Hi,

My pc has recently be infected by the W32/Chir.b@MM virus. Following the general advice on W32/Chir.b@MM, I've done a full scan with McAfee, and also removed the malicious "C:\WINDOWS\SYSTEM\runonce.exe" from windows registry.

The only thing is I couldn't turn off system restore to reboot due to the group policy on staff computers.

It seems I couldn't completely remove this W32/Chir.b@MM virus from my pc. Now I have the following virus message pop up now and then:

Name In Folder
BIT.tmp C:\WINDOWS\SoftwareDistribution\Download\577f85d9343cc6463c3eccfc58d91738

Detected As Detection Type Status Application Username
W32/Chir.b@MM Virus Cleaned C:\WINDOWS\System32\svchost.exe NT AUTHORITY\SYSTEM

The virus keeps on generating BIT1.tmp, BIT2.tmp, BIT3.tmp ......... and so on. The nasty bit is, in the "quarantine" folder on C drive, it also generates some really large BUP files. I have to keep on deleting these BUP files from the quarantine folder, otherwise it fills up the C drive.

I used CClearner to scan the registry, nothing really obvious there.

I'm out of my depth, please help.