Hot answers tagged

19

I know you said that you tried deleting the shortname of the file and it didn't work for you, but it does work for some forms of this problem. It worked for me. So for the sake of completeness I am mentioning it here. Step by step: press windows key + r type cmd.exe, press enter cd \to\the\folder\containing\the\problem\file dir /x Note the short filename ...


14

I'm pretty sure I know what's going on, and it's Spybot that did it to you (sort of). Spybot put entries in your Hosts file, but removed the usual default localhost entry (or it is missing for some other reason). "007guard.com" happens to be alphabetically first, so it was inserted at the top of the list. When a process does a reverse lookup for the 127.0....


12

I think I've found the answer: this YouTube video says that on some computers, F8 brings up the "Select boot device" menu that I described above, and if that happens, to hit Esc then keep hitting F8 until the Advanced Boot Options screen appears. I'll give it a go. Update First attempt failed: it just booted normally. On second attempt, I tapped the F8 ...


10

Never trust removal tools to get rid of a virus, trust them to tell you have a virus, wipe the drive, re-install the OS, re-install your programs, and restore your data from backups. However if you would prefer to use a virus removal tool, try Comodo Cleaning Essentials, or Comodo Rescue Disc (which is a bootable version of Comodo Cleaning Essentials). It's ...


9

Try the DelinvFile tool. It worked for me perfectly when NOTHING worked before. BR, galmeida


9

4 Useful Tools To Detect And Remove A Potential Botnet If you get more enterprising, checkout the Darknet schemes A more focused blacklist method is given by OpenDNS too. If it is Conficker you want to check, start with this quick EyeChart test


7

Boot into a Linux live CD environment and delete it with NTFS-3G?


6

I would recommend three tools for determining if your system is part of a botnet. The sysinternals tool suite is a must have for this process. The three tools listed below are the ones you will use for this process. Process Explorer, TCPView Filemon The first step is to run TCPView to see if you are talking to any strange addresses across the web. You ...


5

It might be the case that another program (like your antivirus, CCleaner, or some other anti-malware app you've used) already deleted the files but left the Registry keys behind. It might also be the case that the malware relocated itself one or more times while trying to evade detection, or created decoy registry keys. I've had good luck with MalwareBytes; ...


5

Try these: Edit your browser settings manually Reset your browser settings to the default Check if any new software is now available which you didn't explicitly install Uninstall the offending software and repeat the above Look through running processes and kill any suspects (Please be very careful here. If you don't know what you're doing, call an expert.)...


4

Disable these under safe mode: R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll BHO: ALOT Toolbar - {5AA2BA46-9913-4dc7-9620-69AB0FA17AE7} - C:\Program Files\alot\bin\alot.dll (file missing) O3 - Toolbar: ALOT ...


4

Long story short, you cannot use a guest account for that, best solution is use a USB dvd drive, boot from a Kaspersky rescue disk to clean the PC of malware. Or remove the hard drive and connect it to another PC using a USB adapter, clean it that way.


4

You are correct to assume that no malware scan finds all malware... but there ARE sites that multi-test programs. http://dexpot.en.lo4d.com/virus-malware-tests has tested Dexpot May5 2014 (2 days ago as of this post) and found it is clean from 27 different tests.


4

Check DNS settings on the router, modem and other devices. Also consider a factory reset, rather than just a reboot - the reset will completely clear all settings. If you are using default (ISP-assigned) DNS servers, consider changing them to an alternative, such as Google's 8.8.8.8 - if you observe this behaviour stopping, consider checking with other ...


4

Per this document, Probably, provided you use the Reset option, and are not working with an instance that was upgraded from win8. That said, there may be types of malware that may not be addressable in this fashion, depending on your system configuration. This is particularly true if you have partitions other than a system partition. Reset will not affect ...


3

Can you locate the executable? If so, boot into a linux LiveCD and blast it off the face of your filesystem. It may well recreate itself, if it's got hidden agents hiding around, so grab a copy of Autoruns and check what's loading behind your back. edit: And have you checked your Hosts file? C:\WINDOWS\SYSTEM32\DRIVERS\ETC That's where Pre-DNS level ...


