Leftover from malware

XP Pro SP3. I am the only user.

I recently acquired some malware apparently centered around one "jfpvilh.exe." AVG 8 was oblivious to it. A rootkit detector discovered it.

I appear to have it removed except that there is a folder (named 2F43026092684600) left over in my private, temporary (not "temp") download folder. Some parts of windows say it is empty. (jfpvilh.exe was originally in it but now it is not) Some say it is not empty. All attempts to open it, remove the "read only" attribute, delete it or do anything to it are futile - even in safe mode. I always get an error saying the folder is "inaccessable."

Oops, take it back. Rename will work on it.

There was a specific entry in the registry for jfpvilh.exe which I deleted.

I see a lot of file and process killers but nothing for folders. Am I stuck with this nut case folder or are there utilities that can kill it?

JimLL

 

Double checking about CCLEANER

I hope this isn't an unacceptable question.

If I read correctly, one should not ask for malware help here if he has even any legitimate, regularly used cookies on his system, right? That is, all commonly used website setups must be trashed?

I use cookies only when absolutely necessary and then single session ones if possible. And I run cookie cleaner utilities regularly. But some forums and services I visit regularly absolutely _require_ cookies and most are a major pain to get into without them. So I really hesitate to simply destroy all my legitimate cookies (and caches) by running ccleaner at default as directed.

JimLL

 

Re: Double checking about CCLEANER

I must be misunderstanding something.

The instructions say to run CCleaner WITHOUT changing any settings. I ran the analysis feature and it listed all of my cookies (along with much else). The question appears to be, are we to follow the "do not change settings" instructions or not? It appears that running it without changing any settings will delete everything shown in the analysis - which would do what I asked about. Is that NOT how it works?

JimLL

 

Please follow the instructions in the READ & RUN ME FIRST link given further down and attach the requested logs when you finish these instructions.

• If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.
  • TDSSserv Non-Plug & Play Driver Disable
• If something does not run, write down the info to explain to us later but keep on going.
• Do not assume that because one step does not work that they all will not.

READ & RUN ME FIRST. Malware Removal Guide


Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in Safe Mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. To avoid additional delay in getting a response, it is advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!
4. Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

 

Re: Double checking about CCLEANER

Forget the analyze button, click on options and then cookies. From here, select the cookies to keep and then run the program!

By the way, please stay in one thread.

 

Re: Double checking about CCLEANER

Sorry, I thought I read that you're supposed to only have one subject per thread.

JimLL

 

I was reading that when I found the instructions to run CCleaner without changing it, which is why I asked in the first place.

JimLL

 

Re: Double checking about CCLEANER

If it's all related to one computer then one thread should be created, create additional threads for any other computers.

Okay! Just attach the logs once complete.