Random .exe files - Virus?

[Jock]

My dad has reported some strange goings on on his computer.

Basically he said random .exe files have started apearing in folders they shouldnt have. Some of them look to me like they are legit like the company of heroes replay analyser therefore i reckon he must have installed that himself and not realised where he sent it to, though some of the other files look a bit suspect like the

_isdel.exe

When i look that up it seesm to suggest its a legit windows file though it should be elsewhere and if its out of place it could be a virus trying to replicate the file. Plus theres loads of setup files that he has no idea how they got there.

I done a scan with his his AV which is AVG free though it picked up nothing. Do you reckon hes got some kind of a virus and AVG just isnt picking it up. (i did update the definitions) Or do you reckon hes done something himself and just didnt realise it.

 

[Pulseammo]

I have no idea whether or not it is but you could always upload the file to http://www.virustotal.com/ and see what the results are? (it basically scans the file with numerous virus scanners)

 

[edscdk]

get combofix from bleeping computers, run that

then install the free version of malwarebyte from malwaregyte.org and do a scan

 

[Mattus]

There's nothing there which looks at all suspicious to me. Apart from the COHRA ones, all those files just look like installation files for some kind of program - perhaps the remains of an extracted archive or similar. _isdel.exe is a file used by the InstallShield installer, I think.

When viruses imitate genuine files, it's normally to conceal the virus. I can't see any virus drawing attention to itself by putting that many files in such an obvious location.

I'm almost certain that your dad's just downloaded some kind of game and extracted the installation files to that folder. Running ComboFix is way over the top without any evidence of actual virus activity on the machine. ComboFix is quite invasive.

 

[SiriusB]

Malwarebyte's is still worth a punt - just in case. But it really does look like he simply extracted something to that folder.

 

[Ev0]

As Mattus says, looks like he's extracted some setup files to that directory as all the exe files there are usually ones included in an installation package.

 

[bledd]

As Mattus says, looks like he's extracted some setup files to that directory as all the exe files there are usually ones included in an installation package.

This

Company of Heroes replay analyser

 

[Jock]

Thanks for the help guys, i'll pass the info on.

 

[Ev0]

And yup it's an installshield based installation that's been extracted.