ok i have some damn spyware and its called win27a5.tmp.exe and the only place i find it is in my prefetch folder, everytime i clean it out and restart it comes back >< so i need to find out how to get rid of it for good
Jeff is a mean boss
28th July 2002
have you ran scans with programs like Ad-Aware, Spybot S&D, Windows Defender, etc??
You can disable the prefetch manually in the registry. That will at least keep the thing from loading itself into memory on boot. Then you'll need to dig it out manually at that point, but at least you won't have it running in the background on that account.
ok so this is pissin me off, i installed spybot and adaware, and both havent found it, i dled an ATF cleaner and hijackthis, nothing can get rid of this junk, i did alil research and found out its from search assistant, but for microsoft, possibly >< but its actually a trojan horse, and i can find the horse to remove it, it just keeps making tmp (temp) files and trys to connect tothe net, anyone kno how to get rid of this crap??!
Download a program call Ewido. Unfortunatly it's a trial but it will work good!
wow, i dled it, installed it and like 30 second later it found it........ well see if it actually removes it tho :) thx julz
Thats ok.... I hope it gets rid of it :)
well now after i scanned twice it found a bunch more stuff and quantined it, but before it finished it kept on tryin t connect blah balh
in norton, it switched from always block to always allow and i didnt catch it and allowed it once, looked in my log files for hte ip of that instance and blocked it on all ports and such. so hopefully nothin got threw :(
Exe's should not be in that folder but this has nothing to do with the actual Prefetch files or the Windows Prefetcher. Do NOT clean the Prefetch folder, simply delete the infected file and do NOT disable Windows Prefetching. Nothing is loaded at startup in relation to prefetching, these are all Myths: XP Myths
If it was a trojan horse, I would go ahead and reformat.
You can never be totally certian that your system isn't comprosmised until you do a full reformat.