[vkvladman]

Hi, I found some internet worms on my computer a couple of days ago I don't think there bad, no new ones have come up, but I'm not sure if i should wipe them because they sound like inportant computer files. The first one is: C:\WINDOWS\b.exe, that one has a worm\spybot.28.BQ. but the file is a backup copy. The second one is C:\System Volume Information\_restore { then a bunch of numbers and letters} .exe, that is also a worm/spybot.28.BQ but it's not a backup file.

If someone could please tell me if it's okay to wipe it would be greatly appreciated.
Thanks

[lunarlander]

Which version of Windows are you using ? On my Vista box, there is no b.exe in C:\Windows.

Why do you say that the file is a backup copy?

[vkvladman]

I'm using Windows XP SP2
When I click on the description of the worm, it says that b.exe if a backup file.
I think b.exe was created by the worm but i'm not sure, because I don't have b.exe on my other computer.

[DarqueMist]

C:\System Volume Information\_restore { then a bunch of numbers and letters} .exe

that looks like it is a system restore point. The only way you will be able to remove it is to purge all your restore points. I'm not going to suggest you do anything yet though as I googled b.exe and that looks like it could very well be a worm. Removing bits and pieces could leave stuff behind that causes more trouble for you.

I suggest that you go to the hijackthis board post your problem along with a hijackthis report to let the malware removal experts have a look at it.