Exterminate It! Antimalware


Known threats:700,086 Last Update:March 16, 12:51



Thanks so much for your help. For now, this seemed to have solved the problem and found all the infected files. I'll keep you updated, as I know this virus can be very hard to kill.

Thanks a million.


File: My Pictures.url

Location of My Pictures.url and Associated Malware

Check whether My Pictures.url is present in the following locations:

Windows 2000, Windows XP, Windows Server 2003 specific My Pictures.url file locations:

  • C:\Documents And Settings\USER_NAME\My Documents\My Pictures\My Pictures.url

Windows Vista, Windows Server 2008, Windows 7, Windows 8 specific My Pictures.url file locations:

  • C:\Users\USER_NAME\Pictures\My Pictures.url

If you find My Pictures.url file in any of these locations, your computer is very likely to be infected with the following malware:

IMPORTANT: Malware files can be camouflaged with the same file names as legitimate files. The My Pictures.url file is associated with malware only if found in the locations listed above.


Different Variations of My Pictures.url File^

File SizeFile Md5Last Seen
1443A0651288A57342413D240D36C393185Mar 5, 2010
83CCEBEAC3D5AF6CBFC66820B7B1D08495Mar 22, 2010
1999C84BE6BE3D55BD7322B6E0D5841A07DMar 27, 2010
14057F85138EC7F8282D49E0DF3F4715867May 15, 2010
1429951A0EA3EE9C3AA33D36607C8E17E0AMay 17, 2010
1408002F0654F99D8515D5A8EBB795CE80EJun 9, 2010
149C2431E34F3382DA13C60E9E74A2DB7B4Jun 17, 2010
143C87036ABCBAE861FD56453E01C516A90Aug 14, 2010
138B6EC17615C92B654388C0A39E6647FAAAug 17, 2010
144824D62A78BBEF6568CBC6A2E3C6FAAD9Aug 29, 2010
146F487773B5632518A5B8EECD19461EDC3Nov 9, 2010
131D9108FE60A3E97794A9E14C36FEE32C2Feb 24, 2011
199FDB5C6AF26CF4BEF4AF843A78C59A380Mar 11, 2011
1400DB98E9758953AA65DDC30898695255BApr 15, 2011
1380FBA62DBD7B8F0A81A3FA3833AD9E02EJun 9, 2011
136E8E23E5A69445340DF64F3766D01BFFAJul 8, 2011
133F2D9BD7071AF3C1E818901DB8189B4F9Aug 29, 2011
135EB8ECD19B9C36E3090333EBC961DFA44Sep 16, 2011
145F6026BF7C9F67C9EF5103D05394D7648Sep 28, 2011
1393529BB5E872017F703A7D5C458A73FF9Oct 8, 2011
140C2E846DD80DE24A4E43209AEC8DA5031Oct 15, 2011
14044FCA19D0086CAC434FED8BB8364958FNov 6, 2011
1384B763397444BFE68AC7B9C4CB8BA7378Nov 10, 2011
135BA931DE91884C30569E63063C3CCB9A8Nov 21, 2011
139AC569A3FFB9C4CF115969476C811D875Dec 14, 2011
81623762D8390F260CD95BF8173FEB675FDec 23, 2011
143A8489EC22FE3CD667FF9674D1C04DCCEFeb 1, 2012
20390388CBF0C12D730602AA7AFDE06040CFeb 17, 2012
1379F542B0ADCFDC3F6ECBE7117F91159B7Feb 24, 2012
1344F4AD87ED44E93375A938C32BF0B9C71Mar 1, 2012
143BEC3BBE3DF0104F74A1FF7B03E639C2BMar 28, 2012
1349DC06AA6D10A0DEA96B27A446C7EBB18Jun 5, 2012
136D935883AFB11010306C8B3B3D50AEEDEJul 31, 2012
140B5114BDB089F12541E55C90DBF195ACBApr 21, 2013
138796C805C27963B6AFB180B151B882564Jan 19, 2014
1398EAC369380AAB1B28AB0A2C5DF59298CFeb 15, 2016
136D112EB2E5723FFED9836A4C76F907CE5Apr 8, 2016
13692CB7E9FF1061AB966425B481A3ADCF0Jan 11, 2017

Why Is It Important to Remove Malware Files?^

It is imperative that you delete malware-associated files as soon as possible because they can be used - or are already being used - to inflict serious damage on your PC, including:

  • Disrupting the normal functioning of the operating system or rendering it completely useless.
  • Hijacking valuable private information (credit card numbers, passwords, PIN codes, etc.)
  • Directing all your Web searches to the same unwanted or malicious sites.
  • Dramatically slowing down your computer.
  • Gaining total control of your PC to spread viruses and trojans and send out spam.

How to Remove My Pictures.url^

  1. To enable deleting the My Pictures.url file, terminate the associated process in the Task Manager as follows:
    • Right-click in the Windows taskbar (a bar that appears along the bottom of the Windows screen) and select Task Manager on the menu.
    • In the Tasks Manager window, click the Processes tab.
    • On the Processes tab, select My Pictures.url and click End Process.
  2. Using your file explorer, browse to the file using the paths listed in Location of My Pictures.url and Associated Malware.
  3. Select the file and press SHIFT+Delete on the keyboard.
  4. Click Yes in the confirm deletion dialog box.
  5. Repeat steps 2-4 for each location listed in Location of My Pictures.url and Associated Malware.
  6. Notes:

    • The deletion of My Pictures.url will fail if it is locked; that is, it is in use by some application (Windows will display a corresponding message). For instructions on deleting locked files, see Deleting Locked Files.
    • The deletion of My Pictures.url will fail if your Windows uses the NT File System (NTFS) and you have no write rights for the file. Request your system administrator to grant you write rights for the file.

Deleting Locked Files^

You can delete locked files with the RemoveOnReboot utility. You can install the RemoveOnReboot utility from here.

After you delete a locked file, you need to delete all the references to the file in Windows registry.

To delete a locked file:

  1. Right-click on the file and select Send To -> Remove on Next Reboot on the menu.
  2. Restart your computer.

The file will be deleted on restart.

Note: In the case of complex viruses that can replicate themselves, malware files can reappear in the same locations even after you have deleted those files and restarted your computer. Exterminate It! Antimalware can effectively eradicate such viruses from your computer.

To remove all registry references to a My Pictures.url malware file:

  1. On the Windows Start menu, click Run.
  2. In the Open box, type regedit and click OK. The Registry Editor window opens.
  3. On the Edit menu, select Find.
  4. In the Find dialog box, type My Pictures.url. The name of the first found registry value referencing My Pictures.url is highlighted in the right pane of the Registry Editor window.
  5. Right-click the registry value name and select Delete on the menu.
  6. Click Yes in the Confirm Value Delete dialog box.
  7. To delete all other references to My Pictures.url, repeat steps 4-6.
IMPORTANT: Malware files can masquerade as legitimate files by using the same file names. To avoid deleting a harmless file, ensure that the Value column for the registry value displays exactly one of the paths listed in Location of My Pictures.url and Associated Malware.