Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am currently backpacking in India for several months and have to use public PC to check my email and write my blog.

The first thing I do when after I plugged in my hard-drive is to use SysInternals' Autoruns.exe and procexp.exe to check for unusual software on the machine. In many cases just starting them kicks into a hard reboot without a blue screen.

I had this experience before and it is usually malware on the system that detects these programs and initiates the reboot.

However I had this problem on so many PCs now including some newly set up ones that I don't think malware is the problem.

This usually happens on Windows XP.

I tried this from different media to make sure there is no problem with the drive.

I am sure the copies of autoruns and process explorer and clean and I am in some cases 95% sure the PCs are clean too, but the reboot still happens.

Any ideas what could be the cause for this?

On my hard drive I have a boot-able Ubuntu Linux which I use whenever I can because I feel much safer using it. But I am not sure what tools to use there to check for malware on the Windows partition.

share|improve this question
    
Process explorer, doesn't it install a lower level driver item? I do not think autoruns does that. there are some very usefull utilities that look to be 100% portable, that on first run do a driver install. So they are not AS portable looking in reality. –  Psycogeek Mar 29 '12 at 5:36
1  
Process explorer is 100% portable, no low level drivers. It even runs from write-protected media, that is not the problem. –  Peter Hahndorf Apr 28 '12 at 22:16
    
forum.sysinternals.com/… Well the ones I have been running have not for 10 years now, runs as a "legasy driver" starting at "root", shows as a service. But back to the real problem. You could run a "total uninstal" tracing of XP, before and after you stuff run your flash disk on it, and see all the things that occur. –  Psycogeek Apr 29 '12 at 4:23

2 Answers 2

Judging from my whole experience with PCs in Internet Cafes in India, I would now say that the (pirated) Windows XP CDs that many shops are using have a built-in root kit.

I will be back in India soon and will try to get my hands on one of the CDs to analyze it further.

share|improve this answer

First stating

The first thing I do when after I plugged in my hard-drive is to use SysInternals' Autoruns.exe and procexp.exe to check for unusual software on the machine.

makes

I am sure the copies of autoruns and process explorer and clean and I am in some cases 95% sure the PCs are clean too, ...

a false assumption because the moment you attach the hard-drive it could become infected.


In many cases just starting them kicks into a hard reboot without a blue screen. I had this experience before and it is usually malware on the system that detects these programs and initiates the reboot.

Why would this have to be malware, it could just be software to prevent you from messing with these public computers. I could write something simple that probes whether you launch such processs and then kick off a reboot if you do, it's no rocket science. You are drawing too much assumptions.

You shouldn't be running these tools on public computers without permission anyway...

I would now say that the (pirated) Windows XP CDs that many shops are using have a built-in root kit.

There is no evidence that leads to it having a root kit nor to it being pirated, try WGA validation. ;)

share|improve this answer
1  
1. I do use USB devices with physical write protection, so no software can affect the my tools itself. I is still possible for the malware to attach itself to my tools as soon as they are running though. –  Peter Hahndorf Apr 29 '12 at 19:26
    
2. If I can not check whether a computer is infected or not, I can not use the computer because I have to assume that is is infected (just from experience). 3. The fact that Windows itself complaints that it is not genuine and WGA validation fails is evidence enough for me to say it is pirated software. –  Peter Hahndorf Apr 29 '12 at 19:32
    
3. I seen shop owner re-installing Windows XP from their CD-Rom and rebooting when a clean autoruns.exe starts. This makes me think there is something on that CD that was not in the original Microsoft CD. –  Peter Hahndorf Apr 29 '12 at 19:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.