"Windows Repair" Virus halfway defeated?

5 thoughts on “"Windows Repair" Virus halfway defeated?”

1. John says:

   April 5, 2011 at 1:28 am

   Please follow these removal instructions:
   http://deletemalware.blogspot.com/2011/01/how-to-remove-windows-scan-and-memory.html
   http://www.bleepingcomputer.com/virus-removal/remove-windows-repair

   Install and run Malwarebytes Antimalware or SUPERAntispyware.
   http://malwarebytes.org/
   http://www.superantispyware.com/

   I hope this helps. Good luck!

2. GameDay says:

   April 5, 2011 at 1:28 am

   http://www.bleepingcomputer.com/virus-removal/remove-windows-recovery
   scroll halfway down the page and follow the automated removal instructions
   this is a bad bug, these instructions will help you get rid of the bug and fix the hidden files

   hope this helps

3. Ben T says:

   April 5, 2011 at 1:28 am

   Use Microsoft’s Malicious Software Removal Tool. Enter MRT in your search or RUN box and open the program (press ENTER or OK). Start it by clicking NEXT at the bottom of the page. Follow the prompts to remove the virus if there.

   The best free anti virus/spyware software for a Windows computer is Microsoft Security Essentials. It was built by Microsoft for Microsoft computers. It is updated daily and runs quietly in the background. It doesn’t use much bandwidth and has been proven to be very reliable and secure.

   You need to remove any and all other anti virus/spyware programs before you install MSE. Only use one virus protection program on your computer.

4. frankg says:

   April 5, 2011 at 1:28 am

   Reboot PC and press the F8 key a couple of times before the Windows screen appears. Enter Safe Mode, or Safe Mode with Networking if you need network access) and download MalwareBytes from google ,Install it, update, and run a full system scan. Remove everything it finds. Next, run a full antivirus scan with something like Microsoft Security Essentials .Auslogics disk defrag and Auslogics registry cleaner are very good and fast to keep you clean and running good .all are free ,just google them

5. Dave says:

   April 5, 2011 at 1:28 am

   I just had that bugger virus…I think I got rid of it (fingers crossed)

   I followed this guide: http://www.bleepingcomputer.com/virus-removal/remove-windows-repair

   I had one problem though: the Windows Repair virus blocks you from updating Malwarebytes, and it replicates itself so that each time you reboot after running Malwarebytes, it’s back.

   The bleepingcomputer.com guide gives you some simple proprietary software to run: a thing called rkill that stops all running processes, and a thing called unhide that lets you unhide all the files that Windows Repair hides. So the steps the guide gives you are:
   1) unhide files manually
   2) (download and) run rkill to halt Windows Repair
   3) (download and) run Malwarebytes to remove it.
   4) run unhide.exe to reset your files as visible files again.

   The problem is that after step 3, Malwarebytes reboots your computer and Windows Repair is back.

   Here’s what worked for me.
   1) unhide files manually
   2) run rkill to halt windows repair.
   3) review the rkill log file and write down the names and file locations of everything it shut down
   4) run Malwarebytes
   4) When Malwarebytes is done, remove the things it finds but don’t reboot the computer.
   5) Go into My Computer and manually search for the file names that rkill shut down. You’ll see a bunch of files with those names that Malwarebytes missed. Delete them all manually.
   6) (Download and) Run CCleaner to clean the registry of all the registry files associated with Windows Repair (they’ll pop up in CCleaner as dead registry keys).
   7) Reboot
   8) You should be able to update Malwarebytes again. I re-ran Malwarebytes and CCleaner again to be safe
   9) Run the unhide software from the bleepingcomputer guide to repair the hidden file settings that Windows Repair changes.

   That seemed to work for me. All free. I’m running Windows XP home, btw, for what it’s worth.

Comments are closed.