Remove File Recovery virus (Uninstall Guide)

Share your experience or ask a question about this article.

1. R
   Rasmus14 years ago

   Thank you so muth!! Works perfect!! :) You rock!
   Before I saw your instructions I was going to reset my whole system. When I was in safe mode I put over some files I didn’t wana lose to an external disk. The files I put over was just some word documents, movie and images. Is it possibly that may external hard disk now is infected (and will infect my computer the plugging it) or should it be safe because I was in safe mode when doing it?

   Helpful ReplyReport
   1. S
      Stelian PiliciTeam14 years ago

      In reply to Rasmus

      As long as you saved just some images and movies than you are ok!
      I suggest that you perform another check…mostly for your peace of mind:
      1.Run a scan with Kaspersky Virus Removal Tool
      Click here to download the Kaspersky Virus Removal Tool.

      1. Save it to your desktop.
      2. Double click the setup file to run it.
      3. Follow the onscreen prompts until it is installed
      4. Click the Options button (the ‘Gear’ icon), then make sure only the following are ticked:
         • System Memory
         • Hidden startup objects
         • Disk boot sectors
         • Local Disk (C:)
         • Also any other drives (Removable that you may have)
      5. Then click on Actions on the left hand side
      6. Click Select Action, then make sure both Disinfect and Delete if disinfection fails are ticked
      7. Click on Automatic Scan
      8. Now click the Start Scanning button, to run the scan
      9. After the scan is complete, click the reports button (‘Paper icon’, next to the ‘cog’ icon) on the right hand side
      10. Click Detected threats on the left
      11. Now click the Save button, and save it as kaslog.txt to your Desktop
      12. Please copy and paste the contents of kaslog.txt in your next reply.

      ---

      2.Run a scan with Eset Online Scanner.

      1. Download ESET Online Scanner utility.
         ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
      2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
      3. Check Yes, I accept the Terms of Use
      4. Click the Start button.
      5. Check Scan archives
      6. Push the Start button.
      7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      8. When the scan completes, push Finish

      ---

      Helpful ReplyReport
      1. T
         tom14 years ago

         In reply to Stelian Pilici

         using the registration number *brilliant* what are they going to do sue me for that lol ……thanks

         Helpful Report
2. T
   Thy Le14 years ago

   Hi! I’ve fixed all the problems. Got all the icons on desktop back. However, when I click on any of the folders, there are some folders inside showing no size. And when I click on those folders, all of my photos, documents, and music are gone. In other word, those folders are now empty. I’ve tried the unhide.exe but still did not get them back. Please reply this as soon as possible. (would be great if you email me the answer: tle9794@gmail.com or, the email above). Thank you so much for your time. I wish you all the best things.

   Helpful ReplyReport
   1. S
      Stelian PiliciTeam14 years ago

      In reply to Thy Le

      Hello Thy Le,
      Did you use any clean-up tool while your computer was infected with this rogue program?
      Can you please follow the steps from this post: http://malwaretips.com/Thread-Files-still-hidden-after-smart-hdd-removal-and-unhide-exe?pid=58410#pid58410

      Helpful ReplyReport
3. P
   Patrick14 years ago

   Everything worked well. I appreciate the time and effort put into this.

   Patrick

   Helpful ReplyReport
   1. J
      Josh14 years ago

      In reply to Patrick

      I believe the virus has made my internet explorer inaccessible. I have no icon in normal or safe mode and cannot find in all programs either. Is this typical? Any suggestions?

      Helpful ReplyReport
      1. S
         Stelian PiliciTeam14 years ago

         In reply to Josh

         Hello Josh,
         Lets try another way around this
         While in Normal Mode,please try to download and run Malwarebytes Chameleon:

         1. Hold down the WINDOWS key and press the R key

         ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

         iexplore.exe http://downloads.malwarebytes.org/file/chameleon

         2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
         3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
         4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
         5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
         6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
         7. Upon completion of the scan, if anything has been detected, click on Show Result
         8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
         9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

         ---

         2.Please perform a scan with HitmanPro,RogueKiller and Unhide.exe as seen on the guide.

         ---

         3.Run a scan with ESET Online Scanner:

         1. Download ESET Online Scanner utility.
            ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
         2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
         3. Check Yes, I accept the Terms of Use
         4. Click the Start button.
         5. Check Scan archives
         6. Push the Start button.
         7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
         8. When the scan completes, push Finish

         If it still doesn’t want to work, please try the above steps while in Safe Mode with Networking.
         Waiting for your reply to see how everything is running…. Good luck!

