windows repair virus removal?

5 thoughts on “windows repair virus removal?”

1. Dave says:

   April 6, 2011 at 11:05 pm

   I just had that bugger virus…I think I got rid of it (fingers crossed)

   I followed this guide: http://www.bleepingcomputer.com/virus-removal/remove-windows-repair

   I had one problem though: the Windows Repair virus blocks you from updating Malwarebytes, and it replicates itself so that each time you reboot after running Malwarebytes, it’s back.

   The bleepingcomputer.com guide gives you some simple proprietary software to run: a thing called rkill that stops all running processes, and a thing called unhide that lets you unhide all the files that Windows Repair hides. So the steps the guide gives you are:
   1) unhide files manually
   2) (download and) run rkill to halt Windows Repair
   3) (download and) run Malwarebytes to remove it.
   4) run unhide.exe to reset your files as visible files again.

   The problem is that after step 3, Malwarebytes reboots your computer and Windows Repair is back.

   Here’s what worked for me.
   1) unhide files manually
   2) run rkill to halt windows repair.
   3) review the rkill log file and write down the names and file locations of everything it shut down
   4) run Malwarebytes
   4) When Malwarebytes is done, remove the things it finds but don’t reboot the computer.
   5) Go into My Computer and manually search for the file names that rkill shut down. You’ll see a bunch of files with those names that Malwarebytes missed. Delete them all manually.
   6) (Download and) Run CCleaner to clean the registry of all the registry files associated with Windows Repair (they’ll pop up in CCleaner as dead registry keys).
   7) Reboot
   8) You should be able to update Malwarebytes again. I re-ran Malwarebytes and CCleaner again to be safe
   9) Run the unhide software from the bleepingcomputer guide to repair the hidden file settings that Windows Repair changes.

   That seemed to work for me. All free. I’m running Windows XP home, btw, for what it’s worth.

2. John says:

   April 6, 2011 at 11:05 pm

   Please follow these removal instructions:

   http://deletemalware.blogspot.com/2011/01/how-to-remove-windows-scan-and-memory.html

   http://www.bleepingcomputer.com/virus-removal/remove-windows-repair

   Install and run Malwarebytes Antimalware or SUPERAntispyware.
   http://malwarebytes.org/
   http://www.superantispyware.com/

   I hope this helps. Good luck!

3. Linda says:

   April 6, 2011 at 11:05 pm

   I just fixed one today. Nasty virus. It actually hid all the icons on the desktop and all programs, so it was a challenge. Start in safe mode. The programs I tried were: Combofix (didn’t fix it), Spybot (found it, deleted it, but it came back). Superantispyware did most of what I wanted. Still in safemode, I went to msconfig and looked at the startup programs and unchecked the questionable ones. Almost there…..there was an icon on my desktop (Windows Repair) which pointed to the .exe file. It was under c:\documents and settings\all users The file was something like 1926855625.exe. I deleted that program and everything related to it. Did another Super Antispyware scan and rebooted the machine. So far (6 hours later) everything is running perfectly.

   Repost again if this doesn’t work for you.

4. Cereal Killer says:

   April 6, 2011 at 11:05 pm

   Try starting up in safe mode and running a virus scan while in safe mode.

5. Marc-André Bolduc says:

   April 6, 2011 at 11:05 pm

   At that point, backup important files, reinstall windows, install a good anti-virus/anti-spyware, then copy you backup on your new system.

   Even if you succeed to get your system to work.. there is probably a lot of corrupted files… Your system will alway be unstable…

Comments are closed.