Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

I believe I have a virus and the virus scanning tools I tried so far haven't found any (I will continue to run them in the meantime). However, how do I manually find and remove a virus?

My first steps were to look at msconfig startup and services. I found nothing suspicious (all but one app (Launchy, which is a incredibly convenient tool) were signed. All my services are signed as well.

Why I believe i have a 'virus' is that randomly I will get a privileged prompt to run install 1 and immediately after I hit "No" it will prompt again for install 2. When I boot up I use 3GB of RAM. When I look at task manager and look at the memory size of the apps it adds up to 1.4GB of RAM. When I log out/in I am using the 1.3 or 1.4 GB of RAM as normal. I sometimes see my CPU usage being eaten by 'cmd'. I have no idea what process ran it.

How do I find and remove this virus manually? The symptoms above should give you some ideas of where to start when tracking and removing the virus.

Unless the virus hijacked a chrome update, I do not believe I hit "Yes" for a privileged prompt to get it onto my machine, but it doesn't make sense that it could run on startup if I have never done that.

share|improve this question

marked as duplicate by Ƭᴇcʜιᴇ007, Indrek, Nifle, Canadian Luke, Renan Aug 26 '12 at 19:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

Look for it in process list in Windows Task Manager (enable "show processes from all users" option).

If process in Task Manager isn't killable (for example, a pair of virus processes taking care of each other), find the corresponding file on disk and revoke access rights for it with CACLS, then try to kill the beast again :)

Also I suggest StRun software to check startup list for malware. MSConfig doesn't show BHOs (Browser Helper Objects) and other ways malware usually employs to get called on reboot.

share|improve this answer
    
I clicked on show processes from all users when i was counting the ram usage which DID NOT ADD UP so i think it may be hiding itself? Do you mean WhatInStartup by StRun software? It shows only things i reconize. (which is just 11 objects) i'm going to try hijack this for BHOs –  acidzombie24 Nov 1 '11 at 23:45
    
Yes, I mean nirsoft.net/utils/what_run_in_startup.html –  Mikhail Kupchik Nov 2 '11 at 6:59

High quality viruses cannot be found by the user and will not show in the process list, so unless you know how the virus was written, you have no chance to remove the more stealthy infections. See my post here, use the Windows System Sweeper or Kaspersky boot CD to scan and remove the infection.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.