Thread: application files error

today some of my application files in my documents show 0 kb space.
is this a virus or something.
nokia pc suite application
xp sp3 application and
avg application. all 3 are for installation. though i have already installed them before. when i click on them it shows "not a valid win32 application" and when i try to delete them it shows "being used by another program".
some other application files in the same my documents still exist like Dap86, firefox.exe etc.
i scanned my computer using nod 32 but it shows zero virus. Please help?

You have been infected with Vundo virus or one of its variants. Have you tried to install any "keygen/crack" software from sites such as dailykeys.com, serials.ws or similar. These sites are notorious for spreading malware.

Check the following:

a) Go to C:\Windows\System32 folder and sort by "Date Modified" in descending order. You may see 2 or 3 dll's which have been recently added.
b) Check these filenames on Google. You will get a few options on how to remove them.
c) There will be few .exe files in C:\Windows directory also which should not be existing.

From Wikipedia:

Vundu
Vundo infects victims' computers by exploiting a vulnerability in Sun Java 1.5 and earlier versions. Many of the popups advertise programs including (but not limited to) Sysprotect, Storage Protector and WinFixer.It attachs to the system using bogus Browser Helper Objects and DLL files attached to Winlogon and Explorer.exe.

Symptoms
Vundo will periodically show popups claiming that the computer's performance is "deteriorating", and that the user must download or buy (bogus) security software to fix this. ULWindowSeek or ULWindowURL popups are also a symptom of this virus. Many virus removal programs will remove some of these hidden files but not the actual DLL which has a random name. Some versions of Vundo will also create .ini and .ini2 files with random names. These files may be marked as hidden system files. While these can be deleted easily, the DLL usually cannot be removed because the file is in use as soon as Winlogon starts. If the DLL is removed but not the other files, they will make a new DLL with a different random name.

Depending on versions, Vundo attempts to prevent the user from removing it or otherwise impede its operation, such as by disabling the task manager or Windows registry editor.

Link: Vundo (Virtumondo) Removal Tool. Remove Vundo (Virtumondo) Now

I don't have any symptoms of Vundu trojan and

Go to C:\Windows\System32 folder and sort by "Date Modified" in descending order. You may see 2 or 3 dll's which have been recently added.

there is no new dll's added recently.
so far no scan shows any virus. computer also works fine

The symptoms you mention have happened to me in the past (a year ago).

Can you do the following?

a) Go to C:\Windows\System32 folder and sort by "Date Modified" in descending order.
b) Paste the results of the first 10-15 DLLs

Also check whether:

c) you are getting unwanted pop-ups inspite of your pop-up blocker ON (check this with IE)
d) your home page properly set or does it get hijacked.
e) you have unwanted browser helper objects
f) you are able to run 'msconfig' and are able to do registry editing

home page works fine, don't get any popup, msconfig works(i can edit startup options). i think its just some system problem. anyway here is system32 by date modified