This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.
Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.
Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.
Research
A lot of information can be found at this EliteKiller link, including...
Step 3 unzip the Kit, read the instruction file and run the tools in the order given.
Step 4 Thank me in about 3 hours for fixing your shit.
The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.
Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.
Taken from the readme in the Rogue Removal Kit:
Quality Online Virus Scanners: (all scanners offer detection and removal)
My two cents on downloading anti-malware software...
Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.
Other Helpful Tips & Tools
Rkill will kill processes that may be preventing scanners from completely removing malware.
To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.
Still infected, or just want to make sure everything is okay?
HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.
If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.
You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.
Windows Performance
A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.
To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.
Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore. [Reply]
Originally Posted by ROYC75:
My file extensions are trying to be sent as a Pepper Zip now ? I have scanned the pc, found the uninstall icon, done that but there is still an intact file attachment somewhere. I can not compress a file to email out to a client.
Anybody have any info on a pepper zip ?
Follow these instructions, and it should take care of it:
I had already did this first, used the Hitman then followed it up with Malwarebytes, of which it is scanning a 2nd time now after rebooting.
Any file I try to send out as a zip is a pepper file attachment, of which is not going through. I can't find a damn thing that is still linked up to holding it up.
I even went in and tried to restore the previous file I want to send, but it is coming back as a pepper file, no matter how far I go back.
Again, I am still awaiting for Malwarebytes & Hitman Pro to scan a 2nd time. [Reply]
Originally Posted by ROYC75:
I had already did this first, used the Hitman then followed it up with Malwarebytes, of which it is scanning a 2nd time now after rebooting.
Any file I try to send out as a zip is a pepper file attachment, of which is not going through. I can't find a damn thing that is still linked up to holding it up.
I even went in and tried to restore the previous file I want to send, but it is coming back as a pepper file, no matter how far I go back.
Again, I am still awaiting for Malwarebytes & Hitman Pro to scan a 2nd time.
When you say "Any file I try to sent out", what are you talking about? What program are you using for that? [Reply]
Originally Posted by Fish:
When you say "Any file I try to sent out", what are you talking about? What program are you using for that?
Just documents in a pdf that I send out to new carriers for a set up process. I had it in a zip folder and everything worked great for 14 years. Now the damn folder is a pepper file zip and I have no clue as to why and when we tried to clean it up it leaves a folder with a padlock on it that that has the impression of a busted file.
I can delete it, copy a new file, zip it and it goes to another pepper file, that looks the same. I can not go back to a previous version of that file to change anything.
I can't find anything that is listed to do with pepper except that pdf file that I make when I zip it. I'm thinking it came along with the chrome that was downloaded one day while I was away. [Reply]
That file might be hosed then. The padlock means you don't have permission to it. Don't you have a backup copy of that?
You can try and change the permissions on the file, but there's a likelihood that it's infected and you surely don't want to risk sending a potentially infected file to your carriers. [Reply]
If these forms have info on the carriers like EINs or drivers license numbers you sure should be taking this seriously to back your stuff up and reinstall Windows. [Reply]
Originally Posted by Fish:
That file might be hosed then. The padlock means you don't have permission to it. Don't you have a backup copy of that?
You can try and change the permissions on the file, but there's a likelihood that it's infected and you surely don't want to risk sending a potentially infected file to your carriers.
File is not damaged, when I click to compress it, it goes to a Pepper Zip file. I have never heard of it, Pepper Zip ? I can open it up, do anything I want except compress it to send out.
I downloaded a free trial on winzip, I can send it that way, but I don't want to buy winzip and it's a pain in the ass anymore to use.
Originally Posted by DaveNull:
If these forms have info on the carriers like EINs or drivers license numbers you sure should be taking this seriously to back your stuff up and reinstall Windows.
Nothing personal, just basic company information that needs to be exchanged before a contract is written in place. [Reply]
I just logged on Google Chrome on my computer a minute ago and a little pop up told me something along the lines of "Your internet connection is being controlled" and some other jazz. It prompted me to go into the settings and return them to normal. When I clicked on the settings to 'learn more' it says that I have to delete the extension and then restore my settings.
Problem is, I don't remember downloading any extensions and don't know exactly how to find it because I wouldn't even know what belongs and what doesn't.
So I ask you guys: for one, is this some kind of thing that's trying to get me to adjust my settings or do I actually need to find and delete this "extension"? And if so, how would I go about finding it?
I have Microsoft Security Essentials, for the record. The last time I had my computer on it said it had located and quarantined some malware. I then deleted it.. [Reply]
Hmmm. Well, looks like I had two extensions on Chrome. I just deleted them both and now I'll run a virus check... I really wish I was more computer literate but hopefully I don't have any issues from this point forward.. [Reply]
Originally Posted by ThaVirus:
Hmmm. Well, looks like I had two extensions on Chrome. I just deleted them both and now I'll run a virus check... I really wish I was more computer literate but hopefully I don't have any issues from this point forward..
Have you ran malwarebytes to check for anything else? [Reply]
I have an issue with my iPhone lately my battery has been running down all the time I think a program must be on but I think they are all off but not sure.
Just got xfinity a few weeks ago, supposed to be 25 Mbps.
Regularly getting <5 down and as much as 8 up. Have to reset the router 2-3 times/day. After I reset it get up to 30 down. Anyone else have these problems know a fix? A tech is supposed to come out later this week, but the dude on the phone basically said resetting the router is the only way. [Reply]