Mystery 'ias' folder

Discussion in 'Computer Support' started by MiniEmma, Mar 23, 2005.

  1. MiniEmma

    MiniEmma Guest

    Running windows xp prof

    Yesterday norton antivirus popped up a few virus warnings for IRC Trojan and
    a few others. The infected files were in 'c:/windows/fonts/ias' folder

    When I browse through My Computer (hidden folders made viewable), the Fonts
    directory does not have any folders in, but if I go to 'Start>Search>Files
    and Folders>Browse' I can then see the folder called 'ias' in the fonts
    folder

    When I first managed to get to the folder there were a few MIRC icons and
    other IRC related things and I tried to delete the folder but loads of it
    said I could not access it and could not delete it. I did a system restore
    and the folder is still there but without the MIRC items.

    Does anyone know what it is and why I can't see it through My Computer?

    I've done a full system scan with Norton and have no viruses. I have also
    run the stinger and an online virus scan all showing clear. Also 3
    different spyware searches - also all clear.
     
    MiniEmma, Mar 23, 2005
    #1
    1. Advertisements

  2. MiniEmma

    carson Guest

    "MiniEmma" <> wrote in message
    news:d1rtid$2kb$...
    > Running windows xp prof
    >
    > Yesterday norton antivirus popped up a few virus warnings for IRC Trojan

    and
    > a few others. The infected files were in 'c:/windows/fonts/ias' folder
    >
    > When I browse through My Computer (hidden folders made viewable), the

    Fonts
    > directory does not have any folders in, but if I go to 'Start>Search>Files
    > and Folders>Browse' I can then see the folder called 'ias' in the fonts
    > folder
    >
    > When I first managed to get to the folder there were a few MIRC icons and
    > other IRC related things and I tried to delete the folder but loads of it
    > said I could not access it and could not delete it. I did a system

    restore
    > and the folder is still there but without the MIRC items.
    >
    > Does anyone know what it is and why I can't see it through My Computer?
    >
    > I've done a full system scan with Norton and have no viruses. I have also
    > run the stinger and an online virus scan all showing clear. Also 3
    > different spyware searches - also all clear.
    >
    >



    How do I delete an "undeletable" file?

    Sometimes you want to delete a file but when you do so an error message pops
    and tells you it cannot be done. Do successfully delete such a file do the
    following:

    1.. Open a Command Prompt window and leave it open.

    2.. Close all open programs.

    3.. You now need to close EXPLORER.EXE. The proper way to shutdown
    Explorer is to raise the "Shut Down Windows" dialog (select "Shut Down..."
    from the start menu), hold down CTRL+SHIFT+ALT and press the CANCEL button.
    Explorer will exit cleanly.

    Note: The <CTRL+SHIFT+ALT> at the 'Shut Down Windows' dialog method of
    closing Explorer is built into Explorer. (It was specifically designed so
    that developers writing Shell Extensions could get Explorer to release their
    Shell Extension DLLs while debugging them).

    4.. Go back to the Command Prompt window and change to the directory where
    the undeletable file is located in. At the command prompt type DEL
    <filename> where <filename> is the file you wish to delete.

    5.. Go back to Task Manager, click File, New Task and enter EXPLORER.EXE
    to restart the GUI shell.

    6.. Close Task Manager.

    (Tip modification submitted by James R. Twine who has a great utility called
    Delete FXP Files that can help you delete files and folders that simply
    won't go away).
     
    carson, Mar 23, 2005
    #2
    1. Advertisements

  3. MiniEmma

    EricP Guest

    On Wed, 23 Mar 2005 14:13:33 +0000 (UTC), "MiniEmma"
    <> babbled like a waterfall and said:

    >Running windows xp prof
    >
    >Yesterday norton antivirus popped up a few virus warnings for IRC Trojan and
    >a few others. The infected files were in 'c:/windows/fonts/ias' folder
    >
    >When I browse through My Computer (hidden folders made viewable), the Fonts
    >directory does not have any folders in, but if I go to 'Start>Search>Files
    >and Folders>Browse' I can then see the folder called 'ias' in the fonts
    >folder
    >
    >When I first managed to get to the folder there were a few MIRC icons and
    >other IRC related things and I tried to delete the folder but loads of it
    >said I could not access it and could not delete it. I did a system restore
    >and the folder is still there but without the MIRC items.
    >
    >Does anyone know what it is and why I can't see it through My Computer?
    >
    >I've done a full system scan with Norton and have no viruses. I have also
    >run the stinger and an online virus scan all showing clear. Also 3
    >different spyware searches - also all clear.
    >

    You have to turn off the Hidden file attribute. This should reveal
    several files there. If you have one named "shares.bat", stick it in
    notepad and post the text here so we can see what it was activating.

