Anyone know of this one

[TechShop]

Something that may help. I have run across this before and regardless of it's name, the file is usually located in you user directory in a directory named "TempDIR" and that will contain the file. Each of the two times I have found this malware it was in that directory. One site that may be suspect is Zorpia. If I run across this again I will post more possible sites.

 

[A Guy]

Welcome to Seven Forums TechShop. Thanks for the addition. A Guy

 

[DavidtheRhino]

More BundleIns

I just did a full system scan with Malawarebytes and it came up with 7 assorted PUP.BundleInstaller.oi This seems curious because this machine is never used to surf the Internet, it is connected to the Web for Windows updating, but it's used simply as a back-up. 6 deleted okay, but one in C:\System Volume Information\_restore{9EC.... 386.exe} keeps re-generating itself. When I try to find the file I get "C:\System Volume Information\ is not accessible."

using XP Pro SP3. What's the next move? Thanks for any suggestions

David

 

[A Guy]

Welcome to Seven Forums DavidtheRhino. That is a System Restore point. If your system is running ok, you can delete all the SR points by turning SR off, then back on again.

How to turn off and turn on System Restore in Windows XP

Turn SR off, then scan again in windows. Then scan yet again in safe mode just to be sure. Now turn SR back on again. A Guy

 

[DavidtheRhino]

Thank you very much for the clear and concise answer. Perfect.

David

 

[A Guy]

My pleasure, let us know if need anything. A Guy