         Helpful Report
4. M
   Melissa14 years ago

   most well written guide on the Internet!!

   Helpful ReplyReport
   1. B
      Brad14 years ago

      In reply to Melissa

      I cant get the first step done, when I enter safe my firefox says already running and wont run and my internet explorer has completely disappeared. Also i tried the activation code twice with no luck.

      Helpful ReplyReport
      1. S
         Stelian PiliciTeam14 years ago

         In reply to Brad

         Hello,
         Lets try another way around this
         While in Normal Mode,please try to download and run Malwarebytes Chameleon:

         1. Hold down the WINDOWS key and press the R key

         ,this should brind up the Run box…. In it, please type the below content to download Malwarebytes Chameleon.

         iexplore.exe http://downloads.malwarebytes.org/file/chameleon

         2. Make certain that your PC is connected to the internet and then open the folder where you extracted Chameleon to and double-click on the Chameleon help file and then follow the onscreen instructions to use it.
         3. If the Chameleon help file itself will not open, then double-click each file one by one until you find one that works, which will be indicated by a black DOS/command prompt window Note: Do not attempt to open mbam-killer as that is not a Chameleon executable and serves a different purpose)
         4. Follow the onscreen instructions to press a key to continue and Chameleon will proceed to download and install Malwarebytes Anti-Malware for you
         5. Once it has done this, it will attempt to update Malwarebytes Anti-Malware, click OK when it says that the database was updated successful
         6. Next, Malwarebytes Anti-Malware will automatically open and perform a Quick scan
         7. Upon completion of the scan, if anything has been detected, click on Show Result
         8. Have Malwarebytes Anti-Malware remove any threats that are detected and click Yes if prompted to reboot your computer to allow the removal process to complete
         9. After your computer restarts, open Malwarebytes Anti-Malware and perform a Full System scan to verify that there are no remaining threats

         ---

         2.Please perform a scan with HitmanPro,RogueKiller and Unhide.exe as seen on the guide.

         ---

         3.Run a scan with ESET Online Scanner:

         1. Download ESET Online Scanner utility.
            ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
         2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
         3. Check Yes, I accept the Terms of Use
         4. Click the Start button.
         5. Check Scan archives
         6. Push the Start button.
         7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
         8. When the scan completes, push Finish

         If it still doesn’t want to work, please try the above steps while in Safe Mode with Networking.
         Waiting for your reply to see how everything is running…. Good luck!

         Helpful Report
5. J
   James14 years ago

   You absolutely ROCK!!!!!!!! This worked perfectly. Thanks for being so helpful and sharing this info.

   Helpful ReplyReport
6. T
   Thy Le14 years ago

   You are so awesome!!!!! I’ve spent a whole night of last night until 4 AM trying to fix this by a different way from another website. However, my laptop got frozen on the startup screen and the safe mode didnt work either this morning. Wish I was about to find this earlier. Thank you so much. I think there is still some missing files on the desktop like some word files, picture, and music. But that’s totally fine. Thank you for being so specific. Thank you and thank you

   Helpful ReplyReport
7. E
   eperson14 years ago

   Thanks for this guide, I am impressed with the detail.

   I have a machine with this infection. I have daily image backups of this machine going back two weeks. If I restore an image, what’s the best way to determine if it’s clean?

   Thanks in advance.

   Helpful ReplyReport
   1. S
      Stelian PiliciTeam14 years ago

      In reply to eperson

      Hello eperson,
      Run a scan with Malwarebytes,HitmanPro and ESET Online Scanner.. if they all came up clean then you’re good to go…
      +1 for doing Image back-ups!:)
      Stay safe!

      Helpful ReplyReport
8. E
   Erin14 years ago

   Thank you, thank you, thank you! This made it so easy to get my computer up and running again. You are the best!

   Helpful ReplyReport
9. C
   caleb14 years ago

   Hi, thank you for providing these instructions for removing the file recovery virus,
   I am however having trouble running the Rkill programme even with it being renamed.
   It comes up with:
   Checking for Windows services to stop.
   * No malware services found to stop.
   Checking for processes to terminate.
   * No malware processes found to kill.
   Checking Registry for malware related settings.
   * No issues found in the Registry.
   Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
   Performing miscellaneous checks.

   Is this normal? as it says it hasn’t found any malware processes to kill etc. and I am certain I have this virus. Will this stop the other stages… malwarebytes onwards from working?

   Thank you in advance.

   Helpful ReplyReport
   1. S
      Stelian PiliciTeam14 years ago

      In reply to caleb

      Hello Caleb,
      Go ahead with the Malwarebytes scan… don’t worry about RKILL… If you will have any problems please reply back.

