Virus Alert – IBM00001.EXE

A file called ibm00001.exe will appear in your c:\Program Files\Common Files\Microsoft Shared\Web Folders or in a temp folder under your Windows\System or System32 folder. Files called ibm00000.exe, ibm00001.dll, ibm00002.dll, ibm00003.exe, ibm00007.exe and tmp.tmp may also appear on your system. These files install with the Torpig-C Trojan. This Trojan sets itself up to run on system startup. It can steal personal information, download code from the Internet, turn off antivirus programs and reduce system security.

We'd recommend removing these files using WinPatrol. First, kill them under Active Tasks then remove them from your Startup Programs and IE Helpers. If running WinPatrol 8.x or later, right click ach file then select 'Delete file on reboot'. Finally, reboot your system. We'd also recommend a full system scan with an up to date antivirus program.

Additional background information can be found at http://www.sophos.com/virusinfo/analyses/trojtorpigc.html.

Virus

Remove