Windows XP Professional Temporary Internet Files you can't see & Trojans

november

I have a problem which I don't understand

My computer regularly runs anti virus scans - Norton Anti Virus which is fully up to date.

The last time (2 days ago) it said I had 4 infected files - all are types of Trojan. It can't quarantine them and it can't delete them.

Having looked into it and trying to find out also why my antivirus takes all day to run I have also found another problem.

The Trojans are apparently in temporary internet files. I regularly delete my temporary internet files. If I go into IE, Tools, Explorer it now appears empty (well apart from it will now have an MSE cookie in again )

I tried going through My Computer using the file address showing in the internet explorer for one file it was searching for and found tons and tons of folders and files which I can only see if I type in the correct file address.

For example there are about 30 folders at this address C:\Documents and Settings\ My name \Local Settings\Temporary Internet Files\Content.IE5. Each of these folders contains so many files that it freezes my computer to try to scroll down them!

The files seem to be such things as every web page this computer has ever visited. I thought maybe it was related to the Trojans but it can't be as the files go back to the date I got the computer - 2 years ago roughly - which is why there is so many.

I know my computer seems to automatically save file attachments to emails to files using file names with random numbers. This is before I save them myself where I want them to be. Although I can't find these files I am assuming they are saved in something similar e.g. is there a Contect IE1, IE2, etc?

Questions -

1) How do I find out what temporary internet files are on this computer if they don't show in the temporary internet file folder? If I can find them I can delete them but I can't if the only way is to know all their exact addresses which I don't. Would there be anything likely to be in these files which I shouldn't delete?

2) How do I stop my computer saving all these temp internet files in the first place? I also don't understand why if I go through My Computer the folder my name has no folder in it called local settings and if I put in the local settings\temporary internet files address that contains no folders when there are lots in there if you know their addresses!

3) When Norton has eventually finished again if I haven't managed to get rid of the Trojans I will post them up if thats OK for advice on how to get rid of them

4) I would preferably like to do all of the above without spending a penny!

Being driven mad here Its Sunday and its supposed to be the day of rest not the day you spend messing about getting nowhere with a PC.

djohn2002uk

november wrote:

For example there are about 30 folders at this address C:\Documents and Settings\ My name \Local Settings\Temporary Internet Files\Content.IE5. Each of these folders contains so many files that it freezes my computer to try to scroll down them!

You can safely delete all the Temporary Internet Files above including cookies. Two years worth may take a while deleting (had the same with my sons PC with 3yrs worth). The only problem you will find is that at websites you regularly visit you will probably have to log in on your first visit. You will also probably find that if there are Trojans in there they may not delete. But you will have made a start in cleaning out a good load of rubbish.
In each of the folders go to Edit/ Select All then File/Delete.

november

Thanks John but I have discovered I cannot delete most of these files! As I said I do regularly (once a week actually ) delete via IE Tools but that doesn't get rid of these other TI files on my computer obviously!!

I did find out the following - windows XP does store files in Local Settings which you can only access via typing in the address - might be worth other people doing as well as me!

Viruses are -

Deluca D (Trojan) x 2 apparently - I can find Deluca C etc on line but not D

Another unnamed Trojan x 2.

Browntoa

you can set IE to delete these files when you shut it down

under tools, Internet options,Advanced, scroll down to security and tick the box that says "Empty Temporary Internet files when browser is close"

You will need to virus scan in Safe mode to remove these if that do not delete

Browntoa

www.ccleaner.com

is worth downloading and running

CCleaner is a freeware system optimization and privacy tool. It removes unused files from your system - allowing Windows to run faster and freeing up valuable hard disk space. It also cleans traces of your online activities such as your Internet history. But the best part is that it's fast (normally taking less that a second to run) and contains NO Spyware or Adware!

<H2>Cleans the following Windows components:

• Internet Explorer
  - Temporary File Cache.
  - URL History.
  - Cookies.
  - Hidden Index.dat files.
  - Last download file location.
• Firefox
  - Temporary File Cache.
  - URL History.
  - Cookies.
  - Download manager.
• Recycle Bin
• Clipboard
• Windows Temporary files
• Windows Log files.
• Recent Documents (on the Start Menu).
• Run history (on the Start Menu).
• Windows XP Search Assistant history.
• Windows XP old Prefetch data.
• Windows memory dumps after crashes.
• Chkdsk file fragments.

</H2>

deary65

just in case, check your system for other parasites and scumware..

Before starting, use ERUNT to make an emergency backup of your registry into a folder of your choice, then(go to folder options,view and check hidden files and folders,apply.

