Power32.exe a virus?

[EatnS10s]

I got this problem with a computer. It's Windows XP and when it boots to the log on screen, you can go to any of the names and nothing but the background loads. CTRL - ALT - DEL and there's this program called power32.exe running. End Task it and the your at the desktop. It's hidden in the WINDOWS\SYSTEM32 folder and I cannot remove the hidden attribute nor can I delete, alter or rename it through command prompt. To me it's acting Viral do to the symptoms. But no virus scan will detect it as a virus.

Any insight?

[kato2274]

maybe spyware.

use something like spybot or ad-aware to check for spyware - also make sure you are using the latest updates. (I prefer spybot)

[NooNoo]

There is very little about this program out there. As far as I can tell its probably a left over from msblast or one of the variants.

Try this.
Go to safe mode
Turn off system restore
Search the registry for power32.exe and delete any keys you find.
Start, run, msconfig and check through win.ini and system.ini for it and check that it doesn't appear in the startup tab, if it does, uncheck it.

Reboot to safe mode.
Now try and delete the power32.exe file. If this doesn't work then reboot with the xp cdrom and go to repair console and delete it from there.

[Platypus]

Isn't power32.exe the power management for mobile installations ie laptops? There isn't an M chip in the system is there? Maybe a corrupted install trying to use PM features the system doesn't have?

[EatnS10s]

There is very little about this program out there. As far as I can tell its probably a left over from msblast or one of the variants.

Try this.
Go to safe mode
Turn off system restore
Search the registry for power32.exe and delete any keys you find.
Start, run, msconfig and check through win.ini and system.ini for it and check that it doesn't appear in the startup tab, if it does, uncheck it.

Reboot to safe mode.
Now try and delete the power32.exe file. If this doesn't work then reboot with the xp cdrom and go to repair console and delete it from there.

Have done all the above except for the repair console. Doing that right now and will post results. Thank you.


***update***
Having done the above minus the recover console (new issue) I started normally and did not have the problem anymore. I'm sure the file is still there so I am going to continue working on deleting it. (it's an HP and in safemode you can log in as Admin, but in recovery console there's supposively a password... ?? Found fix for that and am working on it. Thanks again.)