    Not much on this anywhere.
     
    EricP, Mar 23, 2005
    #3
  4. MiniEmma

    MiniEmma Guest

    "carson" <> wrote in message
    news:...
    >
    > "MiniEmma" <> wrote in message
    > news:d1rtid$2kb$...
    >> Running windows xp prof
    >>
    >> Yesterday norton antivirus popped up a few virus warnings for IRC Trojan

    > and
    >> a few others. The infected files were in 'c:/windows/fonts/ias' folder
    >>
    >> When I browse through My Computer (hidden folders made viewable), the

    > Fonts
    >> directory does not have any folders in, but if I go to
    >> 'Start>Search>Files
    >> and Folders>Browse' I can then see the folder called 'ias' in the fonts
    >> folder
    >>
    >> When I first managed to get to the folder there were a few MIRC icons and
    >> other IRC related things and I tried to delete the folder but loads of it
    >> said I could not access it and could not delete it. I did a system

    > restore
    >> and the folder is still there but without the MIRC items.
    >>
    >> Does anyone know what it is and why I can't see it through My Computer?
    >>
    >> I've done a full system scan with Norton and have no viruses. I have
    >> also
    >> run the stinger and an online virus scan all showing clear. Also 3
    >> different spyware searches - also all clear.
    >>
    >>

    >
    >
    > How do I delete an "undeletable" file?
    >
    > Sometimes you want to delete a file but when you do so an error message
    > pops
    > and tells you it cannot be done. Do successfully delete such a file do the
    > following:
    >
    > 1.. Open a Command Prompt window and leave it open.
    >
    > 2.. Close all open programs.
    >
    > 3.. You now need to close EXPLORER.EXE. The proper way to shutdown
    > Explorer is to raise the "Shut Down Windows" dialog (select "Shut Down..."
    > from the start menu), hold down CTRL+SHIFT+ALT and press the CANCEL
    > button.
    > Explorer will exit cleanly.
    >
    > Note: The <CTRL+SHIFT+ALT> at the 'Shut Down Windows' dialog method of
    > closing Explorer is built into Explorer. (It was specifically designed so
    > that developers writing Shell Extensions could get Explorer to release
    > their
    > Shell Extension DLLs while debugging them).
    >
    > 4.. Go back to the Command Prompt window and change to the directory
    > where
    > the undeletable file is located in. At the command prompt type DEL
    > <filename> where <filename> is the file you wish to delete.
    >
    > 5.. Go back to Task Manager, click File, New Task and enter EXPLORER.EXE
    > to restart the GUI shell.
    >
    > 6.. Close Task Manager.
    >
    > (Tip modification submitted by James R. Twine who has a great utility
    > called
    > Delete FXP Files that can help you delete files and folders that simply
    > won't go away).
    >


    Thank you, that is very interesting to know.

    But I won't be deleting this until I know what it is.
     
    MiniEmma, Mar 23, 2005
    #4
  5. MiniEmma

    MiniEmma Guest

    "EricP" <> wrote in message
    news:...
    > On Wed, 23 Mar 2005 14:13:33 +0000 (UTC), "MiniEmma"
    > <> babbled like a waterfall and said:
    >
    >>Running windows xp prof
    >>
    >>Yesterday norton antivirus popped up a few virus warnings for IRC Trojan
    >>and
    >>a few others. The infected files were in 'c:/windows/fonts/ias' folder
    >>
    >>When I browse through My Computer (hidden folders made viewable), the
    >>Fonts
    >>directory does not have any folders in, but if I go to 'Start>Search>Files
    >>and Folders>Browse' I can then see the folder called 'ias' in the fonts
    >>folder
    >>
    >>When I first managed to get to the folder there were a few MIRC icons and
    >>other IRC related things and I tried to delete the folder but loads of it
    >>said I could not access it and could not delete it. I did a system
    >>restore
    >>and the folder is still there but without the MIRC items.
    >>
    >>Does anyone know what it is and why I can't see it through My Computer?
    >>
    >>I've done a full system scan with Norton and have no viruses. I have also
    >>run the stinger and an online virus scan all showing clear. Also 3
    >>different spyware searches - also all clear.
    >>

