It takes a long time to load eight. What to think?

Question

System administration

In the office of a violent employee, the figure eight began to load for a long time.
He likes scandalous sites and all sorts of sects ..
Downloaded from a Kaspersky flash drive. Five viruses.
Doctor Web does not start from a flash drive.
How would you decide? Is it a screw or viruses?
Reluctance to put the least eight, and especially if it's a screw. The system manager is a couple of years old. But the ups was not always but electric welding in the neighboring building daily.
The desktop background is loaded and the rest of the shortcuts after 20 minutes and then from the fifth reboot.
Testing a screw from a flash drive with Linux?
And forward the eight. and there are documents for a dozen gigs ... But not very critical

Answer 1

Try also running adwcleaner from malwarebytes.com - it helps

Answer 2

The desktop background is loaded and the rest of the shortcuts after 20 minutes and then from the fifth reboot.

Well, it's not normal at all. We must take action. And the first is an archival copy of documents. Whether the virus encrypts them or the screw dies - you will be to blame anyway. At the screw for a start at least a smart look. If everything is bad there, then why check it further, you need to change it. If everything is fine, then you can certainly look for viruses. But I would think, would it not be faster to reinstall Windows?

Answer 3

How would you decide? Is it a screw or viruses?

(almost like Shakespeare's screw or not a screw? )..
- the test is always from an external medium (hereinafter we are talking about situations of a virus threat)
- not just from an external one, but from a cold boot (in this case, we are talking about a complete power off for several minutes. because there is a type of attack "cold reboot", we just need to completely de-energize the computer for 10-15 minutes)
- a test from a media from a trusted source. these next buzzwords mean that builds from trackers cannot be a trusted source. it is easy and reliable to use any Linux live image for testing hardware. A big plus of Linux is that for a Windows infection, it is usually an absolutely incomprehensible phenomenon. if you are not friends with Linux, take Mint. for the company we test memory, memtest86 at Mint in the boot menu. we don’t test with the disk (this is later, because most tests make sense for the file system), but first of all we look at SMART and if the wiki is small, we are looking for some other cheat sheet on which values ​​to look at and which ones not to bother too much, for example here https://www.ixbt.com/storage/hdd-smart-testing.shtml after which everything should be clear with the disk (well, or look for more articles on SMART)))
- if there is happinessthe main pieces of iron are working, we exhale, and move on to the answer of Ronald McDonald ( editor 's choice is my choice, because his answer was written earlier and IMHO the most accurate of those published, at the time of my answer)
upd fixed a bug with one of the important links. soryan