How do i manually find/remove a virus?

Question

I believe i have a virus and the virus scanning tools i tried so far hasnt found any (i will continue to run them in the meantime). However, how do i manually find/remove a virus?

My first steps were to look at msconfig startup and services, i found nothing suspicious (all but one app (launchy which is a incredibly convenient tool) were signed. All my services are signed as well.

Why i believe i have a 'virus' is randomly i will get a privileged prompted to run install 1 and immediately after i hit no it will prompt again for install 2. When i boot up i use 3gb of ram, when i look at task manager and look at the memory size of the apps it adds up to 1.4gb of ram. When i logout/in i am using the 1.3/4gb as normal. I sometimes see my CPU usage being eaten by 'cmd'. I have no idea what process ran it.

How do i find/remove this virus manually? The symptom above should give you some ideas of where to start when tracking/removing the virus.

PS: Unless the virus hijacked a chrome update i do not believe i hit yes for a privileged prompt to get it onto my machine. But... it doesnt make sense that it could run on startup if i have never done that.

Answer 1

Look for it in process list in Windows Task Manager (enable "show processes from all users" option).

If process in Task Manager isn't killable (for example, a pair of virus processes taking care of each other), find the corresponding file on disk and revoke access rights for it with CACLS, then try to kill the beast again :)

Also I suggest StRun software to check startup list for malware. MSConfig doesn't show BHOs (Browser Helper Objects) and other ways malware usually employs to get called on reboot.

Answer 2

High quality viruses cannot be found by the user and will not show in the process list, so unless you know how the virus was written, you have no chance to remove the more stealthy infections. See my post here, use the Windows System Sweeper or Kaspersky boot CD to scan and remove the infection.