-1

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

I believe I have a virus and the virus scanning tools I tried so far haven't found any (I will continue to run them in the meantime). However, how do I manually find and remove a virus?

My first steps were to look at msconfig startup and services. I found nothing suspicious (all but one app (Launchy, which is a incredibly convenient tool) were signed. All my services are signed as well.

Why I believe i have a 'virus' is that randomly I will get a privileged prompt to run install 1 and immediately after I hit "No" it will prompt again for install 2. When I boot up I use 3GB of RAM. When I look at task manager and look at the memory size of the apps it adds up to 1.4GB of RAM. When I log out/in I am using the 1.3 or 1.4 GB of RAM as normal. I sometimes see my CPU usage being eaten by 'cmd'. I have no idea what process ran it.

How do I find and remove this virus manually? The symptoms above should give you some ideas of where to start when tracking and removing the virus.

Unless the virus hijacked a chrome update, I do not believe I hit "Yes" for a privileged prompt to get it onto my machine, but it doesn't make sense that it could run on startup if I have never done that.

Community
  • 1

2 Answers2

0

Look for it in process list in Windows Task Manager (enable "show processes from all users" option).

If process in Task Manager isn't killable (for example, a pair of virus processes taking care of each other), find the corresponding file on disk and revoke access rights for it with CACLS, then try to kill the beast again :)

Also I suggest StRun software to check startup list for malware. MSConfig doesn't show BHOs (Browser Helper Objects) and other ways malware usually employs to get called on reboot.

Mikhail Kupchik
  • 2,521
0

High quality viruses cannot be found by the user and will not show in the process list, so unless you know how the virus was written, you have no chance to remove the more stealthy infections. See my post here, use the Windows System Sweeper or Kaspersky boot CD to scan and remove the infection.

Community
  • 1
Moab
  • 58,769