    > You have to turn off the Hidden file attribute. This should reveal
    > several files there. If you have one named "shares.bat", stick it in
    > notepad and post the text here so we can see what it was activating.
    >
    > Not much on this anywhere.
    >


    I already have hidden files showing.

    I have checked for a 'shares.bat' file and there does not appear to be one
    but there is a file called 'sample.cpp' that contains the following text at
    the top:

    /*****************************************************************
    Filename : sample.cpp
    Description : check xxxxxx vulnerable
    Author : glacier
    Update : 2002-07-09

    Copyright (C) 2002 http://www.xfocus.org All Rights Reserved
    *****************************************************************/
    <snipped>

    I followed the link but did not really understand what i was seeing :)





    'Config.bak' says this at the start:

    # PORT-LIST: Customizing scanning port list

    # SCAN-MODE: You can set this value to "TCP" or "SYN"
    # TCP: TCP connect() port scan (default)
    # SYN: SYN stealth port scan

    [PORT-SCAN-OPTIONS]
    PORT-LIST=1-139,443,445,1080,1433,2049,3128,3389,5000,7000-7010,8010,8080,8181
    SCAN-MODE=TCP
    <snipped>



    there were not really any other files that had anything to say.

    you are right there is not much info about this around, i did a good google
    before i posted.

    regards
    MiniEmma
     
    MiniEmma, Mar 23, 2005
    #5
  6. MiniEmma

    Bigbri Guest

    I have ias folder in windows used by m/s access programme files but it is
    not in the fonts section

    --
    Bigbri
     
    Bigbri, Mar 23, 2005
    #6
  7. MiniEmma

    MiniEmma Guest

    "EricP" <> wrote in message
    news:...
    > On Wed, 23 Mar 2005 14:13:33 +0000 (UTC), "MiniEmma"
    > <> babbled like a waterfall and said:
    >
    >>Running windows xp prof
    >>
    >>Yesterday norton antivirus popped up a few virus warnings for IRC Trojan
    >>and
    >>a few others. The infected files were in 'c:/windows/fonts/ias' folder
    >>
    >>When I browse through My Computer (hidden folders made viewable), the
    >>Fonts
    >>directory does not have any folders in, but if I go to 'Start>Search>Files
    >>and Folders>Browse' I can then see the folder called 'ias' in the fonts
    >>folder
    >>
    >>When I first managed to get to the folder there were a few MIRC icons and
    >>other IRC related things and I tried to delete the folder but loads of it
    >>said I could not access it and could not delete it. I did a system
    >>restore
    >>and the folder is still there but without the MIRC items.
    >>
    >>Does anyone know what it is and why I can't see it through My Computer?
    >>
    >>I've done a full system scan with Norton and have no viruses. I have also
    >>run the stinger and an online virus scan all showing clear. Also 3
    >>different spyware searches - also all clear.
    >>

    > You have to turn off the Hidden file attribute. This should reveal
    > several files there. If you have one named "shares.bat", stick it in
    > notepad and post the text here so we can see what it was activating.
    >
    > Not much on this anywhere.


    Hi

    Reposting because it's been an hour and I can't see the first one.

    I already have hidden files showing.

