Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Every time i boot the PC, i am not able to surf the net as most of the sites do not open even when there is no problem with the internet connection. I searched for a solution online and found out that malwares are responsible for this. So I downloaded and installed MALWAREBYTES-anti malware and ran a scan which detected some malwares on my PC and deleted them. The problem was solved and my surfing returned to normal. But when I switched off the PC and rebooted it, the same problem occurred again. I ran the malware scan again and it detected a malware at the location 'C:\Users\Anto\AppData\Roaming\skype.dat'

Every time i reboot, and run MALWAREBYTES, it detects and deletes skype.dat but it keeps on returning.

After some time i found out that the malware regenerates itself after 10 minutes or so as 10 minutes (approx) after deleting the malware, my surfing problem returns again.

I manually tried to find 'skype.dat' in the location 'C:\Users\Anto\AppData\Roaming' but could never find it. QuickHeal never detected it. I tried to find some other online solutions and tried combofix and roguekiller but none worked.

Please help me resolve this problem.

Anto Oswin

share|improve this question

5 Answers 5

You may not like this answer, but basically, "you're toast" - or your computer is ;-). That machine has become unreliable and an infection source for others.

You think it's only that skype.dat malware but there's no saying what else has been installed.

  1. Backup your data
  2. Reformat the entire machine
  3. Re-install Windows and programs; among them an on-access virus scanner. MS Security Essentials at the minimum.
  4. Put back your data
  5. Run full virus and rootkit scans (or do this on your backup data disk before reinstalling the data).

Exclude from the data backup any PDF you don't need (nowadays the most common vector for infections through files), HTM(L) files you may have downloaded. Since you're running Win7, I assume your Office is modern enough to no longer be vulnerable to old-fashioned office macro viruses.

Finally, ask yourself how your computer got infected. Were you too gullible clicking on that spectacular link, are you downloading pirated software or software from unreliable sites, did you fall for messages like 'a codec needs to be installed' or 'your computer is infected and you need this antivirus', etcetera?

share|improve this answer
    
Reinstalling windows would be my final resort. If i don't reinstall windows but simply UPGRADE to windows 8, will it solve my problem? –  Anto Oswin Jul 30 '13 at 14:27
    
I wrote reinstall for a reason. No, in all likelyhood upgrading will not help, it won't remove installed malware. –  Jan Doggen Jul 30 '13 at 17:54
    
I read 'skype.dat' to be a simple and low risk malware. It won't corrupt system files it seems. It would just disrupt browsing sessions. Please suggest some way to delete it. Thanx in advance. –  Anto Oswin Aug 3 '13 at 5:06

Before you reformat, try running at least one of these:

  • TDSS Killer
  • rkill
  • Combofix
  • GMER
  • hijackthis

These are rootkit scanners and will look for anything malicious that runs in the background. The hardest to understand of those is hijackthis, so if you don't know how to use it then run the others. Be sure to disconnect from the internet when you run these.

Afterwards, try running MWB, then SuperAntiSpyware, and then Spybot Search & Destroy. Make sure you install and then update them, disconnect from the internet, and then run the scans (not simultaneously, of course). If you are still having trouble, then consider a reformat.

Source: I work in my university's tech support and this is our general workflow for most infested computers.

share|improve this answer
    
Thank you , will try them and let you know. –  Anto Oswin Jul 30 '13 at 14:25
    
I tried TDSS,Combofix and GMER but none worked. I tried Quick Heal AntiMalware which detected 3 malwares and deleted them. Now my browsing problem has almost gone (I still can't access some specific sites which i can access from my laptop). But Malwarebytes still detects the 'skype.dat' malware everytime. :-( –  Anto Oswin Aug 3 '13 at 5:04

You can use a simple trick if you still have a problem as soon as it deletes skype.dat create a directory with same name on the same path it will do the work

share|improve this answer

You could try using a antivirus rescue live cd's like those from Avira, Bitdefender....

Using these to boot ensures nothing from Windows gets loaded and grants full access to the Windows partitions . If it is a rootkit infection this approach has much change of succesfully removal because it has nowhere to hide.

Do note your IP settings before booting from a livecd, you will need to configure this to enable virus database updates.

share|improve this answer

These instructions indicate how to get rid of Skype.dat automatically. The instructions need to be applied on the infected computer.

  1. Turn the infected computer on. If it is turned on, restart it.
  2. When BIOS screen disappears after the reboot, tap F8 key repeatedly. Advanced Options menu will show up. If Windows logo appears, reboot the PC and try pressing F8 again.
  3. When you access Advanced Options menu, use arrow keys to navigate and choose Safe Mode with Networking. Press Enter to access the mode.load-in-safe-mode with Networking
  4. Wait for Windows to load Safe Mode with Networking.
  5. Press and hold the Windows key and then press R key.
  6. If you have pressed both keys correctly, Windows Run Box will pop up.
  7. Type the following into the Open box:

explorer http://www.spyware-techie.com/removalrun-screen2

Note- that there has to be a single space gap in between iexplore and http. Click OK

  1. Internet Explorer will open and a download dialog bar will appear at the bottom of your screen.
  2. Click Run to begin the installation automatically once SpyHunter is downloaded.
  3. Click OK if your system asks whether you want to run SpyHunter software.
  4. Run SpyHunter and perform a full system scan.
  5. Once all the malicious infections are detected, click Fix Threats. SpyHunter will ask you to register the software.
  6. By registering SpyHunter you will also be able to protect your computer from other potential threats.
  7. Once you have registered the program, the malware will be removed. Reboot your PC to fully implement the malware removal procedure.
  8. Locate the below application

    Search protection

From Control Panel > Uninstall a program and remove it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.