AAAAAAAAAAAH!!! I think mmf.sys = VIRUS!!!

[Gutter Ball]

Okay, I booted into safemode and did a deltree mmf.sys and it disappeared! However, when I rebooted..my desktop was rearranged, so I fixed it and by accident I opened up my accessories folder...Word pad was now renamed WORDPAD.EXE and when I tried to change it to just WordPad, Windows gave me an error message! (If I change it, it won't work or something like that). I rechecked for the mmf.sys file and it was back! I remember reading about the Wordpad virus thing, but I'm doing a forum search for "Wordpad virus" now and can't seem to find it. I deleted WORDPAD.EXE and MSPAINT.EXE rebooted, and poof! Back they came..so I think I found my problem..now I need to find the solution! If anyone would kindly point me to the thread, I'd appreciate it! Thanks http://sysopt.earthweb.com/forum/smile.gif

[SoopaStar]

wordpad always has the extension .exe. Maybe now you can just see them (it is turned off by default--you can alter that in the tools-->folder options-->view-->"CHECKBOX" hide extensions for known file types). I highly doubt its a virus. Right click on the file, choose properties, then goto the version tab and see what it says. If it doesnt have a version tab, that doesn't mean that it is a virus either. I did a search on:
http://www.norton.com/avcenter/vinfodb.html and foudn nothing with NORTON in it. What operating system are you using? More than likely this file is a part of a driver set for some piece of hardware you are using.

Paul

[Gutter Ball]

SoopaStar: Yep, I know it has the exe extension..but it never showed up like that before. It used to always just say "WordPad", not WORDPAD.EXE.. It might be something else, but I can't seem to find anyone else that has it on their comps or laptops :/ I'd feel much better if someone had it http://sysopt.earthweb.com/forum/smile.gif I tried to "attrib -h -r" and it tells me "Not resetting..." Oh well, someone has to know where this file came from!

[smokin1]

Is this what you were thinking about?
http://www.pchell.com/virus/qaz.shtml

[Warthog]

The shortcut is listed as Wordpad.exe?
or is it the file name?

Warthog

[Gutter Ball]

Well, thanks for all your help and ideas. I guess it wasn't the qaz(thanks smokin')! Warthog: The icon on my desktop was named WORDPAD.EXE and Mspaint was named "MSPAINT.EXE" dumb me just deleted them and then recopied them from my start menu :/ So I'll never know! Ah well, I guess I'll just leave it for now http://sysopt.earthweb.com/forum/smile.gif