- Use at your own risk: WhatTheTech forum's, does not take responsibility for any outcome of following these directions. Every computer is different, so we cannot guarantee the outcome.
- DO NOT use for Google (browser) Redirects!! See HERE
- Vista and Windows 7 users:
- These tools MUST be run from the executable. (.exe) every time you run them
- With Admin Rights (Right click, choose "Run as Administrator")
When you find that your computer is so bogged down with malware and nothing works, please look through this When Nut'n Works Tutorial and maybe one of the options will work.
1. The first thing we want to do is to download and run Malwarebytes' Anti-Malware (MBAM) which you probably can't do….that's why you're here.
Common Issues, Questions, and their Solutions for MBAM HERE and HERE
The malware is preventing you from downloading any programs, running any files such as .exe (executable) and even preventing you from using safe mode. We will attempt to terminate the malware that's running on your computer and restore some of the functions by using rkill or exehelper, they both do a good job at it, it's just a matter of finding out which one will run on your computer.
Please Note: The purpose of these tools is to stop certain processes and fix certain reg keys that stop you from using our normal clean up tools. They're NOT designed to remove infections in their entirety and not designed to fix all problems.
You can try running these in safe mode also if possible.
If needed you can download them to a usb flash drive and then transfer them to the sick computer.
There's 3 versions of exehelper and 5 versions of rkill.
When you find a version that does run, immediately download and run MBAM.
exeHelper.com exehelper.scr
explorer.exe<—-exehelper with a different file name
rkill.exe rkill.com rkill.scr
WiNlOgOn.exe uSeRiNiT.exe <—–these are rkill with different file names
If you can't connect to the internet, here's how to fix that:
- Open up Internet Explorer, and when the program is open, click on the Tools menu and then select Internet Options.
- Now click on the Connections
- Now click on the Lan Settings
- Under the Proxy Server section, please uncheck the checkbox labeled Use a proxy server for your LAN. Then press the OK button to close this screen. Then press the OK button to close the Internet Options screen.
- Now that you have disabled the proxy server you will be able to browse the web again with Internet Explorer.
VIPRE Rescue Program is a new anti-malware utility that runs from the command prompt that will scan for and remove most malware including rootkits. It will run when other programs won't.
Please note: Windows must load for this scanner to work.
It's easy to use:
1. Download VIPRE Rescue to your desktop (it's a big download about 80mb…..takes about 4-5 minutes on broadband and always download a fresh copy as it is updated frequently)
2. Double click on the VIPRE Rescue icon, it will ask if you want to extract VIPRE Rescue Scanner to your computer, click yes.
3. The "WinZip Self- Extractor" window will pop-up, click Unzip
It should by default unzip to C:
Make sure the checkbox for "When done unzipping open: .\deep_scan.bat" is checked
After the files are unzipped, click OK
4. VIPRE Rescue will now run automatically and perform a deep (full) scan.
5. When it's done, type exit and press enter to close the program.
6. The log isn't that good but will be in the VIPRERESCUE folder and listed as a CSV file.
7. Now see if you can run MBAM.
Note: If you find that you can't download any programs to the infected computer, you can download VIPRERescue to a usb flash drive on another computer.
Then plug the drive into the infected computer, navigate to the drive and double click on VIPRERescue****.exe and follow the directions above starting at #2.
It's easy to use, just download SAS Portable Scanner to the sick computer, double click on it and then run it.
If you can't download it on the sick computer, download it onto another computer and then put it on a usb pen drive or cd and run it from there.
Please note: Windows must load for this scanner to work and also the scanner is saved under a random filename so that malware infections won't block the scanner.
"AVG rescue CD is basically a portable version of AVG anti-virus, which runs on linux distribution as bootable CD or bootable USB flash drive. This Rescue CD is equipped with AVG Antivirus , AVG Anti Spyware and some administrator recovery tool.
You can scan and remove computer virus without booting operating system first. It is suitable for recovering MS Windows and Linux operating systems (FAT32 and NTFS file systems) from virus and spyware attack. Meanwhile, Administrator toolset on AVG rescue disk are Windows Registry editor, a TestDisk utility for data recovering and lost partitions, a file browser for navigating folders, and a Ping tool for basic network diagnostics."
Please Note: Windows does not have to load for this scanner to work.
AVG Rescue CD Guide-check here
You can download AVG rescue CD HERE.
It's also located on ThisPage, make sure you download the .iso file.
Here's how it goes:
Download and install Active@ ISO Burner
Click HERE for ISOBurner Instructions.
Install the program, and follow the next set of steps.
After you install Active@ ISO Burner, put a blank cd-r in your burner and double click on the AVG Rescue CD.iso you downloaded and Active@ ISO Burner should automatically open up…..now click BURN.
The program is very easy to use, you'll just be pressing Enter most of the time but here's how it goes:
1. After the rescue cd is made, boot-up the sick computer, put the rescue cd in and then restart it.
Note: In order to do so, the computer must be set to boot from the CD first. For information on how to do that….click HERE.
2. At the Boot Menu: Choose AVG Rescue CD (1) and press Enter
3. Let it load, at the Disclaimer Screen……just choose I agree or not and press Enter
4. At the Update Screen, choose Yes and press Enter
Next screen, Choose Update from Internet and press Enter
5. At the Update Priority Configuration window, choose Priority 2 Virus Database Update and press Enter6. Let it update and when finished, Press any key to continue
7. You end up back at the Update Screen, choose Return and press Enter
8. Your at the Main Menu screen, choose Scan, press Enter
9. Scan Type Menu, choose Volumes Scan - Selected Volumes and press Enter
10. Scan Volumes, choose OK and press Enter
11. Scan Options, choose OK and press Enter
12. Run Scan, choose Yes and press Enter
13. When scan is complete, Press any key to continue
14. Info screen, choose OK and press Enter
15. To see the scan report, select Report File and press Enter
Please look over the list as some files can be crucial for the Windows system and deleting them can make it inoperative, if in your not sure please Google the file or files.
16. Scan Results Menu, use the up and down keys and choose Select - Handle single or groups of infected files, press Enter
Go through the files and choose to Rename the infected file, don't choose Delete!
This is important….Rename<—
17. Read the Warning Screen, Yes and Enter
18. Back to Scan Results Menu, choose Back or Return to get to the Main Menu and then choose —->Reboot System
Don't forget to take out the rescue cd.
19. All the malware files will be renamed to _INFECTED.arl, to find all of these files….
Go to Start > Search > All Files and Folders > type _INFECTED.arl and click search.
Example: malware.exe would be renamed to malware.exe_infected.arl
20. Note: If you find the cd doesn't load, it's most likely do to a bad download or bad burn, download the file again and burn it at a slower speed.<++++++><++++++><++++++><++++++><++++++><++++++><++++++><++++++><++++++><++++++>
Good Luck and Thanks for using the forum…..MrC