's why I'm looking for an alternative.

btw our version of norton sucks, it was made with the symantec packager and is seriously void of features (the guy who made it didn't know what he's doing). And I'm not allowed to touch it becuase of some sort of contract we have with the company who set it up for us. Bastages...oh well, I stayed up late last night toying with one of the infected computers, and I think I'm going to take a crack at novells zenworks imaging, hoping I can broadcast it to all the infected computers...but some of them don't have PXE lan so I'll have to images those manually....work's gonna suck today :(

oh i didnt think of this, you can load the image using ghost on boot off the server on all the machines, still sucks though

we don't have ghost

i believe its freeware

last time I checked you had to pay for noton ghost... (AFAIR)

no...it's not...you have to pay a license for each machine you use it on...so in our case, 250 licenses (because imaging them with one license one by one is pointless).

im thinking of the version of ghost before norton purchased it.

If you know the process that's causing the problem (it wont just be a file...there has to be a program behind it) you could use something like WMI to flick through the active processes and kill the ones that are causing trouble.

You would still need to look for the cause of the virus (often the start keys of the registry are where these apps launch themselves from)

well these are win98 machines, which means it can be tied into the system at many points...trust me i scoured the registry and win.ini...either I missed something somewhere else (perhaps it injected itself into a dll) or it's in the bootsector in which case I might as well just re-image if I have to restart into dos to fix the boot sector anyway.