Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Virus identified, need system 32 file restored??  (Read 2051 times)

0 Members and 1 Guest are viewing this topic.

pirosko

    Topic Starter


    Rookie
    Virus identified, need system 32 file restored??
    « on: May 31, 2009, 08:29:34 AM »
    I have two files that have been infected, and quarantined. They were both infected by the virus "W32/BACKDOOR2.EMEB".

    The two files are:
    C:\Windows\system3dllcache\ftp.exe
    C:\window\systems32\ftp.exe

    My system told me to basically reinstall these 2 files or it may not operate properly. I thought I could update my system but my system is now running Service Pack 3, my system install  disk is version 2002, so is not up to the current operating level.

    Basically, what are my options and how do I get these files back?
    and what do these 2 files do, or what are the ramifications of ignoring the warning???

    Thanks for any help.

    Here is my system description:

     Microsoft Windows XP
    Home Edition
    Version 2002
    Service Pack 3

    Intel® Corel  ™ 2 Duo CPU
    E 4600 @ 2.4 GHz
    2.40 GHz, 1.99 GB RAM

    ASUS P5GC-MX/1333 Motherboard

    On Board Sound Cards
    Legacy Audio Drivers
    Realtek HD Audio Output
       

    Helpmeh



      Guru

    • Roar.
    • Thanked: 123
      • Yes
      • Yes
    • Computer: Specs
    • Experience: Familiar
    • OS: Windows 8
    Re: Virus identified, need system 32 file restored??
    « Reply #1 on: May 31, 2009, 01:02:07 PM »
    The two files are:
    C:\Windows\system3dllcache\ftp.exe
    C:\window\systems32\ftp.exe
    I can tell that the bottom one is made to look like system32, but is not, and I'm fairly sure about the top one too...I think you should be fine, but just in case, follow as many steps as possible here: http://www.computerhope.com/forum/index.php/topic,46313.0.html
    Where's MagicSpeed?
    Quote from: 'matt'
    He's playing a game called IRL. Great graphics, *censored* gameplay.

    evilfantasy

    • Malware Removal Specialist
    • Moderator


    • Genius
    • Calm like a bomb
    • Thanked: 489
    • Experience: Familiar
    • OS: Windows 10
    Re: Virus identified, need system 32 file restored??
    « Reply #2 on: May 31, 2009, 01:22:55 PM »
    Those are most likely false positives. http://www.bleepingcomputer.com/filedb/ftp.exe-962.html

    Can you restore them from the antivirus quarantine?

    Helpmeh



      Guru

    • Roar.
    • Thanked: 123
      • Yes
      • Yes
    • Computer: Specs
    • Experience: Familiar
    • OS: Windows 8
    Re: Virus identified, need system 32 file restored??
    « Reply #3 on: May 31, 2009, 01:28:37 PM »
    Those are most likely false positives. http://www.bleepingcomputer.com/filedb/ftp.exe-962.html

    Can you restore them from the antivirus quarantine?
    Look where the files are though...
    Where's MagicSpeed?
    Quote from: 'matt'
    He's playing a game called IRL. Great graphics, *censored* gameplay.

    pirosko

      Topic Starter


      Rookie
      Re: Virus identified, need system 32 file restored??
      « Reply #4 on: May 31, 2009, 01:30:13 PM »
      Thanks to both of you, helpmeh and evilfantasy. I was afraid to import it back from the antivirus as it leads me to believe that the virus will come back as well. I will review again though to see if there are other options. Also I will scroll through all of the info from helpmeh to see if I can plod through it. 

      I am a little less worried by your comments though. Thanks again for the quick response.

      evilfantasy

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Calm like a bomb
      • Thanked: 489
      • Experience: Familiar
      • OS: Windows 10
      Re: Virus identified, need system 32 file restored??
      « Reply #5 on: May 31, 2009, 01:31:02 PM »
      This one is right. C:\window\systems32\ftp.exe

      This one is most likely a backup copy. C:\Windows\system32\dllcache\ftp.exe

      evilfantasy

      • Malware Removal Specialist
      • Moderator


      • Genius
      • Calm like a bomb
      • Thanked: 489
      • Experience: Familiar
      • OS: Windows 10
      Re: Virus identified, need system 32 file restored??
      « Reply #6 on: May 31, 2009, 01:31:52 PM »
      Helpmeh, check your PM's.

      pirosko

        Topic Starter


        Rookie
        Re: Virus identified, need system 32 file restored??
        « Reply #7 on: May 31, 2009, 01:33:51 PM »
        If I could find the right file as you indicated could I copy and paste it from my XP cd into my system?? Or doesn't it work that way?

        evilfantasy

        • Malware Removal Specialist
        • Moderator


        • Genius
        • Calm like a bomb
        • Thanked: 489
        • Experience: Familiar
        • OS: Windows 10
        Re: Virus identified, need system 32 file restored??
        « Reply #8 on: May 31, 2009, 01:36:22 PM »
        If it's on your CD then it will likely be at:

        C:\Windows\system32\dllcache\ftp.exe

        Or on your hard drive at:

        C:\WINDOWS\ServicePackFiles\i386

        Or

        C:\WINDOWS\i386