I am running WINDOWS XP Home, SERVICE pack 2.
My norton antivirus picked up a virus in system32. I forgot what the virus name was but it was in a folder i have never seen before called 'inetsrv'.
My antivirus got rid of it and the folder but when i restart/turn on the computer, there is an undeletable empty folder named 'inetsrv'
Anyone have any idea what this is?Could be a Wareout infection. We need to see a HijackThis log first though.

I suggest you print this out to help you follow my advice.


Please download FixwareOut from one of the following sites .....

http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

http://downloads.subratam.org/Fixwareout.exe


SAVE it to your desktop and run it.

Click Next, then Install, make sure "Run fixit" is checked and click Finish.

The fix will begin; follow the prompts.

If your FIREWALL gives an alert, (because this tool will download an additional file from the internet), please don't let your firewall block it, but allow it instead.

Then you will be asked to reboot your computer; please do so. Your system MAY take longer than usual to load; this is normal.

Once the desktop loads please post the text that will open (report.txt) and a new HijackThis log.

Note: ONLY if you have connection problems after performing above steps - go to Start > Control Panel choose work Connections, right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and left click on properties. Double-click on the Internet Protocol (TCP/IP) and select the radio button that says obain DNS servers automatically. Click OK twice and restart your computer.

*******************

Download Ewido/AVG Anti Spyware from here ….

http://www.ewido.net/en/

It has a fully working 30 day trial period.

Install it and update it to the latest definitions.

Do NOT use it yet.


Now boot to safe mode. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

Reboot to normal mode and use the computer as you would usually do.

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

*******************

If this doesn’t succeed in fixing the problem download a self-extracting copy of HijackThis from here …….

http://downloads.malwareremoval.com/hijackthis_sfx.exe

Save it to your Desktop.

Double-click on the file hijackthis_sfx.exe file and it will self-extract into its own folder ……

C:\Program Files\HijackThis

Go to this folder and run the hijackthis.exe file.

From the menu click on "Do a system scan and save a logfile".

Copy and paste both the AVG AS scan report and the HJT logfile to this thread. More specific removal instructions will follow for whatever it is that's causing the problem.


OJHey thanks man, ill try thatSorry but I have had to correct the wording in my advice (above). No substantive changes ... just corrections to my spelling. I really need to improve...... Due to lack of response this thread now locked.

Should the original poster require it re-opening please PM GX1_Man or a moderator.