Mydoom Virus

[robrpb]

Hi,

My computer was infected with the "Mydoom" virus. I went to Symantecs website and downloaded the removal tool and ran it. It stated it found the virus and removed it. When I ran the removal tool a second time as instructed it stated that "mydoom was not dectected on my computer." When I looked in the notepad there were several (8) files there that stated they were too large to scan and then the last message that stated "Mydoom was not detected." What are these files for and do I need to be concerned with them? They are listed below. Thanks.

Rob

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\YNK9QNOV\Type%3dclick%26FlightID%3d35266%26AdID%3d46779%26TargetID%3d337%26Segment s%3d712,715,1078,1181,1197,1530,1535,2099,2230,3220,3261,3263,3342,3433,3635,3773,3860,3933,3972,415[1].html (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\YNK9QNOV\site=match&build=5&pagepos=439&adsize=553x108&brandid=0&trackingid=0&bannerid=0&a=50&zip=33411&g=1&gp=2&co=1&state=10&city=115393&page=197&income=P_Income_00&subid=1&SID=B6A9F[1].js (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\E1SHKTI1\site=match&build=5&pagepos=439&adsize=553x108&brandid=0&trackingid=0&bannerid=0&g=1&gp=2&page=227&subid=2&SID=B6A9F1C5-FB1B-42DC-A5BC-75EA1FA9A50C&Theme=213&Params[1].js (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\E1SHKTI1\site=match&build=5&pagepos=439&adsize=553x108&brandid=0&trackingid=0&bannerid=0&g=1&gp=2&page=197&subid=2&SID=B6A9F1C5-FB1B-42DC-A5BC-75EA1FA9A50C&Theme=213&Params[1].js (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\E1SHKTI1\site=match&build=5&pagepos=439&adsize=553x108&brandid=0&trackingid=0&bannerid=0&g=1&gp=2&page=197&subid=2&SID=B6A9F1C5-FB1B-42DC-A5BC-75EA1FA9A50C&Theme=213&Params[2].js (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\A3A3KL8V\Type%3dclick%26FlightID%3d35266%26AdID%3d46779%26TargetID%3d337%26Segment s%3d712,715,1078,1181,1197,1530,1535,1537,1612,2099,2228,2386,3220,3261,3263,3340,3342,3401,3433,363[1].html (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\A3A3KL8V\site=match&build=5&spacedesc=&adsize=160x90&pagepos=462&brandid=0&trackingid=0&bannerid=0&a=50&zip=33411&g=1&gp=2&co=1&state=10&city=115393&page=2&income=P_Income_00&subid=1&S[1].js (WARNING: not scanned, path to long)

C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\Content.IE5\QR8RC5E1\site=match&build=5&spacedesc=&adsize=160x187&pagepos=464&brandid=0&trackingid=0&bannerid=0&a=50&zip=33411&g=1&gp=2&co=1&state=10&city=115393&page=2&income=P_Income_00&subid=1&[1].js (WARNING: not scanned, path to long)

[reboot]

Open IE, go to Tools, Internet Options, Temporary Internet Files box, click Delete files, put a tick in Delete Offline Content, then OK.
Restart, rescan.

[robrpb]

I tried your suggestion and I got the same results. I also tried the same thing using Disk Cleanup with the same results. Before running the scan I deleted the notepad folder for the scan and then deleted it from the recycle bin. I also tried to cut the file from the notepad and paste it in search files and folders but it would not allow me to paste as the area for paste was grayed out. I also tried to do a manual search by clicking on my computer, then documents and settings but when I came to the place for "local settings" I could not find that folder and could not proceed further to find the file. Your help is greatly appreciated. Thanks.

[reboot]

It's probably in C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5
If not there, check all the users under Documents and Settings.
Just close IE, and delete EVERYTHING.

[robrpb]

I am running XP Home. Under Documents and Settings I have listed Rob (myself), All Users, and Administrator. I don't have (or see) default user there or under any of them. I checked them all and can't find local settings under any user. I am confused when you say close IE and delete everything. I have tried closing everything and then from my desktop clicking start, accessories, system tools, then disk cleanup and deleting everything there. Is this what you mean or something else? Thanks.

Rob

[reboot]

No, I mean find your temp internet folder, and delete it.
In XP, it should be under C:\Documents and Settings\Default User\Local Settings\ or some other user.
In your case it's here: C:\Documents and Settings\Rob\Local Settings\Temp\Temporary Internet Files\
Close IE, open Explorer, browse to that folder, and delete everything.

[robrpb]

I tried to delete the temp folder, but windows would not allow me giving me the message:

"cannot delete TYPE%3~1.HTM: Cannot find the specified file. Make sure you specify the correct path and file name."

There are 4 folders in the temp folder and I went in manually and deleted all files except for 8 total in these folders. Windows would not allow me to delete the individual file or the complete temp folder giving the above error message. How do I delete a TYPE%3~1.HTM file? Thanks for your patience.

[reboot]

Boot to safe mode.
Open a DOS box (command prompt).
Type this:
del c:\docume~1\Rob\locals~1\temp\*.*

[robrpb]

Though it took some work going back and forth between windows and DOS, the bottom line is that I was finally able to delete all those files. Thanks Jim for all your help. I really appreciate it.

Rob