Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Every time i boot the PC, i am not able to surf the net as most of the sites do not open even when there is no problem with the internet connection. I searched for a solution online and found out that malwares are responsible for this. So I downloaded and installed MALWAREBYTES-anti malware and ran a scan which detected some malwares on my PC and deleted them. The problem was solved and my surfing returned to normal. But when I switched off the PC and rebooted it, the same problem occurred again. I ran the malware scan again and it detected a malware at the location 'C:\Users\Anto\AppData\Roaming\skype.dat'

Every time i reboot, and run MALWAREBYTES, it detects and deletes skype.dat but it keeps on returning.

After some time i found out that the malware regenerates itself after 10 minutes or so as 10 minutes (approx) after deleting the malware, my surfing problem returns again.

I manually tried to find 'skype.dat' in the location 'C:\Users\Anto\AppData\Roaming' but could never find it. QuickHeal never detected it. I tried to find some other online solutions and tried combofix and roguekiller but none worked.

Please help me resolve this problem.

Anto Oswin

share|improve this question
add comment

4 Answers

You may not like this answer, but basically, "you're toast" - or your computer is ;-). That machine has become unreliable and an infection source for others.

You think it's only that skype.dat malware but there's no saying what else has been installed.

  1. Backup your data
  2. Reformat the entire machine
  3. Re-install Windows and programs; among them an on-access virus scanner. MS Security Essentials at the minimum.
  4. Put back your data
  5. Run full virus and rootkit scans (or do this on your backup data disk before reinstalling the data).

Exclude from the data backup any PDF you don't need (nowadays the most common vector for infections through files), HTM(L) files you may have downloaded. Since you're running Win7, I assume your Office is modern enough to no longer be vulnerable to old-fashioned office macro viruses.

Finally, ask yourself how your computer got infected. Were you too gullible clicking on that spectacular link, are you downloading pirated software or software from unreliable sites, did you fall for messages like 'a codec needs to be installed' or 'your computer is infected and you need this antivirus', etcetera?

share|improve this answer
    
Reinstalling windows would be my final resort. If i don't reinstall windows but simply UPGRADE to windows 8, will it solve my problem? –  Anto Oswin Jul 30 '13 at 14:27
    
I wrote reinstall for a reason. No, in all likelyhood upgrading will not help, it won't remove installed malware. –  Jan Doggen Jul 30 '13 at 17:54
    
I read 'skype.dat' to be a simple and low risk malware. It won't corrupt system files it seems. It would just disrupt browsing sessions. Please suggest some way to delete it. Thanx in advance. –  Anto Oswin Aug 3 '13 at 5:06
add comment

Before you reformat, try running at least one of these:

  • TDSS Killer
  • rkill
  • Combofix
  • GMER
  • hijackthis

These are rootkit scanners and will look for anything malicious that runs in the background. The hardest to understand of those is hijackthis, so if you don't know how to use it then run the others. Be sure to disconnect from the internet when you run these.

Afterwards, try running MWB, then SuperAntiSpyware, and then Spybot Search & Destroy. Make sure you install and then update them, disconnect from the internet, and then run the scans (not simultaneously, of course). If you are still having trouble, then consider a reformat.

Source: I work in my university's tech support and this is our general workflow for most infested computers.

share|improve this answer
    
Thank you , will try them and let you know. –  Anto Oswin Jul 30 '13 at 14:25
    
I tried TDSS,Combofix and GMER but none worked. I tried Quick Heal AntiMalware which detected 3 malwares and deleted them. Now my browsing problem has almost gone (I still can't access some specific sites which i can access from my laptop). But Malwarebytes still detects the 'skype.dat' malware everytime. :-( –  Anto Oswin Aug 3 '13 at 5:04
add comment

You can use a simple trick if you still have a problem as soon as it deletes skype.dat create a directory with same name on the same path it will do the work

share|improve this answer
add comment

You could try using a antivirus rescue live cd's like those from Avira, Bitdefender....

Using these to boot ensures nothing from Windows gets loaded and grants full access to the Windows partitions . If it is a rootkit infection this approach has much change of succesfully removal because it has nowhere to hide.

Do note your IP settings before booting from a livecd, you will need to configure this to enable virus database updates.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.