xxxyyyzzz.dat and xXx.xXx files in AppData\Local\Temp

Discussion in 'malware problems & news' started by mango, Mar 20, 2010.

Thread Status:
Not open for further replies.
  1. mango
    Offline

    mango Registered Member

    I noticed self replicating files xxxyyyzzz.dat and xXx.xXx in AppData\Local\Temp folder.

    The xxxyyyzzz.dat containsthe email adress in |Messenger| [email address] |Password| [password] |format.

    Eset doesnt find anything, anyone know what this is?
  2. CloneRanger
    Offline

    CloneRanger Registered Member

    Hi strange Eset doesnt find anything as they list it as Malware ? http://www.eset.com/threat-center/encyclopedia/threats/win32spateta

    But there are lots of links on google suggesting it could be legit as well o_O

    I would do a System Restore and see if they still appear, and/or download MBAM and update and scan http://www.malwarebytes.org/mbam.php

    Also i would upload those files to VT for scanning http://www.virustotal.com but posting the full results on here is against TOS. You can say if they are detected though, and PM me the results and/or link.
  3. mango
    Offline

    mango Registered Member

    Did run MBAM a couple of times and f-secure online scan + Eset.

    MBAM found and finally deleted xxx.xxx uuu.uuu files, and i dont see them replicating again every minute. Hope that helped.
  4. CloneRanger
    Offline

    CloneRanger Registered Member

    Good :thumb:

    Well i as rather hoping it all helped you more than me :D
Thread Status:
Not open for further replies.