A Microsoft Security Essentials virus scan just finished on one of our computers and it shows two potential threats in Internet Explorer's temporary internet files:

  1. Web page with Black Hole Exploit Kit
  2. Specially crafted PDF file (part of Black Hole Exploit Kit)

The two items were downloaded on the same date about a year ago, so I think it's safe to assume a user visited a malicious site (item #1) which downloaded the PDF (item #2). The user account is an unprivileged non-administrative account.

According to Microsoft, the PDF was meant to exploit a bug in an old version of Adobe Reader which had been fixed long before the PDF was downloaded. We keep our software up-to-date here, so it looks like this exploit failed. The virus scan didn't detect any other problems.

My main concern is that the malicious site tried to use several exploits and Security Essentials didn't detect all of them. Should I nuke from orbit just in case, or trust the antivirus and let it just delete the files?

  • Personally I won't use MS Security Essentials. I would rather go with Kaspersky or Norton. While it's true that they may be power consuming and slower down your PC, I have found that they really protect you (more) from threats than other AV. Of course, this is a personal opinion.
    – HamZa
    Commented Jun 20, 2013 at 22:12
  • 1
    Wait - nuke what from orbit? The user or their machine? The first seems pretty harsh.
    – UKMonkey
    Commented Jan 25, 2019 at 13:25

2 Answers 2


What you have there is evidence of an infection attempt, not a successful infection. It's not uncommon to have these types of files in the temp internet folder if they were not blocked by malware protection.

However, you do need more evidence that the machine is clean before you consider NOT nuking it from orbit. Scans from a LiveCD (or boot-time scan), or evidence that the attempt was blocked would be required.

If you are unsure, or cannot confirm that the infection did not occur, then you should re-image. You DO have a rapid re-imaging strategy, right??

My other concern is that these files were not seen until now, which raises more questions for which the answers are likely to be to reimage anyway.

On a side note about anti-virus: "trust, but confirm". My rule of thumb is that AV blocks 80% of possible threats. I confirm clean machines instead of trusting a 'dirt preventor'.

  • 2
    How do you confirm that a machine is clean, especially when you know that antivirus doesn't catch 20% of the infections?
    – Phil
    Commented Jun 19, 2013 at 20:28
  • +1 for general policy of requiring evidence to not nuke a given machine from orbit...
    – Michael
    Commented Jun 20, 2013 at 18:23

To be safe, I would run a boot-time scan with heuristics set to the max. Microsoft Security Essentials is a nice Anti-Virus but it runs a little light and I always couple it with something heavier at least once a month, such as Avast!. The boot-time scan will go through the hard drive with none of the drivers turned on, which is where some real mean viruses/trojans/worms tend to hide so the "in operating system" Anit-Virus programs won't scan them. This method of scanning has saved many machines in my time in IT. Going forward, I would highly recommend developing a solid and routine backup schedule. Like the old saying goes, save and save often. There are some nice third-party Backup solutions out there, such as Acronis, with which you can create and recover Images in just minutes. I hope this helps and good luck.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .