Folders Duplicating with .exe

Status
Not open for further replies.

PuP

Contributor
Saturday Night was the last time i saw my Comp behaving normally . After that it was all f****d up .

All my folder's are duplicating inside themselves with an exe .

Like if there's an folder NFSMW in D drive , NFSMW creates another folder NFSMW inside itself with an exenstion exe.Its afftected to all my drives .

Some of these can be deleted whereas some not( access denied) . Its not possible for me to delete all folders manually.

After some googling on this i found a program called Clone Remover . But clone remover only removes the folders temporary. After 10-15min all those folders are again created .

Ive formatted windows as well . But still no solutions. Its really serious for me I've got 800Gb storage and all my drives are affected :( :( :( :( :( :( :(
 
its called the Win32.pinfi virus. reinstalling windows will not do anything if it has spread throughout the hdd
 
scan using a good antivirus and then an anti-spyware? I thought that was self explanatory :P

I would suggest Antivir and spybot. Both are free :)
 
I had this in one of my P3 machines till a month ago, spreads quite rapidly and will attach itself to any removable drive.

Tried to clean it up with eset and more but all in vein.

I only had ~3GB of important documents on the system which I copied onto a pendrive.

Cleaned the pendrive on my current system with ESET 3.0.XXX, did a fantastic job. Formatted the infected HDD and reinstalled WinXP.

p.s. - you could try a portable eset nod32 or for that matter any portable antivir, this would allow you to skip all installation hassle's.
 
Here is a link for you to download a fix

Cleaning Utility for Win32.Pinfi - CA

Reboot to safemode and run it.

The details about the virus from the Symantec site follows

###########
Discovered: October 11, 2001
Updated: February 13, 2007 11:42:23 AM
Also Known As: Win32.Parite.a [KAV], W32/Pate.a [McAfee], Win32.Pinfi.A [CA], PE_PARITE.A [Trend], W32/Parite-A [Sophos], Win32/Parite.A [RAV]
Type: Virus
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
W32.Pinfi is a memory-resident polymorphic virus that will infect the .EXE and .SCR files. This virus can also spread via mapped drives and network shares.
Protection

* Initial Rapid Release version October 12, 2001
* Latest Rapid Release version September 13, 2008 revision 022
* Initial Daily Certified version October 12, 2001 revision 007
* Latest Daily Certified version September 13, 2008 revision 021
* Initial Weekly Certified release date October 17, 2001

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild

* Wild Level: Low
* Number of Infections: More than 1000
* Number of Sites: More than 10
* Geographical Distribution: High
* Threat Containment: Moderate
* Removal: Moderate

Damage

* Damage Level: Low

Distribution

* Distribution Level: Medium
################
 
^^ :lol: you are lucky if it works for you.. i tried the same on my system and somehow it got converted to .exe from .com the moment i ran it.. and it got eaten by the virus. Eventually, i had to format the entire drive. Am not scaring you but thats the way it went for me :|.. good luck
 
Supra said:
One thing for sure...all your rar / self extracting files / .exes are gone :P

Nothing like that. Don't use any other tool to clean the drives. An updated Avast boot-scan has helped me repair/ recover lotsa instances of the same situation. After the boot scan is over, run SD Fix to reset any registry changes. Disable auto run and scan/ fix all ur pen drives. Make sure show hidden files/system files is activated and enter all removable drives thru the address bar. Delete any suspicious files/*.infs from the pen drives which the Avast scan might have missed.
 
mcafee 8.5+ mcafee antispyware edition combo solved this problem for me.
formating is not the solution... scan entire system and configure mcafee in maximum protection mode and exclusive scanning.
 
Status
Not open for further replies.