Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Someone I know has a slow Windows XP computer and they asked me to look at it. I found that the drive was constantly being accessed, and so would be any removable drive that was plugged in (making it nearly impossible to remove safely without shutting down the machine). When I used Process Explorer to find out what was causing this, I found one service scanning the removable drive (I forget which). I stopped the service, and a different service immediately seemed to pick up the scan. I did this a dozen times, as it rotated through both plausible and implausible services, the only seeming commonality being that they run as LocalSystem.

I installed and used AVG Free and MalwareBytes, which detected Trojan.FakeMS and Trojan.Dropper among others, but most of the files detected seem to be in no position to be run, and in any case fixing them did not fix the problem. Trend Micro's rootkit and botnet detectors also found nothing, but the scanning goes on. What is going on here? Is there some known malware that does this, but can't be detected by any of these scanners?

Oh, and I'm not sure if it's related, but Windows CardSpace (infocard.exe) keeps crashing.

share|improve this question
    
Safe Boot and nuke it all? –  Jeffrey Lin Jul 10 '13 at 0:43
    
I'd like to avoid this if possible, since they have a legit install of Office they no longer can find media for. (And it's Office 2000, so the correct install key can't be recovered even if I could find the right media.) –  James Deikun Jul 10 '13 at 0:45
    
Safe boot and then scan it? –  Jeffrey Lin Jul 10 '13 at 0:46
2  
Try scanning with Combofix –  Scandalist Jul 10 '13 at 0:46
    
Already ran a couple of the scans in Safe Mode -- unsure about AVG scan though so I'll try that too. –  James Deikun Jul 10 '13 at 0:47
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.