Discussion Locked

HELP

0 helpful
6 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

unknown virus detected ... anti virus program unable to disinfect. scanned.... no virus detected.
the virus was found in the following file..

--> d:\docume~1\username~1\local~1\pic32.tmp.exe
--> d:\docume~1\username~1\local~1\pic33.tmp.exe
--> d:\docume~1\username~1\local~1\pic64.tmp.exe
--> d:\docume~1\username~1\local~1\pic70.tmp.exe

delete next reboot box, checked, rebooted.... message keeps popping up... scanned over and over... no files infected... why the D: drive???

help me!!

6 replies

by garydw

I notice that your 'virus' is appearing in documet~1 - Thats normally your documents and settings folder so:

1. Do you have roaming profiles?

2. Do you have any suspect services running that could be recreating/downloading this virus?

3. Do you have any suspect programs running under HLM/Run or similar that could be doing the same?

by w2ktechman

get an update for your AV program, from another system and put it on dosk, flash drive, etc.
Boot infected system into safe mode.
delete files, empty c:\docs&set\profile\localset\temp
systemroot\temp
c:\temp
systemroot prefetch

turn off system restore
regedit -- look under
HKLM and HKCU
\software\microsoft\windows\currentver\run, runonce, runonceex
look for what loads, backup these folders before doing anything else (I export to my desktop).
remove any offending entries. If you are unsure do a web search for each file name
update AV and scan
obtain antispyware utils from a different system and put on a disk,
install and scan
if it all looks good, reboot and try again.

by sgt_shultz

i take it you have no d: drive. give us more: what antivirus? did you run it in safe mode? maybe it is reinfecting...altho that doesn't answer your d: drive question...
you run it with system restore off, yes? and in all the user profiles, yes? and you manually searched for these fishy *tmp.exe files and deleted them, yes?

This discussion is closed to new replies.