Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Let's say I was going to do a full system scan but I want to specify the scanner to look into certain directories.

What are the those directories for Windows XP, Vista, and 7?

I know the common one is /System32 but what are all the places malware could reside in?

share|improve this question
    
entries in the registry are relevant to how malware installs itself, and far more relevant if you're asking about where. –  barlop Jan 24 '11 at 23:59
1  
i'm suprised that somebody with 1600 rep still starts a question saying "Hello" and writes "Thanks" at the end –  barlop Jan 25 '11 at 0:00
    
@barlop: is that a bad thing? I dont get whats wrong with it. –  Chris Tarazi Jan 25 '11 at 5:14
add comment

closed as not constructive by random May 2 '12 at 1:36

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers

up vote 2 down vote accepted

It could reside anywhere if the program which planted it was ran under an administrative account and granted permissions. Typically you will also find malware in temp folders (e.g. IE cache), as some are guaranteed to be writeable by default, even for standard users -- a perfect breeding ground for malware.

share|improve this answer
    
Yup. I'd like to add that I've found malware hiding in all sorts of unexpected places, so the best thing to do is run a full scan and bear with it. –  user3463 Jan 24 '11 at 23:46
    
Ok that makes sense, but what are the common directories (specially)? –  Chris Tarazi Jan 24 '11 at 23:46
1  
Temp folders and C:\Windows (and subfolders) would be my best guess. C:\Program Files is notorious too. Like Randolph said, a full system scan is always good -- better safe than sorry. A good place to ask would be a popular AV's forums (e.g. symantec forums). –  John T Jan 24 '11 at 23:48
    
Thanks but u know there are those very very pesky customers who want their computer NOW and a full system scan is not really an option, I would know b/c I have tried to convince them countless times with no luck. –  Chris Tarazi Jan 24 '11 at 23:55
    
@ct6116 that's why most AV's have a "quick scan" option, they will do the dirty work for you. Personally, from a customer perspective, I would feel safer if the tech spent an extra hour or 2 with my computer rather than 10 minutes, wouldn't you? Try explaining that it is beneficial to them unless they want to be returning their PC again soon. –  John T Jan 24 '11 at 23:58
show 1 more comment

The most effective second stage malware or the ones that cause the most symptoms are rootkits - kernel-mode drivers so they're usually hidden in "c:\windows\system32\drivers" or infect the MBR. Use Autoruns to identify them. Often their initial payloads are deployed to temporary internet files or a hidden user directories. Knowing these directories usually doesn't even matter once the system is infected because they controlled by the rootkit and even if you did manage to delete them they would be quickly rewritten elsewhere. I've yet to find effective anti-virus software for removal so a combo platter, starting with a solid Cleanup or Cleaner; run Combofix from the admin profile in in Safe Mode (run as Administrator) and then sysinternals tools to nitpick out any stragglers

share|improve this answer
    
Thanks for the answer. I ran Kaspersky Rescue disk and removed a lots of malware thinking the system its cleaned out, but when I logged back in it was still loaded with popups and rogues. Then I was able to run ComboFix which deleted 99% of everything but IE was still being redirecting on Google searches so I ran SuperantiSpyware which closed the deal. –  Chris Tarazi Jan 29 '11 at 18:06
add comment

Malware could be anywhere. From personal experience, I've usually found them in the Program Files folder. If it's a huge worry, you might want to run a scan once every few days. I highly recommend Microsoft Security Essentials: http://www.microsoft.com/security_essentials/

share|improve this answer
add comment

I commonly find them in the user accounts Documents and Temp folders, IE Temporary Internet files folder.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.