Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

Windows XP system is affected by a folder.exe virus. It is creating an exe file with the name of the folder and getting deleted while we try deleting, but again generates the same file after some. Can we solve it permanently.

share|improve this question

migrated from serverfault.com Dec 12 '09 at 22:41

This question came from our site for professional system and network administrators.

marked as duplicate by Oliver Salzburg Aug 19 '12 at 14:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

3 Answers

The Right Answer(tm) whenever a computer has become "infected" with malicious software is to backup the data and reload the machine from a known-clean OS install media (ideally from read-only optical media, too). Anything less than that is just a charade. Once malicious software (effectively just another kind of malicious attacker) has had "Administrator" access to a machine its operating system load and application software should never be trusted again.

share|improve this answer
1  
Far too many times has someone "gotten rid of the virus" just to have it start spreading the next day. –  sparks Dec 12 '09 at 13:18
    
Of course, you need to scan the backed up data to be sure it's clean too... –  Adam Ryan Dec 13 '09 at 6:26
add comment

You need to nuke the machine and reload it. This should be trivial for a business machine, and if it isn't then you currently need to fix things so that it is trivial in the future. Leaving aside the issues Evan raises (and which I totally agree with), it's also often the most effective use of employee time - it can take a long time to "clean" an infected machine to the point where you're 99% certain it really is clean (and then there's that 1%...) and the time to do re-load your standard image will be shorter, at least in terms of admin time needed.

Also, and just as importantly, you need to figure out where the infection came from, how it eluded whatever AV/Security precautions you currently have in place and what you are going to do to lock things down and prevent it happening again.

share|improve this answer
add comment

While Evan is right from an ideal perspective, pragmatism sometimes demands that you get rid of the virus. Have you simply tried running an up-to-date antivirus program (I can't tell one way or the other from the original post)? Looking on the internet, the "folder.exe" virus came out sometime in 2007, which means most (all?) antivirus programs should be able to find and remove it. Try downloading and running Microsoft Security Essentials (which is free) and see if it takes care of removing it:

http://www.microsoft.com/security%5Fessentials/

share|improve this answer
1  
-1. I would not bet that antivirus software is able to clean up an infection. Even if the symptoms of the particular piece of malware look familiar, how can you be sure that it's not a new, improved version with new ways of hooking into the system and disabling AV products? Antivirus vendors are in an arms race that they have already lost. –  hillu Dec 13 '09 at 0:22
add comment