detecting virus on all exe files

[nack_4_film]

Hi hopefully someone can assist me.

I have detected a virus attached to my exe files. before I format my drive, I was hoping that perhaps there's another way around this situation.

I've done several scans using Panda, it claims to disinfect almost everything, however, there's always a few left over. Whenever I reboot I get the message that my C:\WINDOWS\p_981116.exe is corrupt. When I go through my file find, all my exe profiles are about 10k larger than they should be.

I know what this is, I just want to know if anyone has heard of it and if I can get rid of it.

Thanks.

 

[TonyKlein]

I don't think you'll need to format your drive.

First, what operating system are you running?

And please do this:

Go to http://www.spywareinfo.com/downloads.php#startup , and download 'Startuplist'.

Unzip, doubleclick it, and it will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more.

Go to Edit > select all, copy it and post the contents here.

If you have problems executing Startuplist.exe, rename the file to Startuplist.com

 

[nack_4_film]

unfortunately, I tried to open the file after unzipping it and my error msg states that the program has performed an illegal function and will be shut down.

THe only other times I'm getting this msg was with a ddcmigrate, and my y_msgrtray.

THanks for the help.

 

[steamwiz]

You may need the .exe fix - what o\s are you using ?

 

[nack_4_film]

I'm using Windows98.

THanks for the assistance, I do appreciate this.

 

[Rollin' Rog]

What is the name of the virus Panda found? There are some that corrupt all new installs, such as "Spaces" and add filler to exe's. If it is Spaces there may be a removal tool available, however the BitDefender site where it resides is not responding right now.

The exefix08 file which Steamwiz refers to may help you out. Although it does not clean infected files, it repairs the registry when those virus files are being called when they shouldn't.

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

There is an unzipped version available through the ONLY IE link at the bottom of the Toys page