(0_0) virus problem

Question

I have a virus that shows up as an (0_0).jpg (which is a script) file and is paired with an autorun.inf on any portable device. I cant find what it does to files, if it's pushing data out of the network, , but it is extremely annoying. Does anyone know how to kill this thing? Google hasn't been any help. So far all I see it doing is slowing down machines.. It also adds a winxp.exe under system32 in windows XP. This thing is driving me crazy.

Answer 1

winxp.exe is a process which is registered as W32.Beagle.AG@mm

Manual removal instructions:

1. Restart your computer in safe mode.

2. Open Task Manager; if winxp.exe is running, end the process.

3. Delete winxp.exe

4. Open the registry editor and navigate to:

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   

5. In the right panel, locate and delete the entry:

   “%System%\winxp.exe”
   

6. Exit the Registry Editor, restart your computer.

Answer 2

Sorry obvious question, can you virus scan it and get a heuristic signature on the virus type? That would allow you to then make a practical search on a solution to get rid of it.

Posting a 'file name' doesn't help as sometimes the viruses infect via different files, and rename themselves as protective measures against deletion.

Answer 3

There are a couple of things you can use to start to try to get rid of this. Multiple virus scanners will detect some viruses that others do not. Try with AVG, Avast, and the free TrendMicro online one HouseCall.

Another thing to try is HijackThis. You can take the log file that is generated and analyze it here. One program that I have used to kill some processes that have been missing from the task manager is Process Explorer. It may not see what you are looking for.