Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm running Windows 7 Ultimate 64-bit.

I found a file in c:/Users/name/AppData/Local called shanjou.dll

I noticed it when I ran msconfig and had a look through why my startup was taking a long time and this is where I noticed an entry for RunDll32 being executed against shanjou.dll

I ran a few searches on the name but nothing came up. MS Security Essentials doesn't detect anything wrong with it. What should I do next? I have already moved it out of it's location into my own self-made quarantine folder.

share|improve this question
1  
I made an edit to the title. Feel free to roll back. –  Dave Rook Jan 17 '13 at 12:54
1  
You could try to do a start-up virusscan (Avast is capable of this) so the OS doesn't have the file in lockdown. Otherwise, try Combofix which is a more agressive scanner. –  Matthias Jan 17 '13 at 12:55
    
I've already removed it from the boot sequence, I'm just wondering about what else I can do if it's not recognized as a virus. There's every chance it's harmless, but then why would someone copy it to an inconspicuous place like the /AppData/Local folder and add it to the startup programs running with RunDll32. It stinks of virus. –  warsong Jan 17 '13 at 13:06
    
The accepted answer to this question might be worth your time: superuser.com/questions/100360/… –  Joel Coehoorn Jan 17 '13 at 15:32
add comment

3 Answers 3

up vote 5 down vote accepted

Try to upload it to virustotal.com . It will get scanned by 44 different antivirus products. Normally some of the scanners should find it...

share|improve this answer
    
That worked. It's a backdoor trojan. I'm kind of worried now about what else MSE has missed. I thought it was reliable up until today. –  warsong Jan 17 '13 at 13:15
3  
MSE is quite reliable. You won't find any antivirus thing which does not have false positives and misses some real viruses. (I would not trust for example every positive from ClamAV, it detects too much) –  Offler Jan 17 '13 at 13:23
    
Well, it missed it today. One miss is enough to lose my trust. –  warsong Jan 17 '13 at 13:25
1  
@warsong - Which is the reason using a single product is never a good idea. There are lots of ways to expand your security lots of resources you should read also. –  Ramhound Jan 17 '13 at 15:16
1  
@warsong I think you misunderstand how anti-virus software works. It is your last line of defense, not your first. It's much more important that you keep your machine fully patched, that you don't run as an administrator by default, and that you use common sense when browsing. There will always be a gap between when a virus is released and when AV products are able to detect it. –  Joel Coehoorn Jan 17 '13 at 15:22
show 2 more comments

This is an interesting question.

You can't really install another AV program as they often conflict with each other, may be having to uninstall one for another isn't a desirable option.

There are online tools, McAfee used to also let you download a program like Stinger which I've had some success with when sharing this with other AV programs. The question arises of why you should have to, especially if you had paid for an AV.

You also need to be careful of false positives.

share|improve this answer
    
Malwarebytes is a good supplement to a standard AV program. –  Bigbio2002 Jan 17 '13 at 14:21
    
Professional pay because the free tools aren't licensed for corporate environments where the professionals work. –  Joel Coehoorn Jan 17 '13 at 15:23
    
@joel that is not quite right. there are some tools like comodo which have the statement that they can be used in prof. environments. –  Offler Jan 17 '13 at 16:24
add comment

That could be anything to do with anything, but its good to check it out to be on the safe side. You can upload files you think are suspicious to Kaspersky via this how to guide http://www.ehow.com/how_8528328_submit-files-kaspersky-lab.html

share|improve this answer
    
It looks like the link in that article is outdated, it doesn't have whatever it's describing, but I'll look for something similar. –  warsong Jan 17 '13 at 13:09
1  
Oh sorry, it looks like they have changed their procedure since I last had to do this. You can try the free virus scan utility labeled 'Kaspersky Security Scan' here kaspersky.com/virus-scanner or ESET's version here eset.com/us/online-scanner You really need a better piece of AV software running than MSE. It's not robust at all. Programs like Kaspersky has a heuristics scanner that can detect infections that have never been identified before and is far more proactive. –  Simkill Jan 17 '13 at 13:32
    
Already running ESET;s online scanner to see what else MSE missed. –  warsong Jan 17 '13 at 13:41
    
@Simkill - I have lots of malicious files that MSE would detect that ESET didn't. MSE is pleanty robust has one of the best engines on the market. –  Ramhound Jan 17 '13 at 15:15
    
@Ramhound MSE is almost completely geared towards anti-malware with a poorly crafted anti-virus element. It's not a good all round solution as its OK with anti-malware but viruses slip in all the time. ESET isn't designed to fight malware, so MSE is always going to pick up on those infections better than ESET as they are more common, but less dangerous. You're better off running Malwarebytes alongside Kaspersky as they won't interfere with each other and will both do what they are designed for very well. –  Simkill Jan 18 '13 at 12:07
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.