"wintis32.exe", what is it?

[Kenny]

Zone Alarm continually tells me "wintis32.exe" is trying to access the
internet, I always deny it access.
Searching PC for this file, it is hidden and located in:
C:\Documents and Settings\Kenny Cargill\Local Settings\Temp.
I have deleted it from there but it comes back after a restart!
Have run AdAware, SpyBot, CounterSpy, AVG free and online virus scans.
The IP address it points to is:
195.92.195.94NS, I have tried "Whois" on that but don't really understand
it and came up with nothing.
Googling it only came up with this:
http://www.google.co.uk/search?q=wintis32.exe&hl=en
which appear to be forum posts in Spanish and I can't understand them.
Have also searched MS site, nothing there.
I am very suspicious of this, would like to know what it is and how to stop
it coming back after deletion.
Using XP Pro with SP2.
Any help appreciated.

 

[Rick \Nutcase\ Rogers]

Hi Kenny,

If it looks like a duck, and acts like a duck......

Yes, it's a nasty. Clear the temp folder completely, and also the Temporary
Internet Files. Then restart the system in Safe mode, follow the steps
outlined here: http://rickrogers.org/fixes.htm#trojan

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Kenny]

Thanks for the reply, have followed your advice and it appears to be gone.

 

[Rick \Nutcase\ Rogers]

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Rick \Nutcase\ Rogers]

No problem Kenny, glad to hear it helped.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org