    I have checked for a 'shares.bat' file and there does not appear to be one
    but there is a file called 'sample.cpp' that contains the following text at
    the top:

    /*****************************************************************
    Filename : sample.cpp
    Description : check xxxxxx vulnerable
    Author : glacier
    Update : 2002-07-09

    Copyright (C) 2002 http://www.xfocus.org All Rights Reserved
    *****************************************************************/
    <snipped>

    I followed the link but did not really understand what i was seeing :)





    'Config.bak' says this at the start:

    # PORT-LIST: Customizing scanning port list

    # SCAN-MODE: You can set this value to "TCP" or "SYN"
    # TCP: TCP connect() port scan (default)
    # SYN: SYN stealth port scan

    [PORT-SCAN-OPTIONS]
    PORT-LIST=1-139,443,445,1080,1433,2049,3128,3389,5000,7000-7010,8010,8080,8181
    SCAN-MODE=TCP
    <snipped>



    there were not really any other files that had anything to say.

    you are right there is not much info about this around, i did a good google
    before i posted.

    regards
    MiniEmma
     
    MiniEmma, Mar 23, 2005
    #7
  8. MiniEmma

    °Mike° Guest

    On Wed, 23 Mar 2005 17:26:18 +0000 (UTC), in
    <d1s8rq$cni$>
    MiniEmma scrawled:

    <snip>

    >I have checked for a 'shares.bat' file and there does not appear to be one
    >but there is a file called 'sample.cpp' that contains the following text at
    >the top:
    >
    >/*****************************************************************
    > Filename : sample.cpp
    > Description : check xxxxxx vulnerable
    > Author : glacier
    > Update : 2002-07-09
    >
    > Copyright (C) 2002 http://www.xfocus.org All Rights Reserved
    > *****************************************************************/
    ><snipped>
    >
    >I followed the link but did not really understand what i was seeing :)


    Kaspersky tags several of the programs from that web site
    as backdoor trojans. For example, "Wolf" is advertised as
    Extended Telnet Services but KAV says it is Backdoor.Win32.Wolf.

    I suggest that if you know nothing of this "service", and it
    is residing in your Fonts folder, boot into Safe Mode and
    delete the entire "IAS" folder.

    I suggest that you temporarily disable Norton AV and install
    the trial version of Kaspersky. UPDATE IT, and perform a
    COMPLETE system scan.

    <snip>

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Mar 23, 2005
    #8
  9. MiniEmma

    MiniEmma Guest

    "°Mike°" <> wrote in message
    news:4245c026.3738453@localhost...
    > On Wed, 23 Mar 2005 17:26:18 +0000 (UTC), in
    > <d1s8rq$cni$>
    > MiniEmma scrawled:
    >
    > <snip>
    >
    >>I have checked for a 'shares.bat' file and there does not appear to be one
    >>but there is a file called 'sample.cpp' that contains the following text
    >>at
    >>the top:
    >>
    >>/*****************************************************************
    >> Filename : sample.cpp
    >> Description : check xxxxxx vulnerable
    >> Author : glacier
    >> Update : 2002-07-09
    >>
    >> Copyright (C) 2002 http://www.xfocus.org All Rights Reserved
    >> *****************************************************************/
    >><snipped>
    >>
    >>I followed the link but did not really understand what i was seeing :)

    >
    > Kaspersky tags several of the programs from that web site
    > as backdoor trojans. For example, "Wolf" is advertised as
    > Extended Telnet Services but KAV says it is Backdoor.Win32.Wolf.
    >
    > I suggest that if you know nothing of this "service", and it
    > is residing in your Fonts folder, boot into Safe Mode and
    > delete the entire "IAS" folder.
    >
    > I suggest that you temporarily disable Norton AV and install
    > the trial version of Kaspersky. UPDATE IT, and perform a
    > COMPLETE system scan.
    >
    > <snip>


    Well I have followed your instructions and now I want to know WHY norton
    didn't find the 16 files that Kaspersky found???

    Thank you mike, I have deleted all files Kaspersky threw up and deleted the
    'ias' folder as well

    Unfortuantely I obviously did not set up Kaspersky very well and ended up
    not being able to browse so I have uninstalled and gone back to Norton - for
    now !!

    point of interest - 'ias.exe' throws up far more on google than just 'ias'
     
    MiniEmma, Mar 23, 2005
    #9
  10. MiniEmma

    °Mike° Guest

    On Wed, 23 Mar 2005 23:12:05 +0000 (UTC), in
    <d1st45$k0t$>
    MiniEmma scrawled:

    >
    >"°Mike°" <> wrote in message
    >news:4245c026.3738453@localhost...


