One of the computers that I manage (in the family, not business) has a weird set of files in its boot:
bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ls.exe, grep.exe and so on.
I know for a fact that no family member has installed anything unusual like
cygwin on this computer -- it's a plain consumer pc with Win7 + Skype + Firefox. That's why these entries worry me. As far as I can tell, this computer looks compromised.
- I've checked the list of installed programs (in the Control Panel) and there's nothing unusual there. The machine is practically a "laptop for grandma" so I'm absolutely certain that no user installed anything special. If anything, this comes from "outside" somehow.
- I installed McAfee and did a full scan -- nothing came up.
- I've yet to try tools like CCleaner but perhaps that will reveal something.
How can I confirm whether this computer is compromised, and how can I clean it?
If it's not a botnet, what is it then?
I know a complete reinstall would be best, and I am preparing to do so. But I want to take this situation as a learning opportunity.