Problem with desktop.ini files

arunbalait

Hi all

In my office systems a file named desktop.ini stored in each and every folders of my system. Am using XP.
And also that file has names like DESKTOP.INI, _destop.ini

I found that its a type of virus. That file is stored or copied in the Administrative tools too.. I have tried lots of antivirus softwares. But nothing cleared it..

And that virus includes a IFRAME code for some sites into my asp, php etc files.

It also affects my programs in ASP, PHP etc...

I think the virus name is VBS.Redlof.A

plz tell me a solution to clear those files.

by searching the computer also resulted failure...

Plz tell me a anti virus software that clears it.

Help me plz

thanx

Jul 6 '07 #1

dafodil

Please try avg a free antivirus.....

just type avg in google to download...

Tell me what happens...
thanks....

Jul 6 '07 #2

arunbalait

Ya i have tried that too..

Upto AVG7.5

Then once I used AVG that cleared those files.,. But I forgot that version name. So i tried lots of AVG versions after that. But no changes.

Thanx for your reply.

Jul 6 '07 #3

dafodil

I've searched the virus and it can be easily removed by norton....

Noticed that it only affects windows operating system....

Made of vb script....

Check this out:

http://www.symantec.com/

Jul 6 '07 #4

arunbalait

Am using symantec 10.1 now. But not detecting.

Now using that anti virus only.

I already found the info abut that virus in that site.
Thanx.

Jul 6 '07 #5

dafodil

How about trying to download Norton Antivirus 2007, try the trial version

try this link:

http://www.symantec.com/home_homeoff...oads/index.jsp

Jul 6 '07 #6

bartonc

Here is the reason that AV won't detect those files:

If you have configured your folders options to 'remember each folder's view
settings' then you will get a desktop.ini file on every folder. This is not
a virus - this is just the settings container for that folder.

Jul 6 '07 #7

arunbalait

Ya watever the version for symantec it doesnt works. I think it needs some patches. But tried few patches. Dont know exact patch.

I tried this version too as a trial version. But no change so I again came back to symantec 10.1

Jul 6 '07 #8

arunbalait

Ya You are right. Thats windows OS file. But with that same name the virus file copies into my system..

Goto symantec.com and search for desktop.ini. It gives the details about that virus

Jul 6 '07 #9

bartonc

Apples and oranges, my fiend. If you have that setting turned on, and AV won't detect them, then you don't have the virus.

Jul 6 '07 #10

bartonc

What's more, all the info that I have dug up is dated 2003 & 2005.

Jul 6 '07 #11

arunbalait

Ya fine... But that file entered into my system through a CD. I scanned that CD too..

If its not a virus am happy only. Am in doubt that, that file getting copied in all folders, administrative tools etc., But in some folders that file does not exists.

Give me some idea if am wrong.

Thanx for your informations

Jul 6 '07 #12

dafodil

Is there no other way? How about using the system restore...

Jul 6 '07 #13

bartonc

A legitimate desktop.ini file can be opened with notepad.
In there you should see only text. For example:
[DeleteOnCopy]
Owner=Barton whoever
Personalized=5
PersonalizedName=My Documents

Jul 6 '07 #14

arunbalait

The files those are visible are opening nad that file contains contents like what you mentioned.. But some files are not visible. But while copying a folder to another location I can able to see that file being copied in the copy progress window.

And that file too scanned by AV but they not indicate them as virus.

Jul 6 '07 #15

dafodil

Try to check the startup folder if anything strange is hanging in there...

And also try to check your task manager by presing ctrl+alt+delete if there is any strange processes running...

Jul 6 '07 #16

arunbalait

I have cleared my startup folder.And it contains only the necessary startup files.

Then explorer.exe and svchost.exe only giving troubles always. It kills lots of my cpu usage. And while booting my system processing is too slow. It takes about 3 minutes to come to normal.

I have installed symantec 10.1 edition. Rtvscan.exe also runs at high memory usage But it might of some other problems I think.


I formatted my C drive and installed XP again. Once after the installation of symantec my cpu usage goes to high.

These problems may not be due to desktop.ini.
But am sure the files were hidden.

Thanx.

Jul 6 '07 #17

dafodil

I'm glad you already solved your problems...

It's easy to create a virus using vb...

Try to experiment at times you'll notice that they always try to put it on your startup, registry and schedule list.....


"You know how to attack, you know how to defend"
law of hacking

Jul 6 '07 #18

arunbalait

Hi,,

Is there any solution?

I juz formatted my C drive and installed XP.

Again desktop.ini files created.

And that file also created in my pen drive and digital cam.

How to resolve this?

Jul 17 '07 #19

bartonc

If you have configured your folders options to 'remember each folder's view
settings' then you will get a desktop.ini file in every folder. This is not
a virus - this is just the settings container for that folder.

If you look inside the file with Notepad, you should see only text and it should make sense what that text is.

Jul 17 '07 #20

dafodil

Yeah right, Its not a virus anymore.... its normal to have desktop.ini
After installing xp? its probably not a virus...

Jul 17 '07 #21

arunbalait

Yeah but I didnt found any files in my pen drive. Its newer one. When I started to use it I found the file being created. And am deleting it whenever I find that file. I need to transfer some data to and fro to my office. So after copying the data into my pen drive and when I open it at home I can able to see that hidden file named desktop.ini. How its get created?

Thank you

Jul 17 '07 #22

dafodil

It's automatically created when you copy files from your desktop... Even my stick drive has that one file after copying from desktop, just ignore it...

Jul 17 '07 #23

arunbalait

Hmm fine. But I didnt copied them from desktop. I copied from local drive d or e......

Jul 17 '07 #24

dafodil

Its normal just ignore it.... That's why its safer to unview your hidden files than to view it...

Jul 17 '07 #25