suspicious files

Avast Free Antivirus / Premium Security
1

There are 2 suspicious files in my PC.
i had used many types of antivitus to scan it,but no result.
all antivirus point that the file is clean.
but after i deleted it,it reappear again in some of my folder,especially in folder “download” folder.
may i know what is that?
i try to off the system restore and start a boot scan,but it does not sow any virus in my PC too.

2

Hi loonsave,

Have you tried uploading the suspicios files to Jotti?

http://virusscan.jotti.org/

This will scan them with mutliple av engines.

What are the file names?

3

What was the suspected file name, where was it found example (C:\windows\system32\suspected-file-name.xxx) ?
If avast doesn’t detect it on a normal scan it is unlikely to do so on a boot-time scan, which is normally used to deal with an infected file that is in use.

What other security based software do you have, e.g. anti-adware/spyware, etc. ?

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner

4

If a virus is replicant (coming and coming again), you should:

  1. Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.
  4. Use a-squared, ewido or Spyware Terminator (trojan removers).
5

i used kapersky,NOD32,avast,e-wido tot scan it.
but no result.
and i found out that it only appear in my shared folder.
here is that attachment.

6

this is what i scan from http://virusscan.jotti.org/

7

If you are not getting a virus warning that you believe is a new, undetected virus then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a new/undetected virus and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

The VirusTotal site has 27 different scanning engines and uses the windows engines of these engines, Jotti has a smaller number of scanners and used the Linux/Unix engines of the scanners listed. So there are times when VirusTotal is better.

8

loonsave - do you have a file named intmonp.exe in your System folder?

Do you have a firewall?