Solved Check PC For Malicious Programs

Hi,
We just got our laptop back from repair. It was initially accessed remotely by the repair shop and it was found that a part needed replaced and the machine was collected and returned. There have been no changes to the OS and a clean install has not been performed by the repairers.
Other than doing a clean install of Windows 11, can anyone suggest how and where to check the machine for spyware etc? I have done a full AntiVirus scan which has returned no adverse results.
Would be grateful for any suggestions.
Mitch.

Mitch said:

Hi,
We just got our laptop back from repair. It was initially accessed remotely by the repair shop and it was found that a part needed replaced and the machine was collected and returned. There have been no changes to the OS and a clean install has not been performed by the repairers.
Other than doing a clean install of Windows 11, can anyone suggest how and where to check the machine for spyware etc? I have done a full AntiVirus scan which has returned no adverse results.
Would be grateful for any suggestions.
Mitch.

Click to expand...

1. If the computer just needed a part, then that's all they would do.

2. If you want a 2nd opinion of your scan for malware...

Thanks for your reply. Although a part was replaced, they also had to change some settings which got us thinking about the possibility of spyware etc. We will have a look at the 2 options you suggested. Thanks again.
Mitch.

Mitch said:

Thanks for your reply. Although a part was replaced, they also had to change some settings which got us thinking about the possibility of spyware etc. We will have a look at the 2 options you suggested. Thanks again.
Mitch.

Click to expand...

Well... yes, anyone that has access to your comp, could install malware.

But... you need to consider a few things. If they are a big company like Best Buy or something... they could get sued for that.
So it's a risk, that's probably not worth it, unless you're trading billions in stocks on a daily basis.

And even for a small, hole-in-the-wall company... unless you're a juicy target, why would they even think to install malware.

ESET and Malwarebytes, are good scanners, if they don't find anything... you're probably OK.


If you want to know for sure, there's always Bleeping Computer. They're not fast, but if they tell you you're clean... then you're clean.



I repeat... having them to a full check will take a while and will require assistance on your part.
But they are the best.

What I use is SUPERAnti-Spyware, SpyBot, and Windows Defender Full Boot scan

WAI said:

What I use is SUPERAnti-Spyware, SpyBot, and Windows Defender Full Boot scan

Click to expand...

Yep... Super Anti-Spyware is great also.

TDSSKiller was also great for rootkits and bootkits... but it's from Kaspersky, and they are sort of on the stay away list these days (politics ofc).

A word of caution, to many Adware & Virus protections can fight with each other & give you a "false Positive and hints of viruses ! It's ok to have more than one installed but NOT running !! Windows Defender is good & so is MalwareBytes !

Thanks for your thoughts. Our current AntiVirus plus one of the above should be enough to put our minds at rest. I was wondering if there is a manual way to check for obvious malicious programmes? Thanks.

I mean I liked nalwarebytes but after they changed I stopped using it

Mitch said:

Thanks for your thoughts. Our current AntiVirus plus one of the above should be enough to put our minds at rest. I was wondering if there is a manual way to check for obvious malicious programmes? Thanks.

Click to expand...

Look for strange and mysterious Processes in Task Manager.
Check out ones that seem to be using too much resources, like very high RAM or CPU percentages.
Generally... browsers use a lot of RAM... that's fairly normal.
If you see anything weird... Google it. Read a few of the results to get an idea, if you should worry about it or not.

You'll see a lot of "Service Host" processes. Those are normal.
Those are the Window's Services that happen to be running.

Will do. Thanks again for replying.
Mitch.

Mitch said:

Will do. Thanks again for replying.
Mitch.

Click to expand...

Good advice above by Ghot.

Can you share what part was replaced ?

Hi. The part was a faulty power connector inside the PC which caused the battery to charge intermittently. It was replaced to fix the problem and to prevent any shorting out of the motherboard.
Mitch

Ghot said:

TDSSKiller was also great for rootkits and bootkits... but it's from Kaspersky, and they are sort of on the stay away list these days (politics ofc).

Click to expand...

Will Defender off-line scan catch rootkits/bootkits?

I have a feeling based on the OP's questions that they will not be satisfied by scans and even manual poking around, for peace of mind I believe in this case a clean install is probably the best option, for them.
Obviously make backups of important documents, photos etc and maybe use an app like Macrium to image the existing system, just in case.

Haydon said:

Will Defender off-line scan catch rootkits/bootkits?

Click to expand...

I don't know. I don't use Defender.
Malwarebytes has either included a rootkit tool or has one on their site.

We're kind of busy-ish here at the moment...

We just got power back after an hour and a half with none.
We also got 1/2" plus snow in under an hour, with winds gusting to 40 mph...

Some free tools to check out from The PC Security Channel YT. Worth a look.

Suspicious network activity


Free security tools

Reading through this thread, there are several things of concern for me. First of all, we do not know what problems the OP had to start that provoked him to contact a repair shop as the OP did not give that information. The OP says "It was initially accessed remotely by the repair shop and it was found that a part needed replaced." I cannot see how the repair shop could have come to this conclusion remotely. Does the OP know he is dealing with a reliable and trustworthy repair shop? What repair shop did he use?

I would NEVER send my machine off for repair unless I knew something about who was getting access to it. Even if I was sending it back to the manufacturer, I would first make an image and then reset it back to default to remove my data. In fact, the manufacturer wants their customers to do this.

It has previously been suggested he backup his data and do a clean install. I agree with the clean install part, but I would not trust that his personal data had not been infected with erroneous code. The only data I would recover is that which I backed up myself BEFORE the laptop was shipped. Just my opinion.

I think that the OP's uneasy feelings is quite common among prudent everyday computer users, he did not even have to send in his computer for repair to have the uneasy feelings.

I just use my production machine in the Internet jungle, practice safe computing, and have nonetheless essentially the same uneasy feelings from time to time.

I know that some of us here do an annual clean install but I think that that's an overreaction to the situation, where's the balance

Haydon said:

OP's uneasy feelings......overreaction to the situation...where's the balance

Click to expand...

The balance is easing his uneasy feelings. If he has run the scanning tools that everyone has suggested and still has those feelings, then a clean install is all that can 100% ease him.