|
![](/i/fill.gif) |
scott wrote:
>> logged into the PC. This surely indicates that something has been
>> installed locally. And yet repeated AV scans detect nothing...
>
> You could just use one of those "spy" tools (forget which one now, but
> former SysInternals probably have something) to check which process owns
> the fake AV alert window. Then just see where it's running from, or
> google the name or whatever.
Obviously the first thing I did was run Process Explorer to see what
processes are running. I found nothing unusual. I hadn't thought of
using it to check which process owns the window though; it's not a
feature I usually have call to use. (I have a sneaking feeling the
answer would just be IEXPLORE.EXE, which seemed to be running directly
after login...)
Then again, I also crawled around in the registry and found nothing
unusual. But deleting the registry hive fixed the problem, so clearly
there *was* something interesting in there that I didn't see.
The problem is fixed now, so I can't investigate further. I did find it
rather alarming however that our AV system that we pay a lot of money
for could apparently find nothing wrong...
Post a reply to this message
|
![](/i/fill.gif) |