What is this?

He can't. That's what he's saying.

 

It is just in a cycle of asking what mode I want to start up in. I hit safe mode and it reboots only to be at the same screen again (what mode do you want to be in) It doesn't stop at safe mode upon reboot just back to that screen. I wonder if I can boot up to my Windows XP disc and then go into safe mode

 

I'm sorry about your problems. I have no problems going into and out of safe mode. You should be able to boot using your XP disk. Once you get back into normal mode, just uncheck lich.exe, find it on your harddrive and then delete it. Any Spyware removal program should be able to remove it for you. I use Ad Aware and Spybot. Both are free.

 

That's what I thought. I ran both Spybot, and Adaware and Windows One Care and all couldn't delete it but could quarantine it. Quarantine doesn't get rid of it though. You can find it on the hard drive and delete it because it says it is running somewhere else. So I am going to go home and boot off of the XP Boot CD and into safe mode. Uncheck the LICH.exe and then run adaware and Spybot and Windows One. I "should" be able to delete it then. I think I read from the link posted earlier that this virus was transmitted via some java application? Not sure
<fingers crossed>

 

try to rename the file

 

Do you have the latest version of MS Antispyware? If you do you need to disable the BHO for lich.exe that's why it keeps coming back when you open your browser.

 

Either that or some other process (that won't be listed in the obvious places) is replacing it automajically. That's why a safe mode scan is necessary.

 

I agree a safe mode scan is necessary, but by blocking the BHO it could be deleted. From what I've read so far on it its a BHO, and will return when the browser is started. That would make sense now. I wasn't able to learn this until I found it under the new name.