Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

A vista laptop I have been asked to take a look at is exhibiting virus-like behaviour.

When Internet Explorer is open, every ten minutes a new command window opens up with nothing in it. It is a random (increasing digit) exe file which is stored in users/appdata/local/temp

I installed and ran a MalwareBytes AntiMalware full scan and updated and then ran a full McAfee scan. Neither of these showed anything, nor did they delete the executable files.

I looked at the netstat output and nothing showed up out of the ordinary and there were no services running that appeared dubious.

The machine had the full McAfee package on so I would have thought that something "like this" shouldn't have got on to the machine.

It isn't my laptop and I no longer have access to it. My advice was that the machine needs a full format & re-install of windows.

What other approach could I have taken or what other procedures should I have tried?

share|improve this question

migrated from serverfault.com Jul 29 '10 at 12:17

This question came from our site for professional system and network administrators.

marked as duplicate by ChrisF, studiohack Oct 28 '11 at 15:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Reference question about malware and viruses, maybe you will find something interesting there: superuser.com/questions/100360/… –  Gnoupi Jul 29 '10 at 12:22

3 Answers 3

up vote 6 down vote accepted

Usually it is indeed the best idea to reinstall the system as it has lost status of trust and there is no easy way to confirm the system is no longer corupted even after removing some of the malware.

If there where preparations made for such case like taking checksums of trusted states that are compared on a regular basis with the running system you could maybe evaluate such a check and return to a trusted state.

share|improve this answer

You could do an offline scan: pull the hdd out of the laptop and mount it to another system with an external USB enclosure and scan it that way. Could be a rootkit hiding itself that may not be detectable when the system is up and running.

share|improve this answer
    
+1 More and more rootkits lately and they will usually not be detected by normal scan. Good suggestion –  Dave M Jul 29 '10 at 12:23
    
Thanks. I can't confirm if this would have fixed it as I no longer have access to the machine. Seems sensible advice though. –  PhillC Jul 29 '10 at 14:29
    
This is a very quick and easy option from my experience. Much malware will prevent the install of diagnostics tools right on the OS, but if you pull the HD and scan as an external drive with a clean machine, you can detect and fix problems and save the trouble of a full install. I would recommend running several scans with several software packages to ensure coverage, running them overnight (AV, Malwarebytes, AdAware, Spybot, etc) –  RussellW Jul 29 '10 at 14:51

Maybe try turning off all IE plugins and see if it continues.

share|improve this answer
    
Apparantly it did .... thanks though. –  PhillC Jul 29 '10 at 14:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.