Is there a virus that creates a I386 file?

[jcfrasco]

One of our executives received a number of e-mails and I'm not sure if they have been opened. I run a regular virus scan on all computers every week and shortly after receiveing the e-mails the virus scan picked up 3 infected files. They were deleted, but upon running the scan again the virus scan spends alot of time in a file named I386. I looked in Windows Explorer and expanded all the sub directories to see what they were and it only has approxiametely 3 sub files. It has a folder named $OEM$, under it is a folder named $1 with a folder named Drivers, under I386 is a second folder named $WIN_NT.~BT. There are a few files in these folders but I don't want to accidently click on one and run it.

When the virus scan is scaning the I386 folder, it continues to count of total number of folders scanned without ever leaving the C:/I386 filder - as if there are hidden files.

Is this normal? What can I do if it's not?

Thank you,
jcfrasco

 

[butchrecon]

What OS are you running. normally Viruses dont bother the I386 folder. this folder is similar to the CABS folder on Win9x. Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.


James Collins
Computer Hardware Engineer
A+, MCP

email: butchrecon@skyenet.net

 

[Zelandakh]

This sounds normal jc - because the REAL i386 folder is the same sort of thing as the CABS folder in Win9x, you can delete it and put a new one from the NT CD back on the HD is you are worried.

 

[jcfrasco]

Thanks both of you for your help! I think everything is working the way it's supposed to. I think I just might be overly paranoid of the ability for the Internet to open our systems up to any malicious intent.
Thanks again. And if there is anything that a novice network administrator should be doing to safeguard the company's computers, I welcome any advice.

jcfrasco

 

[Zelandakh]

Tell us your setup - what server OSs, how many, what email systems, dialup or leased internet line, how many users, what OS, inhouse web server or off site etc?