Solved Can't access Temporary Internet Files

[Bellend45]

Hey all,
recently had a suspicious program trying to run named Contacts[1].exe. Crashed and alerted me due to windows error reporter. Thought I remove it after scanning with MBAM,AVG & SAS yet a few minutes ago I get a .exe named Xhwnibgiz .NET Framework trying to install itself. I reject access due to the admin level pop up box, it repeats over and over until I shut it down with task manager. It also requested access on Zonealarm which I obviously blocked.

Both these .exe are located in C:\Users\name\appdata\Local\Temporary Internet Files

However when I try to access this folder, I get 'Access is denied'.
I'm running an administrator account with full privileges.
Using the method of going on IE and deleting temporary internet files there doesn't work as it is referring to a different folder.
Any ideas?

 

[DMHolt57]

i show it as a shortcut, must lead to IE temp folder, look in local\microsoft\windows\temporary internet files

http://www.sevenforums.com/tutorials/167636-internet-explorer-temporary-internet-files-browse.html

 

[Bellend45]

i show it as a shortcut, must lead to IE temp folder, look in local\microsoft\windows\temporary internet files

http://www.sevenforums.com/tutorials/167636-internet-explorer-temporary-internet-files-browse.html

Ah right ok, makes sense. Thanks for your time holt.
Any idea how these .exe keep getting created there though? I don't even use IE.

 

[Layback Bear]

Ccleaner should be able to remove all temp files. I also use ATF to remove such things.

 

[Bellend45]

Turns out it generates the .exe virus/trojan after the Java process begins. As soon as the Java icon appeared in the systray, I get a pop up asking me to install sfidufbpsaasfi[1].exe.
Uninstalled Java, going to leave it a day and see if it happens again, then reinstall java if not.

 

[Layback Bear]

Sometimes when you remove java you don't remove java. I use Search Everything to look for things in my computers to see if they are really gone. Their is a good chance that its not all gone. I don't remember the number but in the last week or so their was a java security update.