Member Avatar for Buppy

Hi,

There suddenly appeared about 2996 exe files in my windows 7 startup folder. The names seemed random generated, like 0A1RT4.exe.exe or somethign like that. They could be easily removed from safe mode boot. What kind of virus is this?

Thanks

  • 3 Contributors
  • 2 Replies
  • 91 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Nimrod7676

Dani AI

Generated

The pattern described by — many randomly named EXE files dropped into Startup and removable in Safe Mode — is a common persistence/tamper tactic used by droppers or installers. Immediate priorities are to contain the machine, identify how the files are being recreated, and safely remove the persistence mechanism rather than only deleting visible copies.

Recommended quick workflow:

  1. Isolate the PC from the network (unplug/restrict) so it cannot download or call home.
  2. Do not execute any of the unknown EXEs. Collect one sample (copy it offline) and check its hash before deleting. Submit that sample to VirusTotal for a quick multi-engine check.
  3. Use Sysinternals Autoruns (download) to inspect all autostart locations (Logon, Scheduled Tasks, Services, Run/RunOnce keys). Uncheck suspicious entries and use the jump-to-location feature to remove files safely.
  4. Run up-to-date scanners (Malwarebytes, Microsoft Safety Scanner: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download) and an offline rescue disk if persistence remains. Scan for rootkits as well.
  5. Inspect Task Scheduler and the registry Run keys (HKLM/HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce) and Services for installers that recreate files. Check Prefetch and timestamps to see what ran. See running processes with Process Explorer (download).
  6. If files reappear after cleanup, plan for an image backup of data and a clean OS reinstall; persistent infections often require a full rebuild.

This expands on and ’s advice to scan the system. Preserve one sample and logs for analysis if professional help is needed.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

Good question. Have you run a virus scanner (or 3) on your system to determine what has infected you?

Member Avatar for Nimrod7676

Seems like a virus. scan your system using anti virus software.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.