      Helpful ReplyReport
10. S
    Simple14 years ago

    It’s so nice when people like you take the time to give clear, detailed, accurate and intensive directions on how to remove something as disgusting as this malware! Thank you so much!!!!

    Helpful ReplyReport
11. J
    Jack14 years ago

    Hi, Thanks a lot for this great guide! After finishing all the steps, most of my computer settings were restored. However, on my desktop there’s was a shortcut called File_Recovery. I try to right click it and it just freezes on the mouse “loading” image. I searched it on the start menu and there’s an option called “Uninstall File Recovery”. What should I do? I’m scared to click on any of the files.

    Thanks for all the help!

    Helpful ReplyReport
    1. S
       Stelian PiliciTeam14 years ago

       In reply to Jack

       Hello Jack,
       Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

       STEP 1 : Run a scan with Combofix

       Download ComboFix from one of the following locations:

       COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
       COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

       VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

       • Close any open browsers.
       • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
       • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
       • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
       • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

       1. Double click on ComboFix.exe & follow the prompts.
       2. Accept the disclaimer and allow to update if it asks
       3. When finished, it shall produce a log for you.

       Notes:

       1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
       2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
       3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

       ---

       STEP 2: Run a scan with ESET Online Scanner:

       1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
       2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
       3. Check Yes, I accept the Terms of Use
       4. Click the Start button.
       5. Check Scan archives
       6. Push the Start button.
       7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
       8. When the scan completes, push Finish

       Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

       Helpful ReplyReport
12. B
    Brandon14 years ago

    After doing this several times and in different orders I finally got close to being back to normal, but my internet explorer does not work. It works in safe mode, but not normal mode. I tried updating to IE9 while in safe mode, but didn’t help in normal mode. I installed Chrome in Safe mode and that does not work in normal mode, but works in safe mode. When I click on IE in normal mode an application error pops up saying “The application was unable to start correctly (0xc0000005). Click OK to close the application.” Thanks for all your help so far.

    Helpful ReplyReport
    1. S
       Stelian PiliciTeam14 years ago

       In reply to Brandon

       Hello john,
       Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

       STEP 1 : Run a scan with Combofix

       Download ComboFix from one of the following locations:

       COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
       COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

       VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

       • Close any open browsers.
       • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
         ———————————————————–
         • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
         • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
           ———————————————————–
         • Close any open browsers.
         • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
         • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
         • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

         ———————————————————–

        

       1. Double click on ComboFix.exe & follow the prompts.
       2. Accept the disclaimer and allow to update if it asks
       3. When finished, it shall produce a log for you.

       Notes:

       1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
       2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
       3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

       ---

       STEP 2: Run a scan with ESET Online Scanner:

       1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
       2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
       3. Check Yes, I accept the Terms of Use
       4. Click the Start button.
       5. Check Scan archives
       6. Push the Start button.
       7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
       8. When the scan completes, push Finish

       Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

       Helpful ReplyReport
       1. B
          Brandon14 years ago

          In reply to Stelian Pilici

          when I run hitman pro there are always two items that need to be replaced:

          master boot record(sector 0)
          c:smbr
          bootkit

          and

          volume boot record(sector 488368128)
          c:svbr_488368128
          rootkit

          Helpful Report
          1. S
             Stelian PiliciTeam14 years ago

             In reply to Brandon

             Hello Brandon,
             You are infected with a very nasty bootkit.
             We will need to run Kaspersky TDSSKiller (follow this instructions – http://malwaretips.com/Thread-Live-security-platnium-virus?pid=69292#pid69292)
             Can you please run the RogueKiller scan and see if this will fix it….
             Waiting for you reply.

             Helpful Report
13. L
    Los Angeles Educated G14 years ago

    Thank you very much Stelian! Wonderful instructions, easy to understand and follow. I was able to follow all your steps easily enough but I encountered a problem after using RKILL. I could not stop it from rebooting for some reason so I just ended up installing Malwarebytes after it rebooted and it seems to have worked fine without a hitch. My computer is back to normal albeit some programs like by printer control server is not working and needs a re install. If anyone has a step they are having trouble with you can always adjust the steps like I did. It’s probably better to follow it to the T but sometimes its not always exactly like the author’s instructions. Follow these instructions! They aren’t trying to sell you anything, ok maybe the full versions of the programs , they are just sincerely trying to help! There are still good people out there and I thank you again for that! A+

    Helpful ReplyReport
    1. B
       Brian14 years ago

       In reply to Los Angeles Educated G

       WARNING: Do not reboot your computer after running RKill as the malware process will start again , preventing you from properly performing the next step.

