Funny stuff... is this a virus?

Muse

Lifer
Jul 11, 2001
40,433
9,941
136
They are named:

I:\563650d9062b6b48a5dd5d13ed1a92

I:\6a1b2861b4efd0e98bffdb

I:\eb1a42aa8e43368ba6b0edaf

They have creation dates around 24 hours ago. They each contain one file, respectively:

msxml4-KB927978-enu.log

msxml6-KB927977-enu-x86.log

msxml6-KB927977-enu-x86.log

These log files range from 59k to 484 kb. I'm running NAV and Zonealarm Free. I was having mysterious activity yesterday afternoon -- several dropped connections requiring a reboot or recycle of my DSL modem. What would you do? TIA.
 

Muse

Lifer
Jul 11, 2001
40,433
9,941
136
I've started by running Spybot Search and Destroy, and removed 7 or so found items. I'm now running Ad-Aware.
 

InlineFive

Diamond Member
Sep 20, 2003
9,599
2
0
Microsoft has just released patches for an XMLHTTP exploit on the 13th. It's very likely that these are temp directories that were not cleaned up properly. I'd wager it's safe to delete them.
 

bsobel

Moderator Emeritus<br>Elite Member
Dec 9, 2001
13,346
0
0
Those appear to be temp dirs from MS patches that were recently applied.
 

Muse

Lifer
Jul 11, 2001
40,433
9,941
136
Thanks. I ran my spyware stuff, and will now simply delete those subdirectories. Indeed, I did a Microsoft Update on my Windows 2000 yesterday. A Google search on one of the log file names turned up one hit, a forum in German. My German's pretty weak. Thanks again.