I have a System32 folder (containing programs.exe, svchost.exe, taskeng.exe) and a SYS folder (containing winupdate.exe) in the My Documents folder in Windows XP. Virus scans do not raise anything, but I do not remember moving or copying those folders into My Documents? How did they get there?
-
Do you have the normal system32 folder in the Windows folder? – Moab Jul 25 '10 at 14:36
You are most certainly infected. For one, system32 should not be in My Documents. Googling for winupdate.exe shows that it is part of several different trojan horses, a few of which are backdoors. It is likely that other viruses have been installed on the computer as part of the backdoor. I recommend you reformat and reinstall, as there's no telling what viruses it could have installed.
-
There should be a Windows folder in the profile folder, so don't delete that if you do decide to attempt cleaning the computer. – Hello71 Jul 26 '10 at 22:26
-
You could ZIP/RAR the folder and then delete it. Just make sure you have the zip file somewhere safe. Then restart your PC and make sure it's still working. If everything is Ok, good for you. If you have any problems, restart Windows in Safe Mode (hit F8 during boot) and restore the folder from the compressed file you saved before.
