Question

I have some malware infecting one of our machines at home. It first showed up as winulty.exe. After investigating, I am of the opinion that winulty.exe itself is an uninfected file but is being modified after it has loaded into memory. Turning on Data Execution Prevention for all processes and services has confirmed this to be true.

How do I track down the process responsible for this? I've used File Monitor from sysinternals.com to monitor winulty.exe and see this being accessed by the svchost.exe instance hosting most of the system services and also by dfrgntfs.exe. How do I know which service or which DLL has been infected?

Answer 1

The easiest way is to just run an antivirus scan; you can't really know how many files have been infected so deleting them yourself might be problematic. It should pick up and quarantine all the infected files.

You can find quite a few good free antivirus applications, such as Microsoft Security Essentials or avast!

Answer 2

An alternative to installing several antiviruses is online scan.

Some that I like are Trend Micro House Call, Kaspersky Labs Free Virus Scan and Panda. Please note that each takes some hours to complete and that they might require you to use Internet Explorer as your browser

Also some anti-adware software scans would be useful, such as ad-aware and spybot.

Answer 3

winulty is not detected up by ad-aware, spybot, AVG. The best way to get rid of it is with a Trojan detector, such as Trojan-Remover that lets you test-drive it for 30 days. I have encountered this virus this week and in October of last year, and my wife got one last week and I found another on her machine today.