1. Download, update, and scan with CCleaner to clean Temporary files, URL history, cookies, Autocomplete form history, index.dat
# Do not use the "issues" feature with this product
# Check for updates with this and all other software(s) listed here.
2. Disable System Restore
3. Perform an online scan virus scan use more then one scanner as each may or may not detect what the other(s) do not.
4. Download, install, update and scan with (all freeware), and remove whatever is found.....
# AdAware SE
# Spybot -Search and Destroy
# CWShredder™

5. Download, install, update and enable all protection with SpywareBlaster to help keep bad ActiveX from installing, and use SpywareGaurd to provide real-time protection against spyware installation.

remove all that is found, repeat all steps 3 and 4 until cleaned. If problem(s) persist, post back to this thread for further suggestion.

install and use Firefox to do most general browsing as it is cleaner to use over IE. reenable system restore after all is cleared up.

if the use of hijackthis is needed, you may obtain it from here or this Major Geeks Mirror(s). It is important that it not be ran from a temp folder or the desktop as it makes backups which may be need later, so upon download, follow these directions on creating a permanent folder.
http://www.larshederer.homepage.t-online.de/erunt/
http://www.ccleaner.com/
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam
http://forum.littleeagle.us/showthread.php?t=9
http://www.lavasoftusa.com/support/download/
http://www.spybot.info/en/home/index.html
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.javacoolsoftware.com/spywareblaster.html
http://www.javacoolsoftware.com/spywareguard.html
http://www.mozilla.org/
http://www.pchell.com/virus/systemrestore.shtml
http://www.spywareinfo.com/~merijn/
http://www.majorgeeks.com/download3155.html

Rex_Mundi

Another vote here for CCleaner as posted by browntoa. This will clear ALL your temp internet files. Something that Microsoft never told people about is the index.dat files. This is maybe what you've found.

Index.dat are files hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there. Not only that but all of the email that has been sent or received through Outlook or Outlook Express is also being logged. The file names and locations depend on what version of Internet Explorer you have. If you are running IE version 4.0 or above, the file name is "index.dat". Microsoft has not supplied an adequate explanation as to what these files are for or why they have been hidden so well.

CCleaner will clear these out for you.

Mr_Skint_2

Rex_Mundi wrote:

Another vote here for CCleaner as posted by browntoa. This will clear ALL your temp internet files. Something that MS never told people about is the index.dat files. This is maybe what you've found.

Index.dat are files hidden on your computer that contain all of the Web sites that you have ever visited. Every URL, and every Web page is listed there. Not only that but all of the email that has been sent or received through Outlook or Outlook Express is also being logged. The file names and locations depend on what version of Internet Explorer you have. If you are running IE version 4.0 or above, the file name is "index.dat". Microsoft has not supplied an adequate explanation as to what these files are for or why they have been hidden so well.

CCleaner will clear these out for you.

Ere Is that moi Rex? If so yes advanced settings allow this. P.S its the award winning Window Washer by Webroot. V.5


https://www.webroot.com

Rex_Mundi

Ere Is that moi Rex?

lol.......Took me a while to work that one out. By MS, I meant Microsoft...rofl

By the way....why didn't you just provide the link to the webroot site for the download so people could check out the program first?

Mr_Skint_2

Rex_Mundi wrote:

lol.......Took me a while to work that one out. By MS, I meant Microsoft...rofl

Sorry Rex me ole mate, me a bit of a div. Lol

november

Thanks for all your help.

Just to let you know that I've managed to get rid of the virus. I started in safe mode and ran the virus scanner which found them again but still couldn't quarantine or delete the files. As I was in safe mode though I was able to manually delete the infected files. Virus scan then ran clean.

I already have adaware, spybot search and destroy and CW shredder by the way - all of which newly updated said the computer was clean when it wasn't.

Yes Rex it was the index.dat file and all the related files - there were, as well as the index.dat itself , approx 12 folders each containing something like 1,000 files!!

Browntoa - setting my internet to delete files every time I close doesn't seem to get rid of these files so I'll try your other suggestion -

Browntoa wrote:

www.ccleaner.com

is worth downloading and running

Thanks. Or is that thanks to Mr Skint?? I'm confused now - is that the same person? I will download that and give it a try. The only thing I couldn't delete was the index as it said it was being used by a program even in safe mode. I tried manually deleting the contents from the notepad file but it wouldn't then save as it said the filename wasn't valid! Seems a bit unfair to me seeing as it gave it the filename in the first place!

I just love these little things Microsoft hide from me (not)


eta I've found out how the virus got on my computer in the first place as well - lets just say my son is banned from using it now!