Stupid Malware that won't go away >.>;

Welcome to Major Geeks!


Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click and choose Run as Administrator


You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

1. Rkill.exe
2. Rkill.com
3. Rkill.scr
4. Rkill.pif

Once you've gotten one of them to run then try to immediately run the following.



Now download and Run exeHelper from Raktor

• Please download exeHelper to your desktop.
• Double-click on exeHelper.com to run the fix.
• A black window should pop up, press any key to close once the fix is completed.
• A log file named log.txt will be created in the directory where you ran exeHelper.com
• Attach the log.txt file to your next message.

Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Now run this: Using Malwarebytes Anti-Malware


After doing the above, continue with the below.

Now please read ALL of this message including the notes before doing anything.

Please follow the instructions in the below link:

READ & RUN ME FIRST. Malware Removal Guide



and attach the requested logs when you finish these instructions.

• **** If something does not run, write down the info to explain to us later but keep on going. ****
• Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.

• After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
   
   • Starting your computer in Safe mode
2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:
   • Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
​

 

For some programs, you do need to run them from the locations specified. Like MGtools must be on your Desktop or in the root folder of your Windows boot drive. The same applies to other programs if we requested them to be run from a particular location.

Since you don't seem to be able to run anything based on the info you provided ( and I'm assuming you tried every program ) then you may be a candiate to have to build a special boot disk to run a scan while Windows is off line. Try making one of the below ( use another PC if necessary ) and run a scan with it. I would suggest trying Avira to start ( assuming you can boot from a CD - you may need to change to boot order in your BIOS to boot from CD before the hard disk )

Avira Rescue CD
AVG Rescue CD
BitDefender Rescue USB
F-Secure Rescue CD
Kaspersky Rescue Disk.
SystemRescueCD
Trinity Rescue CD
Secure2k BootCD - Malware/Rootkit Removal

 

Hmmm??? I had suggested Avira..... but let's continue with AVG.

Yes it is an antivirus program but you are not going to run it while WIndows is running ( not in safe mode and not in normal mode). You need to BOOT from the CD and it loads a special environment to run a scan and fix things from.

I changed the boot order to boot from disk, then the hard drive, but I'm not sure if I have it in the right order?

Boot priority order:
1. USB CDROM:
2. IDE HDD: Hitachi HTS542512K9SA00
3. IDE CD: HL-DT-ST DVDRAM GSA-T20N (Does this have to be #1?)
4: PCI BEV: MBA v9.4.5 Slot 0500
5: USB HDD:
6: USB FDC:
7: USB KEY:
8:

[/quote] Since your CD drive is # 3 and I assume this is where you will insert the AVG bootable CD then you need to make this the first boot device. Then boot your PC and run the AVG Recue CD selection. Then run scan. The instructions were available on the download site. See: http://www.avg.com/us-en/226386

 

You're welcome. Surf safely.