# Solved: virus spreading by creating exe in the name of parent folder with the folder



## venkatepost (Feb 13, 2006)

Hi I have been facing problem (breaking my head day & night to solve this) with some malware/ spyware kind of thing which is keep on creating the virus files (exe) in the name of parent folder with folder icon. The file size of the created file is 789kb. I have suspected the files regsvr.exe, rundll.exe, winhelp.exe and killed those processes, files from windows-system32 folder & in other places, also removed the startup entry from the registry but eventhough it's starting from next boot, I have scanned my system even in safemode after disabling windows restore.

I am using Symantec Corporate Edition 8.0 with latest updated definitions and Spybot S&D 1.5.2 with fully updated as of today. None of these are identifying the trojan activity. I have also tried online scan thru symantec and trend micro both says no virus. Spybot says there is a spyware "007 spy software" infection it's fixing it, but still no use from next boot onwards any of those three files will start running.

I don't know from where it's coming back after I deleted those files from the system with that names.

it's also creating a autorun.ini (with the code to run the file rundll.exe), copying regsvr.exe in the shared drives and in pen drives.

Since no antivirus is identifying these virus to know the name to get a fix, Iam not able to solve this.

It will be helpfull some one can help me on this issue to solve.

my mail id is [email protected]


----------



## venkatepost (Feb 13, 2006)

finally I have found the solution for the issue.

1. Turn Off the "System Restore".

Select my computer icon in the desktop and right click then click on properties you will get a window with multiple tabs select the System restore tab and check on the "Turn off system restore". 

2. Delete the hidden "SSData" folder in "C:\Windows\System32"

Type the above path in the Run or Windows Explorer, then select it's content or the entire folder and press del key to remove. The above SSData folder will be in hidden.

3. Remove virus startup entries in "MSconfig"

This you must do very careful to avoid problems in loading windows/ other programs

4. Use Symantec Corporate Edition 10.0 to remove viruses 

To remove this virus created files in the name of parent folder and virus files you must have the Symantec Corporate Edition 10.0 and above recent versions of Norton products with latest definitions.



Regards



Venkat


----------

