set##.tmp files in system32 folder

[Ken G.]

My PC was recently infected with a virus that says that svchost.exe is
infected with Trojan.inject.IA. My av program (BitDefender 2009) says it
can't do anything about this infection and tells me "no action is possible" -
great!

When I've looked at the Windows/system32 folder to see that svchost.exe is
actually there, I also notice about 80 files called set##.tmp, with the same
date as the svchost.exe file (14/4/08).

My question is - Can I delete these tmp files from the system32 folder?

Bit Defender says there are 80 instances of this trojan all in svchost.exe
alternately listed as svchost.exe (memory dump) or svchost.exe (full dump).
This number corresponds roughly with the number of tmp files.

Also any suggestions on cleansing my system would be appreciated.

 

[PA Bear [MS MVP]]

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.