I found AISe.bat and a related shortcut in AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup. Windows says I need permission from my own computer account to delete them, and changing the security settings has not helped. Malwarebytes and Windows Defender do not currently detect these files, although they previously detected other malware on the system. What is the safest way to remove the files and make sure the computer is clean?
2 Answers
If you believe the system is compromised, deleting one file may not be enough. The safest approach is to back up only personal documents, create a Windows installation USB from a known-clean computer, and perform a clean Windows installation. A factory reset may not be as reliable if the recovery environment itself is affected.
The permission message does not automatically mean a hacker owns the account. Windows can show your computer name and user account when ownership or permissions are misconfigured. Also, a file not appearing in WMIC is not evidence that it is malware—WMIC mainly lists installed software, not every file. Check the file's properties, location, creation time, and digital signature, and scan the system from an offline or bootable security environment before deciding what to remove.
I suspected an infection because security scans had detected other malware, so I want to verify the system rather than rely only on whether these two files appear in a scan.