McAfee repeatedly detects VDS.EXE in temp folder.

[everway9]

Hi everyone.

I've come here to post this before posting on the McAfee forum because, well.... it's just a better forum, period!

A day ago McAfee live safe started detecting and quarantining VDS.EXE in the local\temp folder. It detects it repeatedly all day in about 1 hour intervals.

I restored one of the quarantined VDS.EXE threats back to the temp folder and took a screenshot of the file explorer window showing the folder containing the VDS.EXE and it's associated files. Also on the screenshot is the McAfee quarantine window showing the details of one of the other VDS.EXE threats. There are at least 20 more of the VDS.EXE threats still in quarantine.

Obviously something is writing these files to the temp folder on a regular basis. I know vds.exe is the Virtual Disk Service which is in the System32 and WinSxS folders but vds.exe is in lowercase whereas the VDS.EXE in the temp folder is in capital letters.

I'm curious to know what is creating the VDS.EXE and it's associated files in the temp folder.

Maybe these files have always been appearing in the temp folder and it's just that McAfee has suddenly started to detect them as threats. OR... Maybe they have only recently started to appear in the temp folder and McAff is correct to detect them as a threat.


I haven't gotta clue and I'm wondering if any of you might know what it's all about.

Any input would be most welcome.

Many thanks.

 

[everway9]

Hi.

Well... during my attempts to fix the SQLiteC issue I performed a clean boot, including disabling all non-Microsoft services and startup items in task manager. This appears to have fixed this VDS.EXE issue and the SQLiteC issue in one go.

Whats really puzzling now though is the fact that after running the clean boot etc I restored all services and startup items. I was expecting the VDS.EXE issue to come back after that but it didn't.

Anyway. Thanks so much for all your help. I'm very grateful. Sorry if I've wasted any of your time.