System32

[Guest]

What exactly is System32 ? I keep getting notices from my virus/adware/etc
scan that there is a file in System32 named pacis.exe, yet when I run manual
scan w/anti-virus or adware programs nothing shows up. Before I do anything
I'd like more information.
Thanks.
chris

 

[Fitz]

This is a malware, or unsafe, program.

This file has been identified as malware (Spyware, Virus, Trojan, Worm,
etc). You should immediately run a spyware removal program and a antivirus
scanner.

From: www.bleepingcomputer.com.

 

[johnf]

Chris, do a Google search on "pacis.exe".
http://www.google.com/advanced_search?hl=en
There's plenty of information on removal.

 

[Rick \Nutcase\ Rogers]

Hi,

C:\Window\system32 is the folder that houses the majority of the system
files. Your AV software is detecting that a malicious file, pacis.exe, is in
there and is trying to tell you that it needs to be removed. As the file is
likely active and resisting detection and removal in normal mode, your best
bet is to do a full system scan with an updated AV program in safe mode.

How to start in Safe mode:
http://www.rickrogers.org/fixes.htm#Safe mode

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Guest]

Well, that was interesting. I restarted in safe mode but for some
reason my AV software (Trend PC-cillin) wouldn't do a scan in that mode. I
did run the spyware (Ad-aware SE) and cleaned out 4 malware and other junk.
Not the pacis.exe. How about if I just find it and delete?
Anyway, I'm wondering if my software (which updates very often,
sometimes several times a day.) is functioning because when I do a scan the
pacis.exe is not detected, but I've found it right there in System32.
chris

 

[Rick \Nutcase\ Rogers]

Hi Chris,

Delete the file in Safe mode, but also the registry string that loads it.
You will likely find it here:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org