I found AISe.bat and a related shortcut in AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup. Windows Defender and Malwarebytes detected other malware, but neither tool specifically identifies these two files. When I try to delete them, Windows says I need permission from my own account on this computer. I temporarily changed their permissions, but I'm unsure whether that is safe or enough. What is the best way to remove them and make sure they are not launching malware?
2 Answers
A file not appearing in the installed-program list or in a malware scan does not prove that it is safe, and the permission message does not identify the hacker. Files in the Startup folder can run when you sign in, so inspect the shortcut’s target and the batch file’s contents only if you know what you are looking at. You can also use Windows Security’s offline scan, but if other malware was already detected, a clean reinstall is the safer option.
If you believe the system is compromised, don’t rely on simply deleting the files. Disconnect the computer from the internet, back up only personal documents, and perform a clean Windows reinstall from installation media created on a separate, trusted computer. A clean reinstall is more reliable than a factory reset if you suspect malware survived in the existing installation. Change important passwords from another safe device afterward.
Would a factory reset remove them, or should I specifically reinstall Windows from a USB drive?
I’m concerned because security software already found other malware, even though it did not flag these particular files.