       Every time I use Rkill the program automatically reboots. What do I do.

       Helpful ReplyReport
       1. S
          Stelian PiliciTeam14 years ago

          In reply to Brian

          Hello Brian,
          It seems like you also have a ZeroAccess rootkit on your machine.Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on:

          STEP 1 : Run a scan with Combofix

          Download ComboFix from one of the following locations:

          COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
          COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

          VERY IMPORTANT !!! Save as Combo-Fix.exe during the download.ComboFix must be renamed before you download to your Desktop

          • Close any open browsers.
          • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
          • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
          • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
          • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

          1. Double click on ComboFix.exe & follow the prompts.
          2. Accept the disclaimer and allow to update if it asks
          3. When finished, it shall produce a log for you.

          Notes:

          1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
          2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
          3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

          ---

          STEP 2: Run a scan with ESET Online Scanner:

          1. Download ESET Online Scanner utility.
             ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
          2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
          3. Check Yes, I accept the Terms of Use
          4. Click the Start button.
          5. Check Scan archives
          6. Push the Start button.
          7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
          8. When the scan completes, push Finish

          NEXT,please run a scan with HitmanPro and RogueKiller
          Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

          Helpful Report
14. M
    Mika14 years ago

    This was a great help! I’m really glad I stumbled across this. It’s pretty annoying to get Malware, but I’ve learned to fix so many of the tough ones I knew right away I needed to shut down and restart in safe mode with networking as soon as my desktop went dark. I also already had Malware Bytes on my computer, so it was pretty easy for me to run the unhide app and hitman. Thank you!

    Helpful ReplyReport
    1. B
       Bill14 years ago

       In reply to Mika

       I have followed each of the steps outlined, which removed the virus, restored my shortcuts, desktop, etc, however, like Randy Haben below, I cannot run Windows Update and cannot turn on Windows Defender firewall. I tried the Windows Update Troubleshooter, but it was unable to fix update.
       Any suggestions?

       Helpful ReplyReport
       1. S
          Stelian PiliciTeam14 years ago

          In reply to Bill

          Hello Bill
          Can you please run a scan with Combofix, ESET online scanner and post the logs here so that I can get an idea on what’s going on :

          STEP 1 : Run a scan with Combofix

          Download ComboFix from one of the following locations:

          COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
          COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

          VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

          • Close any open browsers.
          • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
            ———————————————————–
            • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
            • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
              ———————————————————–
            • Close any open browsers.
            • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
            • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
            • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

            ———————————————————–

           

          1. Double click on ComboFix.exe & follow the prompts.
          2. Accept the disclaimer and allow to update if it asks
          3. When finished, it shall produce a log for you.

          Notes:

          1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
          2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
          3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

          ---

          STEP 2: Run a scan with ESET Online Scanner:

          1. Download ESET Online Scanner utility.
             ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
          2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
          3. Check Yes, I accept the Terms of Use
          4. Click the Start button.
          5. Check Scan archives
          6. Push the Start button.
          7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
          8. When the scan completes, push Finish

          NEXT,
          1. Click the Start buton
          2. Type “cmd” in the Search Box and then press Enter
          3. Right-click “cmd.exe” and select “Run as administrator”
          4. Click “Continue” on the “User Account Control” Window
          5. In the command prompt type the following command
          sc create BITS binpath= “c:\windows\system32\svchost.exe -k netsvcs” start= delayed-auto
          6.Restart your computer and check if the problem is solved.
          Waiting for your reply to tell me if your machine is ok and the logs from this utilities.
          Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

          Helpful Report
15. M
    mdxba14 years ago

    Life Saver! Thank you so much for creating this for us non techies. Followed the steps and all my files were recoved. You guys ROCK!!!!!!

    Helpful ReplyReport
16. K
    Kellie14 years ago

    Worked great – cool tools.. thank you for the help!

