Removing skype.dat malware permanently

Question

Every time i boot the PC, i am not able to surf the net as most of the sites do not open even when there is no problem with the internet connection. I searched for a solution online and found out that malwares are responsible for this. So I downloaded and installed MALWAREBYTES-anti malware and ran a scan which detected some malwares on my PC and deleted them. The problem was solved and my surfing returned to normal. But when I switched off the PC and rebooted it, the same problem occurred again. I ran the malware scan again and it detected a malware at the location 'C:\Users\Anto\AppData\Roaming\skype.dat'

Every time i reboot, and run MALWAREBYTES, it detects and deletes skype.dat but it keeps on returning.

After some time i found out that the malware regenerates itself after 10 minutes or so as 10 minutes (approx) after deleting the malware, my surfing problem returns again.

I manually tried to find 'skype.dat' in the location 'C:\Users\Anto\AppData\Roaming' but could never find it. QuickHeal never detected it. I tried to find some other online solutions and tried combofix and roguekiller but none worked.

Please help me resolve this problem.

Anto Oswin

Answer 1

You may not like this answer, but basically, "you're toast" - or your computer is ;-). That machine has become unreliable and an infection source for others.

You think it's only that skype.dat malware but there's no saying what else has been installed.

1. Backup your data
2. Reformat the entire machine
3. Re-install Windows and programs; among them an on-access virus scanner. MS Security Essentials at the minimum.
4. Put back your data
5. Run full virus and rootkit scans (or do this on your backup data disk before reinstalling the data).

Exclude from the data backup any PDF you don't need (nowadays the most common vector for infections through files), HTM(L) files you may have downloaded. Since you're running Win7, I assume your Office is modern enough to no longer be vulnerable to old-fashioned office macro viruses.

Finally, ask yourself how your computer got infected. Were you too gullible clicking on that spectacular link, are you downloading pirated software or software from unreliable sites, did you fall for messages like 'a codec needs to be installed' or 'your computer is infected and you need this antivirus', etcetera?

Answer 2

Before you reformat, try running at least one of these:

• TDSS Killer
• rkill
• Combofix
• GMER
• hijackthis

These are rootkit scanners and will look for anything malicious that runs in the background. The hardest to understand of those is hijackthis, so if you don't know how to use it then run the others. Be sure to disconnect from the internet when you run these.

Afterwards, try running MWB, then SuperAntiSpyware, and then Spybot Search & Destroy. Make sure you install and then update them, disconnect from the internet, and then run the scans (not simultaneously, of course). If you are still having trouble, then consider a reformat.

Source: I work in my university's tech support and this is our general workflow for most infested computers.

Answer 3

You can use a simple trick if you still have a problem as soon as it deletes skype.dat create a directory with same name on the same path it will do the work

Answer 4

You could try using a antivirus rescue live cd's like those from Avira, Bitdefender....

Using these to boot ensures nothing from Windows gets loaded and grants full access to the Windows partitions . If it is a rootkit infection this approach has much change of succesfully removal because it has nowhere to hide.

Do note your IP settings before booting from a livecd, you will need to configure this to enable virus database updates.