1

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

Windows XP system is affected by a folder.exe virus. It is creating an exe file with the name of the folder and getting deleted while we try deleting, but again generates the same file after some. Can we solve it permanently.

0

3 Answers 3

6

The Right Answer(tm) whenever a computer has become "infected" with malicious software is to backup the data and reload the machine from a known-clean OS install media (ideally from read-only optical media, too). Anything less than that is just a charade. Once malicious software (effectively just another kind of malicious attacker) has had "Administrator" access to a machine its operating system load and application software should never be trusted again.

2
  • 1
    Far too many times has someone "gotten rid of the virus" just to have it start spreading the next day.
    – sclarson
    Dec 12, 2009 at 13:18
  • Of course, you need to scan the backed up data to be sure it's clean too...
    – Adam Ryan
    Dec 13, 2009 at 6:26
2

You need to nuke the machine and reload it. This should be trivial for a business machine, and if it isn't then you currently need to fix things so that it is trivial in the future. Leaving aside the issues Evan raises (and which I totally agree with), it's also often the most effective use of employee time - it can take a long time to "clean" an infected machine to the point where you're 99% certain it really is clean (and then there's that 1%...) and the time to do re-load your standard image will be shorter, at least in terms of admin time needed.

Also, and just as importantly, you need to figure out where the infection came from, how it eluded whatever AV/Security precautions you currently have in place and what you are going to do to lock things down and prevent it happening again.

0

While Evan is right from an ideal perspective, pragmatism sometimes demands that you get rid of the virus. Have you simply tried running an up-to-date antivirus program (I can't tell one way or the other from the original post)? Looking on the internet, the "folder.exe" virus came out sometime in 2007, which means most (all?) antivirus programs should be able to find and remove it. Try downloading and running Microsoft Security Essentials (which is free) and see if it takes care of removing it:

http://www.microsoft.com/security_essentials/

1
  • 1
    -1. I would not bet that antivirus software is able to clean up an infection. Even if the symptoms of the particular piece of malware look familiar, how can you be sure that it's not a new, improved version with new ways of hooking into the system and disabling AV products? Antivirus vendors are in an arms race that they have already lost.
    – hillu
    Dec 13, 2009 at 0:22