False files

Carver

Member
Two days ago in the morning at 2 am I decided to do a unused space wipe. I quit all unnessary processes then start the unused space wipe and then go to sleep, when I wake up the unused space wipe will be almost done. At 5:03 am something happens that never happened before, remember I am asleep when it happens. My AV-NOD32 gets this: Time Module Object Name Threat Action User Information
3/29/2007 5:03:30 AM AMON file C:\~ERAFSWD.TMP\7XC4F3VZ.BAT BAT/KillFiles.S trojan quarantined - deleted - error while cleaning - operation unavailable for this type of object <Computer>\<NAME> Event occurred on a file modified by the application: C:\Program Files\Eraser\eraser.exe. The file was moved to quarantine-Deleted-Error occured while cleaning. You may close this window. This effectively stops the erasing of unused space, at 10:00 I see what has happened. I use a undelete utility to see how many files are left, I decide to erase at least some of the files. I create a folder on my desktop, restore some of the files the undelete utility found..then erase that file. I get rid of 1500 old junk files, then for some reason I look at MY Computer/C/DOCUMENTS and Settings. I see 4 files all the same..the one with my name on it. All the fake copys start My Name(and they have a number inserted in them)/Desktop, the real one starts My name/Application Data;Bluetooth;cookies itc. I also find 7 extra Desktop files in the real file..the one with my name on it. I read Windows was a copy machine....now I believe it. I deleted the fake files, no error so far. If I don't get a error in a couple of day, I will erase the fake files. All is ok so far. I just thought you should know the whole weird story.
 
Back
Top