Virus? HELP!

Does it show up under Windows task manager (Ctrl-Alt-Dlt)? As an application or process?

If it does ................ kill it

It does and I did. I tried to delete the file several times before, but it kept telling me it was being used. I didn't think to look there. Thanks. I would still like to know what it was if anyone can tell me that.

What were you doing around that time or recently?

Cruising the internet? Downloading? P2P'ing? Torrenting?

Perhaps working in Excel with a macro?

Recently opened any email attachments?

Installed any new programs? Any new updates?

.....?..........?........

I just browsed through a few virus lists (Symantec, McAfee, and others) and nothing similar showed up, so unless it is really a really new threat/virus/... - it is probably something else, such as an updater or macro.

I am online all day with the work I do but I don't recall doing anything out of the ordinary that would have installed this thing. The same is true for recent updates or installed programs. Actually, I did recently install MS Frontpage but that is it. I should think that if it was related to this, google would have given me something. I obviously did something I shouldn't have done to end up with this problem but I can't see what it would be. I guess I am concerned that it is a necessary file for one of my other progams or my computer in general. I need to wipe my hard drive and start over fresh anyway so... Thanks for your help!

On the subject of "KILL" what is the difference between "CLEAN VIRUS", "DELETE FILE" and "QUARANTINE" in the responses available from one's anti-virus program?

AFAIK, "CLEAN VIRUS" removes the active (nasty) bits fom the file, leaving the rest intact. "DELETE FILE" does what it says (well, moves it to the recycle bin, anyway). "QUARANTINE" moves the file to a quarantine folder, where (hopefully) it won't be able to do any harm.

Can you locate it with Windows Explorer? Can you check its properties? What anti-virus are you running? Is it up-to-date?

Occurs to me that any self-respecting virus with the balls to exhibit itself and give up its filename would probably change its filename every time it propagated - hence no Google hits (except CR4!).

Yes I can find it with explorer and it installed itself in the windows directory under system 32. The properties just tell me unknown for everything and my virus and spyware scanners turn up nothing. I use the security package from Bell sympatico. I know people have mixed feelings about this product, but it works for me. After two years, has really been my only issue. I am stumped.

You could try AVG - free, from Grisoft - works for me (and has done for about 6 years - touch wood!).

I have no idea what the file is if you just want to delete it go to www.purgeie and download delinvfile it is a free programme that deletes files windows won't. Other option is go to microsoft downloads and download windows defender and run a full scan. You can also down load their malicous software removal tool. There are also numerous free programmes for cache cleaning spyware removal etc.

Sometimes you can delete these "in use" files by booting with an old win95 floppy, then maneuvering around the hard disk in a command (dos) window.

I had the bright idea (as I have used this method before at home) of looking up 'P4Q1s20I.exe' in Google.

The only two hits that came up both linked me back to this forum thread!

Carry on...

This looks related (whatever it is - seems to involve 'downloadnova') ??

http://www.filestube.com/search.html?q=P4Q1s20I.exe&select=All

I've no idea where the links within go.

From Symantec in response to my query......

"we have not come across such issues"

There is a windows scan (THIS IS FOR XP, Vista may be different) that you can perform that will check all of the valid windows files against a cache or the install disc. Open the run command window and type

sfc /scannow

http://forums.majorgeeks.com/showthread.php?t=147786

If you want to delete it and the sfc scan does not remove it, reboot the machine and tap F8 repeatedly till it gives you the option to go into safe mode. In safe mode you should be able to delete it. You could back it up on a flash stick or cd first if your concerned that you need it.

I would then download and run CCleaner and the Registry scan in Ccleaner to get it out of your registry.

Steve

I voted a GA for that....as in 'Good Advice'...........

If this thing is residing in your system32 folder, reboot in safe mode and go to the system32 folder and try to rename it. If this stops the firewall alerts you can be safe to assume that it was up to no good! Also, you can download a program called hijackthis and see what it shows on startup. It is possible that this is a remnant from another innocent install, but usually these system32 folder residing scoundrels are a self propagating virus of various origins, spyware, malware, etc...

Also, try looking for some other free downloads such as malwarebytes, spybot search & destroy, ad-aware, etc..

Dave

Oh i ove that You want a sol. for this RIGHT ? 1. GIVE END TASK COMMAND. 2. CLICK PROCESS TAB 3. FIND FILE NAME IS YOU WANT TO REMOVE 4. CLICK ON THE FILE NAME THN CLICK ON END PROCESS 5. NOW CARE FULLY OPEN MYCOMPUTER 6. OPEN FOLDER OPTIONS 7. VIEW 8. SHOW HIDDEN FILES & FOLDERS 9. HIDE EXTANTIONS FOR KNOWN FILES & FOLDERS 10.HIDE PROTECTED OPRATING SYSTEMS FILES 11.OK 12.RUN 13.C: 14.DON'T TUCH ANY FILE 15.DELETE ANY AUTORUN.INF 16.CONTINUE WITH 12 TO 15 WITH YOUR ALL DRIVES

I had a similar problem some time ago and it turned out that some legacy program was trying to connect to a now-defunct url for updates. I found the answer somewhere in Microsoft's knowledgebase (sorry can't recall what it was), but the solution went something like this.

From the Control Panel, go to Admin Tools, then scan the Event Viewer for Errors. Identify the one that seems to indicate your particular problem, then check the details. Identify the program that's trying to run and write this down. Now, go to Regedit and find this program. Delete any and all references to it. Did I mention that you should save your Registry before you do this?

Good luck

Grae