[Berocca]

Greyknight17 has kindly helped me out in fixing a very badly infected friend’s computer. We are almost finished. There is just one matter that requires further assistance.

He has now asked me to post in the Windows Forum and ask you guys for your expertise. He said:

“I was thinking the same thing about C:\FOUND.018\FILE0001.CHK I'm pretty sure these are related to scandisk files I think. Ask the guys/gals in the Windows Forum and see what they have to say about all those FOUND.001 files and others. Ask them if it's ok to delete this one:

C:\FOUND.018\FILE0001.CHK

If it's ok, then post back saying so. I will give instructions to delete it if you can't delete it.

The computer has the follwing installed:

Microsoft Windows XP Professional Version 2002 Service Pack 2
Microsoft Word (10.4219.4219) SP2

This is the situation:

Files Created After AVG Virus Scan

After doing the final scan by AVG the result showed one infection only. It was:

C:\FOUND.018\FILE0001.CHK - Virus Dropper.Inor – Infection

It was shown as "healable" but on trying to carry out the "heal" action many times, the result still comes back as "Action to Heal Failed". I then moved it to the Vault.

I now have 6 files in the AVG Virus vault shown as:

5 Trojan Horses and
1 Dropper.
The Trojans are shown as “unhealable” but the Dropper as “healable”.

The "Files by Virus Name" AVG Summary shows them as:

(a) MS-DOS viruses;
(b) Trojan Horses; and
© Backdoor and Trojan Horses

Specific details of the six files shown in the AVG Virus Vault are:

1. Trojan horse BackDoor.Generic.LNX – C:\tmpUpdateFile.exe - source – backup copy
2. Trojan horse Agent.DM – C:\WINDOWS\_delete_on_reboot_jaaste.dll - source – backup copy
3. Trojan horse Dialer.Wl – C\WINDOWS\sasent.dll - source – backup copy
4. Trojan horse Dialer.17AW – C\Program Files\SBIT\Plugin\109998.exe - source – backup copy
5. Trojan horse BackDoor.Generic.LNX – C:\FOUND.030\FILE0004.CHK - source – backup copy
6. Virus found Dropper.Inor - C:\FOUND.018\FILE0001.CHK - source – Moved object

This seems to have created 32 Folders on the C drive named:

FOUND.000
FOUND.001
FOUND.002 and so on all the way to
FOUND.031

The contents of these folders show files for example -
For the folder named FOUND.000 it shows files named:

FILE0000.CHK
FILE0001.CHK
FILE0002.CHK
and so on with the description "Recovered File Fragments".

I have not deleted them as yet.

This is the link to the discussion with Greyknight17 if you want further details of the action taken so far:

Link: http://www.geekstogo...topic=69637&hl=

Your help would be sincerely appreciated.

[Advertisements]

All filenames ending in *.CHK can be safely deleted as they are indeed lost file fragments found by Scandisk error-checking. Thay will be completely useless.

[pip22]

All filenames ending in *.CHK can be safely deleted as they are indeed lost file fragments found by Scandisk error-checking. Thay will be completely useless.

[Berocca]

Thank you pip22.

Very much appreciated.

Regards
Berocca