My anti-virus software says a trojan was found on my computer, and the file
in which the trojan lies can not be cleaned, deleted, or quarantined. I have
pictures of my children that I don’t want to lose. Is there a way for me to
delete that file where the trojan is and save the pictures of my children? I
was told if the trojan couldn’t be quarantined, deleted, or cleaned, then I
would need to completely start my hard drive over from scratch. Is this
On the surface the answer here is simple: you should be able to recover your
pictures safely and still remove the trojan. And yes, I’ll walk through how you
might do that.
There’s a much larger issue at play here. One that scares me much
more than the trojan.
Become a Patron of Ask Leo! and go ad-free!
Before I get to removing the trojan, I have to deal with the bigger
You’re not backing up.
Seriously, if the pictures that are so important to you are in one place and
one place only, you will lose them. Some day that hard disk will die
or your computer will have some kind of serious problem, and everything will be
I hear it repeatedly from many people. They’ve placed all their eggs in one
basket, and the basket breaks. Sometimes they can get lucky and data recovery
tools can be used (sometimes at great cost), but why risk it?
I can’t emphasize this enough: start backing up. Copy things that are
important to you to another computer, burn them to CD-ROM, get an external hard
drive, use a backup program or a backup service, but do something.
End of sermon.
OK, now, about those trojan files that can’t be removed.
First, make note of the full path to each of the files that can’t be deleted
by your anti-virus software.
Then boot into Safe Mode (typically that means pressing F8 as Windows begins
to boot, and selecting Safe Mode). Then delete(*) named files by hand. It’s
quite possible you’ll need to alter their read-only status to do so.
If that doesn’t work, though it should, then my next step would be to boot
into the Windows Recovery Console. If you boot from your Windows CD, then the
recovery console should be one of your options. Once in, the recovery console
is nothing more than a Windows Command Prompt with a limited set of commands
available. You should be able to delete the files here.
MoveOnBoot should work and the recovery console should work, but if for some
reason they both fail, or are unavailable, then the last approach I would take
gets just a little geeky: boot from a Linux live CD. Many such as the ever
popular Knoppix or Ubuntu distributions boot into Linux using only the CD-ROM,
and then allow you to access the hard drive on your machine. The “geeky” part
is simply knowing how to navigate around in Linux.
(*) Note: Though I use the word “delete” above, it’s
actually safest to copy the files to another location, or preferably
to a floppy disk or some other removable media. There’s always a slight chance
that the files are actually required and you’ll need to be able to restore
them should your system fail to boot. In a case like that, if things really are
that damaged, then a repair install of Windows may be called for.