3

A noble but misguided endeavor. I used to keep up with the latest techniques for this, but that's not really best practice anymore. Once a system is infected with malware, you just can't trust it again. The right thing to do is back up what data you can, clean that data in a safe environment, and then rebuild the system from scratch (format the drive and ...


3

Ah ha!!! I did it!!! This was so annoying but after several hours... it dawned on me. Basically, you make a folder with the same name as the missing folder, then you drag the folder into the folder with the missing folder. Windows did not ask me to combine the folders, but after that, Windows knows where the folder is and you can delete it. I didn't try to ...


3

There was an in-depth discussion on the topping at Slashdot yesterday - How Can I Tell If My Computer Is Part of a Botnet?


3

More than likely, that site is little more than a turnkey affiliate site for StopZilla (the tool it recommends you download and install to remove the malware.) StopZilla is one of the more shady and untrustworthy of the non-rogue anti-malware applications out there. You'd be much better off with Malwarebytes Antimalware, SuperAntiSpyware, or just about ...


3

Yes. Here is a link to the patch/fix. Just download and run. Here is the manual method: Click Start, Run and type command Type the following commands one by one: cd\windows regedit If Registry Editor opens successfully, then navigate to the following key: HKEY_CLASSES_ROOT \ exefile \ shell \ open \ command Double-click the (...


3

I had the same problem with all of my browsers: IE, Firefox, and Chrome. Ads would rise up in the lower left and lower right hand corners of my browser window (box or cellphone shape) on random sites. I scanned my computer unsuccessfully with malwarebytes (free), microsoft malicious software removal tool (free), and mcafee (enterprise). nothing was ...


3

It sounds like you may still be infected by the rootkit! Your updated information and the diagnostics made by the other community members in the Comments tell me that "incongruous results = something amiss". I strongly suspect that you are getting these extremely "strange" results because whatever damage the rootkit dealt is still present -- either it is ...


3

Wondershare and now iSkysoft (I tried iSkysoft Video Editor) seem to exhibit some behaviors similar to malware in that a hidden piece of software is installed and set to run constantly in the background even after un-install. This is very "rude". In my efforts to clean up what it has done I have resorted to the following. Create a .REG file containing the ...


3

Did Malwarebytes Anti-Malware and Avast antivirus software not detect the malware you are reporting? Or did they detect it but were unable to remove it? If you have malware on your system, you should remove it first; that may eliminate the problem you are experiencing, especially since you are reporting the presence of the browser hijacker bettersearch.tk on ...


3

Put bad processes on ice: Download and run Process Explorer (from Microsoft) as Admin In the Options > VirusTotal.com menu enable Check VirusTotal.com and accept the license agreement A new column will appear titled VirusTotal with a number like 0/57. The first number indicates how many virus scanners think the process is infected. The second number ...


2

Isn't there a special character in the name of the directory? Like an "empty" character that looks like a space but is not a space? Have you tried a "Check Disk", as the directory entry for that directory or its parent might be corrupted?


2

With out deeply inspecting your computer with a wide range of tools I doubt you will be able to manually remove the malicious software entirely. If you miss even a piece of it, as @ChrisF mentioned, it will probably try and undo any of your attempts to remove it. And in the age where viruses will not only hide themselves in system files but will corrupt ...


2

I use Malwarebytes booted into safe mode Sometimes you need to rename the .exe file, if the malware is "smart" I also have a cd-r burnt with all these malware scanners, so its read only :) This way no matter what, the malware can't delete it (though it CAN block it from running if it detects the name, so rename the .exe files) If they re-infected you may ...


2

This worked for me : 1. press windows key + r 2. type cmd.exe, press enter 3. rd /s "\\?\D:\bad\folder\path " Notice the space at the end of "\\?\D:\bad\folder\path "



Only top voted, non community-wiki answers of a minimum length are eligible