Computer Hope

Software => Computer viruses and spyware => Topic started by: pirosko on May 31, 2009, 08:29:34 AM

Title: Virus identified, need system 32 file restored??
Post by: pirosko on May 31, 2009, 08:29:34 AM

I have two files that have been infected, and quarantined. They were both infected by the virus "W32/BACKDOOR2.EMEB".

The two files are:
C:\Windows\system3dllcache\ftp.exe
C:\window\systems32\ftp.exe

My system told me to basically reinstall these 2 files or it may not operate properly. I thought I could update my system but my system is now running Service Pack 3, my system install  disk is version 2002, so is not up to the current operating level.

Basically, what are my options and how do I get these files back?
and what do these 2 files do, or what are the ramifications of ignoring the warning???

Thanks for any help.

Here is my system description:

 Microsoft Windows XP
Home Edition
Version 2002
Service Pack 3

Intel® Corel  ™ 2 Duo CPU
E 4600 @ 2.4 GHz
2.40 GHz, 1.99 GB RAM

ASUS P5GC-MX/1333 Motherboard

On Board Sound Cards
Legacy Audio Drivers
Realtek HD Audio Output
   

Title: Re: Virus identified, need system 32 file restored??
Post by: Helpmeh on May 31, 2009, 01:02:07 PM

Quote from: pirosko on May 31, 2009, 08:29:34 AM

The two files are:
C:\Windows\system3dllcache\ftp.exe
C:\window\systems32\ftp.exe

I can tell that the bottom one is made to look like system32, but is not, and I'm fairly sure about the top one too...I think you should be fine, but just in case, follow as many steps as possible here: http://www.computerhope.com/forum/index.php/topic,46313.0.html

Title: Re: Virus identified, need system 32 file restored??
Post by: evilfantasy on May 31, 2009, 01:22:55 PM

Those are most likely false positives. http://www.bleepingcomputer.com/filedb/ftp.exe-962.html

Can you restore them from the antivirus quarantine?

Title: Re: Virus identified, need system 32 file restored??
Post by: Helpmeh on May 31, 2009, 01:28:37 PM

Quote from: evilfantasy on May 31, 2009, 01:22:55 PM

Those are most likely false positives. http://www.bleepingcomputer.com/filedb/ftp.exe-962.html

Can you restore them from the antivirus quarantine?

Look where the files are though...

Title: Re: Virus identified, need system 32 file restored??
Post by: pirosko on May 31, 2009, 01:30:13 PM

Thanks to both of you, helpmeh and evilfantasy. I was afraid to import it back from the antivirus as it leads me to believe that the virus will come back as well. I will review again though to see if there are other options. Also I will scroll through all of the info from helpmeh to see if I can plod through it. 

I am a little less worried by your comments though. Thanks again for the quick response.

Title: Re: Virus identified, need system 32 file restored??
Post by: evilfantasy on May 31, 2009, 01:31:02 PM

This one is right. C:\window\systems32\ftp.exe

This one is most likely a backup copy. C:\Windows\system32\dllcache\ftp.exe

Title: Re: Virus identified, need system 32 file restored??
Post by: evilfantasy on May 31, 2009, 01:31:52 PM

Helpmeh, check your PM's.

Title: Re: Virus identified, need system 32 file restored??
Post by: pirosko on May 31, 2009, 01:33:51 PM

If I could find the right file as you indicated could I copy and paste it from my XP cd into my system?? Or doesn't it work that way?

Title: Re: Virus identified, need system 32 file restored??
Post by: evilfantasy on May 31, 2009, 01:36:22 PM

If it's on your CD then it will likely be at:

C:\Windows\system32\dllcache\ftp.exe

Or on your hard drive at:

C:\WINDOWS\ServicePackFiles\i386

Or

C:\WINDOWS\i386