    <snip>

    >> I suggest that you temporarily disable Norton AV and install
    >> the trial version of Kaspersky. UPDATE IT, and perform a
    >> COMPLETE system scan.
    >>
    >> <snip>

    >
    >Well I have followed your instructions and now I want to know WHY norton
    >didn't find the 16 files that Kaspersky found???


    Because Kaspersky if far better, and lighter, than Norton.

    >Thank you mike, I have deleted all files Kaspersky threw up and deleted the
    >'ias' folder as well
    >
    >Unfortuantely I obviously did not set up Kaspersky very well and ended up
    >not being able to browse so I have uninstalled and gone back to Norton - for
    >now !!


    Kaspersky has a forum, if you want to ask questions of
    people in the know:
    http://www.kaspersky.com/forum

    >point of interest - 'ias.exe' throws up far more on google than just 'ias'


    Yes, but it may not have anything to do with the "ias" folder
    that you found.

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Mar 24, 2005
    #10
  11. MiniEmma

    MiniEmma Guest

    "MiniEmma" <> wrote in message
    news:d1st45$k0t$...
    >
    > "°Mike°" <> wrote in message
    > news:4245c026.3738453@localhost...
    >> On Wed, 23 Mar 2005 17:26:18 +0000 (UTC), in
    >> <d1s8rq$cni$>
    >> MiniEmma scrawled:
    >>
    >> <snip>
    >>
    >>>I have checked for a 'shares.bat' file and there does not appear to be
    >>>one
    >>>but there is a file called 'sample.cpp' that contains the following text
    >>>at
    >>>the top:
    >>>
    >>>/*****************************************************************
    >>> Filename : sample.cpp
    >>> Description : check xxxxxx vulnerable
    >>> Author : glacier
    >>> Update : 2002-07-09
    >>>
    >>> Copyright (C) 2002 http://www.xfocus.org All Rights Reserved
    >>> *****************************************************************/
    >>><snipped>
    >>>
    >>>I followed the link but did not really understand what i was seeing :)

    >>
    >> Kaspersky tags several of the programs from that web site
    >> as backdoor trojans. For example, "Wolf" is advertised as
    >> Extended Telnet Services but KAV says it is Backdoor.Win32.Wolf.
    >>
    >> I suggest that if you know nothing of this "service", and it
    >> is residing in your Fonts folder, boot into Safe Mode and
    >> delete the entire "IAS" folder.
    >>
    >> I suggest that you temporarily disable Norton AV and install
    >> the trial version of Kaspersky. UPDATE IT, and perform a
    >> COMPLETE system scan.
    >>
    >> <snip>

    >
    > Well I have followed your instructions and now I want to know WHY norton
    > didn't find the 16 files that Kaspersky found???
    >
    > Thank you mike, I have deleted all files Kaspersky threw up and deleted
    > the 'ias' folder as well
    >
    > Unfortuantely I obviously did not set up Kaspersky very well and ended up
    > not being able to browse so I have uninstalled and gone back to Norton -
    > for now !!
    >
    > point of interest - 'ias.exe' throws up far more on google than just 'ias'
    >


    I have had to go and look in google groups to see your reply mike, it hasn't
    shown up on my btopenworld account in OE !!!

    You said :
    "Yes, but it may not have anything to do with the "ias" folder
    that you found."

    I forgot to mention that Kaspersky found, in temp internet files, a file
    called 'ias[1].exe' and another called 'ias[1].exe/msi.exe' which it
    described as a Backdoor.Win32.mIRC-based - and it was mIRC files/icons that
    made me worry about the ias folder in the first place.

    I will have another go at running Kaspersky soon and will certainly visit
    the forums you mentioned in your reply that i cannot see on here !!

    what did you mean when you said Kaspersky was 'lighter' ?

