1

Possible Duplicate:
virus-duplicated-user-account-on-xp?

I had an old netbook running windows xp. I lent it to a friend and now it has a bizzare virus.

Here are the symptoms. Everytime I boot up the computer, it says I have 0 harddrive space left, no matter how many files I delete.

When I go into Documents and Settings, then look at the list of users I see over 40 user accounts each with very bizzare names.

for instance, I saw Avi, Avi.CRICKET.000, Avi.CRICKET.001 etc until Avi.CRICKET.020 and the same on another account. I also saw a TEMP folder that looked like a user account.

When I log into the computer, I don't see my normal desktop image and icons. When I tried to delete Avi.CRICKET.020 it said the file was in use.

This makes me believe that the virus is creating these extra accounts which doesn't allow me proper access to delete files or install an anti-virus but does allow it to use IE to do it's bot attacks or whatever.

I've tried deleting all those .CRICKET accounts and loggin in normally again, but when I do, I find another CRICKET folder created.

What files can I edit to get rid of this? Thanks.

edit----

I should add, That this computer does not have a CD drive, and I've searched all over google and couldn't find anything.

edit 2---

The answer I'm looking for, would be something which tells me which files I should look for, or a reg edit I should do, to remove these duplicate accounts so I can boot from my main account and run the proper tools. Other possible answers would be the identity of this virus so I know what it is doing or can find details about what its doing so I can fix it. Thanks.

Improve this question
8
  • 2
    I think, that this question has been closed because the possibility of someone giving an answer that has not been given in the linked article is very low. If there is someone who can specifically adress your exact problem he could flag for reopening the question. Althoug it might still count as "too localized". – Baarn Jan 16 '12 at 19:30
  • If you really don't want to reinstall, you can try booting into Hiren's Boot CD (hirensbootcd.org/download), which you can also install on a USB stick. This should be completely seperate of your current install. HBCD comes packed with all sorts of virus and malware scanners, which you can scan with. The users' files you mention should also not be in use, so you can delete them as well. – Simon Verbeke Jan 16 '12 at 20:35
  • As the name can be different depending on the variant or the tool you use to remove, I am not sure what meaningful answer would be provided. If you follow the suggestions, you would likley find a name. – Dave M Jan 16 '12 at 20:37
  • Again, what I'm looking for is someone to read this and think, "Oh yeah, I heard about that X years ago, that thing was nasty, sounds like the ABC worm that went after credit card data..." Talk about formating hardrives, or installing windows is not the question I'm asking. – avi Jan 16 '12 at 21:24
  • 1
    @avi That's not the way you should edit out the (system-added) duplicate message though. Please don't be this snarky … that helps nobody. – slhck Jan 17 '12 at 8:03
3

The only way to be safe is to do a format of your harddrive and reinstall Windows. Next time, don't let a user login as an administrator.

Improve this answer
2
  • 1
    Would if I could... – avi Jan 16 '12 at 19:00
  • 2
    I'm sure you can install Windows from a USB stick. – ZippyV Jan 16 '12 at 19:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.