Forum Home
Press F1
 
Thread ID: 50781 2004-11-01 08:42:00 Font folder - 1.19GB - bitmap files problem Nath (1108) Press F1
Post ID Timestamp Content User
286697 2004-11-01 08:42:00 Gidday, I have been having problems with loosing hard drive space and have just discovered my windows font folder (98 SE) is huge - 1.19 GB. under properties it says there are 1278 files and 1 folder. Under explorer the folder within the font folder is called 1.image and contains 1046 bitmap images (.bmp). These are dated has being created everyday this year since june - ie, they seem to create a new bmp file everytime I use the computer or maybe the internet??
Something funny is definitely going on, I did a virus scan and no virus

Any ideas appreciated
cheers
Nath
Nath (1108)
286698 2004-11-01 08:58:00 It does sound like a worm .

I came across the same thing a few months ago, when I reformatted a PC.

It listed over 1000 pic files in some folder. I would go to start/run and type msconfig and see whats under the startup folder. Or go to start/run and type sysedit see if u notice any strange entries under any of the entries there.

I dont think bmp files should be under a font folder, or an image folder for that matter. What did u scan it for, for viruses??
Spacemannz (808)
286699 2004-11-01 09:08:00 Gidday,

thanks for the quick reply. The only thing under startup to do with the windwos font folder is wintask - but what seems strange is I have two wintask under startup - one is ticked (selected) and one is not - could this be my problem?? I also went to sysedit - nothing seemed to stand out, but i wouldn't really no what was starnge entries anyway.

yes i did a scan for viruses

cheers
Nath
Nath (1108)
286700 2004-11-01 09:16:00 A very unplesant thought, have you viewed any of said images?

D.
drb1 (4492)
286701 2004-11-01 09:20:00 Ok . According to Google . Wintask . exe could be a keylogger (like Spyware) .

Use Spybot or Adaware to scan / remove it .

Wintask . exe definition, relationships, removal:

wintask . exe definition

wintask . exe description: File wintask . exe is related to keylogger Donkey KeyLogger .

File wintask . exe removal: WARNING!!! File wintask . exe is related to keyloggers . This is serious violation of your privacy, your system is under security threat .

We advice you to scan your computer and eliminate possible threats .
download scanner and remover

Or this:

W32 . Navidad . 16896, which is a mass mailing worm .

. symantec . com/avcenter/venc/data/w32 . navidad . 16896 . html" target="_blank">securityresponse . symantec . com
is the site on what it does and what it is .

. symantec . com/avcenter/venc/data/w32 . navidad . fix . htm" target="_blank">securityresponse . symantec . com
is the fix tool for this worm .

I would say wintask . exe ISNT part of Windows . End its process in task manager .
Spacemannz (808)
286702 2004-11-01 09:23:00 Do a search at http://www.symantec.com for the worm i listed. Spacemannz (808)
286703 2004-11-01 09:26:00 If it was me I'd delete the 1.image folder (but keep it in the recycle bin) and see what happens. But caution, I can't confirm that this may not mess something up). But that's what I'd try personally - I doubt there's any risk. Greg S (201)
286704 2004-11-01 10:04:00 Gidday, it does sound like the W32.Navidad.16896 worm, however I didn't get the following "Finally, the worm places a flower icon in the system tray of the taskbar" ???

I will disable wintask and delete the folder with all the pics in it and see what happens
I viewed the bmp images and basically they are random snapshots of my computer - ie, playing games, screensaver pics - I hope these pics haven't gone elsewhere??

thanks for the help
cheers
Nath
Nath (1108)
286705 2004-11-01 10:12:00 I would also go to start/run and type regedit. Search for wintask.exe. If anything comes up delete the entry. (if u havent yet)

No worries :-)

You could also try Spybot or Adaware, if u havent yet. See what both pick up.

These may just be 2 examples of what wintask.exe does / is part of. If u would like to see if there are anymore , either go to www.google.com or http: Do a search for wintask.exe.
Spacemannz (808)
286706 2004-11-01 10:16:00 > I hope these pics haven't gone
> elsewhere??

Ouch - that sounds like a real possibility!
Greg S (201)
1 2