Why do deleted exe files come back?

Question

I noticed on one computer running XP SP2 that when I delete some exe files (Examples: spider.exe, spoolsv.exe) from c:\Windows\System32 folder, that they came back. I thought it is a virus. So, I checked on another computers. One of them have the same. Is this normal?

Answer 1

Those files are critical parts of Windows XP and it's trying to rescue itself with Windows File Protection.

Answer 2

For the well-being of your computer...

Avoid modifying manually the contents of C:\Windows

... unless you are very sure of what you are doing.

If you don't know, assume the files are Windows system files and leave them alone. Google a file name if you aren't sure.

Answer 3

System files are in many ways similar to the voltage switch on your PSU: They are not to be tinkered with.

Answer 4

Yeah, its normal! If you want to delete a file from system 32, use the unlocker application to do so! You can use an antivirus software to find out if a program is a virus or not, then use the delete feature in the antivirus software!

And don't make deductions for a virus based on your instincts! Usually viruses would be a hidden file!! If you find a suspicious file search for it on the net! And use some online scanners! Yeah its time consuming, but its worth it!

Answer 5

spoolsv.exe is (usually) a print spooling service. spider.exe is part of the e-mail scraper service. Both are part of Windows XP, and although I've not heard of it could I guess can be regenerated on start-up.

If however, the .exe files are something else, then yes, you should be worried.

Why did you delete them anyway? Did you have evidence of their being dubious?

Sources: File.net: spider.exe, File.net: spoolsv.exe.

These give other info like file sizes to help check authenticity.