    Helpful ReplyReport
17. R
    Randy Haben14 years ago

    Like many others, I found this blog post enormously helpful. It has taken many hours over a couple of weeks to recover from this attack. I got stuck at the Hitman Pro step. When running it I noticed it flagged the MBR (Master Boot Record). That worried me a little and when I rebooted, I got a “disk read error”. I could not find any articles to deal with that other than re-installing Windows. One problem with that is that I cannot have my original disks. However, I do have another laptop with Windows 7 and created a repair disk from that. Booting from the repair disk dvd, I discovered I could get to the command prompt and could see my hard drive and could run CHKDSK, which came back with no errors. I ran the various boot fixes and still could not get past the disk read error on startup. Then it occurred to me that maybe the partition had been deactivated. I got back to the command prompt on the repair disk and used DISKPART to set the partition (in this case partition 2 because DELL has other uses for partition 1) to active. Bingo! Now the computer boots and fine and I have been able to continue with the remaining steps. RogueKiller identified the ZeroAccess rootkit and apparently neutralized it. MalwareBytes and HitmanPro now run clean.

    Thanks again for this really useful post.

    Helpful ReplyReport
    1. R
       Randy Haben14 years ago

       In reply to Randy Haben

       Follow-up: Turns out I was not done. BITS and Windows Update services had been corrupted. I was able to get Windows Update working (sort of) with the Fix-It tool from Microsoft. But it could not fix BITS, which is necessary or Windows Updates to actually install the updates. After many hours of painstaking searching, I finally found a registry fix for BITS in a Microsoft answers article: http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/bits-service-is-missing-error-code-80246008/08cadf89-5ac5-4e15-8795-6c5ff798847c. After rebooting, BITS started normally but I still don’t see any progress in downloading. In any case, it seems like progress.

       Helpful ReplyReport
18. T
    TexasMama14 years ago

    OMG! You are a lifesaver! The instructions were easily laid out and made following easy! THANK YOU!

    Helpful ReplyReport
19. A
    Anthony Freites14 years ago

    Your information on this site is excelent the best thing about it is that is free with no gimmics . I realy appreciate this site .Got rid of that anoying (file Recovery virus) Thanks a lot for your help.

    Helpful ReplyReport
20. R
    Richard14 years ago

    Thank you for the help so far. I have spent 4 hours already researching how to fix this Live Security Platinum spyware with 2 other websites that lure you into a payment plan for protection, and following the discovery of your personal help have managed to reach step 4, but cannot find this mbam-setup icon either on the desktop or in the list of programs to run. Following advice to another in this predicament, I have jumped to Step 6 and returned to step 4 to no avail. Please can you advise? I have MS Windows XP.

    Helpful ReplyReport
    1. S
       Stelian PiliciTeam14 years ago

       In reply to Richard

       Hello Richard,
       Can you please run a scan with Combofix,RogueKiller and ESET online scanner and post the logs here :

       STEP 1 : Run a scan with Combofix

       Download ComboFix from one of the following locations:

       COMBOFIX DOWNLOAD LINK #1 (This link will automatically download Combofix on your computer)
       COMBOFIX DOWNLOAD LINK #2  (This link will automatically download Combofix on your computer)

       VERY IMPORTANT !!! Save as Combo-Fix.exe during the download. ComboFix must be renamed before you download to your Desktop

       • Close any open browsers.
       • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
         ———————————————————–
         • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection beforeperforming a scan. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
         • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don’t know how to disable it, please ask.
           ———————————————————–
         • Close any open browsers.
         • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
         • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
         • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

         ———————————————————–

        

       1. Double click on ComboFix.exe & follow the prompts.
       2. Accept the disclaimer and allow to update if it asks
       3. When finished, it shall produce a log for you.

       Notes:

       1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
       2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
       3.  If after the reboot you get errors about programms being marked for deletion then reboot, that will cure it.

       ---

       STEP 2: Run a scan with RogueKiller

       1. Please download the latest official version of RogueKiller.
          RogueKiller Download Link (This link will automatically download RogueKiller on your computer)
       2. Double click on RogueKiller.exe to start this utility and then wait for the Prescan to complete.This should take only a few seconds and then you can click the Start button to perform a system scan.
       3. After the scan has completed, press the Delete button to remove any malicious registry keys.
       4. Next we will need to restore your shortcuts, so click on the ShortcutsFix button and allow the program to run.

       ---

       STEP 3: Run a scan with ESET Online Scanner:

       1. Download ESET Online Scanner utility.
          ESET Online Scanner Download Link (This link will automatically download ESET Online Scanner on your computer.)
       2. Double click on the Eset installer program (esetsmartinstaller_enu.exe).
       3. Check Yes, I accept the Terms of Use
       4. Click the Start button.
       5. Check Scan archives
       6. Push the Start button.
       7. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
       8. When the scan completes, push Finish

       Next,please run HitmanPro and Malwarebytes as seen on the guide.
       Waiting for your reply to tell me if your machine is ok and the logs from this utilities.

       Helpful ReplyReport