Posted 06 October 2007 - 04:05 PM
This only happens on my Toshiba laptop, occasionally I get this, and only a system restore or fresh re-install works, on to the explanation.
I run dial-up, so it is especially bad for me! What happens is, randomly, two files (possibly more, but I've located only two for now) gets created on my computer, and their whereabouts are unknown. I use the latest Mozilla Firefox and Thunderbird, and I have NOD32 expired anti-virus. (Though I have the latest update, the last update that was applied was yesterday before it expired.) I've scanned my entire system with it, no viruses found, great! Then, when those two files appeared randomly, (I know, because for some reason it eats up my dial-up connection), I scanned them too. Again, no virus detected.
t2.exe is created in C:\, and I see has really no purpose, but seems to get bigger as time passes by. I replace it with a dummy file, replaces fine, and stays at 0kb. Now, NOTEPAD.exe is another small file, invisible, running as a SYSTEM process, and is located in C:\WINDOWS\system. Now, that shouldn't be, as a NOTEPAD.exe file shouldn't exist there, and more importantly, shouldn't be running as a SYSTEM process! (Take note that NOTEPAD.exe doesn't auto-run when Windows is started in safemode.
I can replace NOTEPAD.exe by first terminating the process, and then quickly replacing it with a dummy file. I don't understand how I got these files on my drive, as I am a safe browser, and I have adblock installed, and I don't download "suspicious" files. Especially .EXE files.
Now, my dial-up still takes a hit, after replacing those files, but I can't seem to locate the other possible generated files, and secondly, what they are downloading,
If you can help, it would be greatly appreciated, though I don't have the original files from above. Already replaced with dummy files.
Toshiba Satellite 5205-S5151
Windows XP Pro
Thanks you very much!
It seems as I was typing this, NOTEPAD.exe was re-generated, replacing my dummy NOTEPAD.exe! And t2.exe was also regenerated. I will be copying these files to a remote place, if needed by you guys!