up vote 0 down vote favorite
share [g+] share [fb]

I have a System32 folder (containing programs.exe, svchost.exe, taskeng.exe) and a SYS folder (containing winupdate.exe) in the My Documents folder in Windows XP. Virus scans do not raise anything, but I do not remember moving or copying those folders into My Documents? How did they get there?

link|improve this question
Do you have the normal system32 folder in the Windows folder? – Moab Jul 25 '10 at 14:36
Yes, I do. Thanks – Daniel Sopel Jul 25 '10 at 23:36
feedback

2 Answers

up vote 2 down vote accepted

You are most certainly infected. For one, system32 should not be in My Documents. Googling for winupdate.exe shows that it is part of several different trojan horses, a few of which are backdoors. It is likely that other viruses have been installed on the computer as part of the backdoor. I recommend you reformat and reinstall, as there's no telling what viruses it could have installed.

link|improve this answer
There should be a Windows folder in the profile folder, so don't delete that if you do decide to attempt cleaning the computer. – Hello71 Jul 26 '10 at 22:26
Or when restoring the backup. – Hello71 Jul 26 '10 at 22:34
feedback
up vote 0 down vote

You could ZIP/RAR the folder and then delete it. Just make sure you have the zip file somewhere safe. Then restart your PC and make sure it's still working. If everything is Ok, good for you. If you have any problems, restart Windows in Safe Mode (hit F8 during boot) and restore the folder from the compressed file you saved before.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.