    MiniEmma :)
     
    MiniEmma, Mar 24, 2005
    #11
  12. "carson" <> wrote in message
    news:
    > "MiniEmma" <> wrote in message
    > news:d1rtid$2kb$...
    >> Running windows xp prof
    >>
    >> Yesterday norton antivirus popped up a few virus warnings for IRC
    >> Trojan and a few others. The infected files were in
    >> 'c:/windows/fonts/ias' folder
    >>
    >> When I browse through My Computer (hidden folders made viewable),
    >> the Fonts directory does not have any folders in, but if I go to
    >> 'Start>Search>Files and Folders>Browse' I can then see the folder
    >> called 'ias' in the fonts folder
    >>
    >> When I first managed to get to the folder there were a few MIRC
    >> icons and other IRC related things and I tried to delete the folder
    >> but loads of it said I could not access it and could not delete it.
    >> I did a system restore and the folder is still there but without the
    >> MIRC items.
    >>
    >> Does anyone know what it is and why I can't see it through My
    >> Computer?
    >>
    >> I've done a full system scan with Norton and have no viruses. I
    >> have also run the stinger and an online virus scan all showing
    >> clear. Also 3 different spyware searches - also all clear.
    >>
    >>

    >
    >
    > How do I delete an "undeletable" file?
    >
    > Sometimes you want to delete a file but when you do so an error
    > message pops


    STOLEN, UNCREDITED text from www.petri.co.il/delete_undeletable_files.htm
     
    Miss Perspiration Stink, Mar 24, 2005
    #12
  13. MiniEmma

    °Mike° Guest

    On Thu, 24 Mar 2005 09:48:49 +0000 (UTC), in
    <d1u2e1$p5j$>
    MiniEmma scrawled:

    <snip>

    >what did you mean when you said Kaspersky was 'lighter' ?


    It is not the same bloated software that Symantec products
    seem to be, by that I mean bloated code, making the whole
    package MUCH larger than it should be/needs to be. Also,
    it is not such a drain on the system.

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Mar 24, 2005
    #13
  14. MiniEmma

    MiniEmma Guest

    "°Mike°" <> wrote in message
    news:42471230.4422031@localhost...
    > On Thu, 24 Mar 2005 09:48:49 +0000 (UTC), in
    > <d1u2e1$p5j$>
    > MiniEmma scrawled:
    >
    > <snip>
    >
    >>what did you mean when you said Kaspersky was 'lighter' ?

    >
    > It is not the same bloated software that Symantec products
    > seem to be, by that I mean bloated code, making the whole
    > package MUCH larger than it should be/needs to be. Also,
    > it is not such a drain on the system.


    That's great, thank you so much for all your help and info

    MiniEmma
     
    MiniEmma, Mar 24, 2005
    #14
  15. MiniEmma

    °Mike° Guest

    On Thu, 24 Mar 2005 22:08:25 +0000 (UTC), in
    <d1vdop$9d0$>
    MiniEmma scrawled:

    >
    >"°Mike°" <> wrote in message
    >news:42471230.4422031@localhost...
    >> On Thu, 24 Mar 2005 09:48:49 +0000 (UTC), in
    >> <d1u2e1$p5j$>
    >> MiniEmma scrawled:
    >>
    >> <snip>
    >>
    >>>what did you mean when you said Kaspersky was 'lighter' ?

    >>
    >> It is not the same bloated software that Symantec products
    >> seem to be, by that I mean bloated code, making the whole
    >> package MUCH larger than it should be/needs to be. Also,
    >> it is not such a drain on the system.

    >
    >That's great, thank you so much for all your help and info


    You're welcome.

    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Mar 25, 2005
    #15
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Guest
    Replies:
    55
    Views:
    2,027
    Guest
    Apr 15, 2004
  2. Paul - xxx
    Replies:
    2
    Views:
    753
    Monsignor Larville Jones MD
    Aug 20, 2003
  3. Gary Rose

    XP Q uests: Cookies Folder? Pop-Up Ads Folder ?

    Gary Rose, Oct 15, 2003, in forum: Computer Support
    Replies:
    0
    Views:
    508
    Gary Rose
    Oct 15, 2003
  4. Patty Cake

    mystery folder... know what this is?

    Patty Cake, Nov 8, 2005, in forum: Computer Information
    Replies:
    23
    Views:
    765
    Duane Arnold
    Nov 11, 2005
  5. Spiderd

    EZStickyNotes Folder mystery

    Spiderd, Feb 17, 2007, in forum: Computer Support
    Replies:
    1
    Views:
    2,224
    meerkat
    Feb 17, 2007
Loading...

Share This Page