How to get rid of virus dropper "install.exe"??

[micky77]

In your opinion is there any chance that the file could become active again?

Normally, any threat, that is renamed,eg,virus.exe, to to,virus.exe.xxx,is dead,and can be easily deleted.This file was found in system restore, which is no worry anyway.I would disable system restore, then re-enable.

[CharleyO]

***

Please read my above post (reply #2) for information about those 016 entries.


***

[cdestefani]

Well, this is an update.

I install the PCTool Firewall.

YoKenny,

I searched for those 016 entries and in a HijackThis report says:

O16 - DPF: {33415AC7-AFFA-4D55-B41C-C64C0D07DFCA} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISWebManager.CAB
O16 - DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab

I do not think I will delete them, the PC has two HP printers connected.

I attach the last HijackThis log running XP Standard mode.

Any comments will be much appreciated.

Thanks.

[CharleyO]

***

A better looking HJT log. There were only 4 questionable entries but they are OK.

Three of the questionable entries were the 016 entries that we know to be OK and this one which is also OK :

C:\DOCUME~1\Lucila\LOCALS~1\Temp\AdskCleanup.0001
Belongs to the software Macrovision Europe Ltd. Cleanup by Macrovision Europe Ltd (www.macrovision.com).
http://www.file.net/process/adskcleanup.0001.html

So, is everything running correctly now?


***

[cdestefani]

Micky77

Thanks for the tip on disabling/enabling system restore.

CharleyO,

Thanks for your help with the O16 Entries and the last one you mentioned.

The PC is working fine. The only thing now is getting familiar with the Firewall, but apart from that everything is OK.

I would like to thank to all of you that assist me with this trouble.

I hope the PC will go fine for quite sometime now.

[CharleyO]

***

You are welcome, cdestefani, glad I could help you a little.   


***