|If downloading files to the infected computer is not possible, access a clean computer and transfer files to the infected computer using a USB flash drive, or other removable media (CD/DVD, external drive). |
Now, download one of these files: iExplore.exe or eXplorer.exe. They are renamed copies of RKill:
Save the file to the Desktop, and double-click on it. (For Vista/Windows 7, select: Run as Administrator)
If you get a message that RKill is an infection, just ignore it. If you run into infections warnings to close RKill, leave the warning on the screen and run RKill again.
If you encounter problems running RKill, download another renamed version of RKill from its download page.
Do not reboot your computer after running Rkill!
Next, download TDSSKiller from the following link:
Save to the Desktop..
Once the file is on the Desktop, rename it.
Right-click on the TDSSKiller.exe icon on the Desktop and select: Rename
Name it a random name with a .com extension. For example, jaws.com
Now, double-click the renamed file to run the program
When TDSSKiller starts, it display the welcome screen.
Click on the Start Scan button.
When the scan finishes it displays a results screen stating whether or not the infection was found on your computer.
To remove the infection, click on the Continue button.
If it does not say Cure on the results screen, leave it at the default action of Skip, and press the Continue button.
Do not change to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
If TDSSKiller requires a reboot to finish the cleaning process, click on the Reboot now button.
When TDSSKiller finishes cleaning the infection, a report stating whether or not it was successful is shown.
<<Please provide the TDSSKiller report in your reply.<<
Now, download Malwarebytes’ Anti-Malware (black button with green and white icon) Save to the Desktop:
Double-click mbam-setup.exe and follow the prompts to install the program. (For Vista/Windows 7, select: Run as Administrator)
Run Malwarfebytes’ AntiMalware and update the program.
Once updated, select Perform Full Scan and click the scan button.
When the scan finishes, click OK in the message box, and you will see the results of the scan.
Click <Remove Selected
When Malwarebytes finishes, you may be prompted to reboot. If so, reboot.
>>Please post the Malwarebytes log in your reply, as well as the TDSSKiller report, and we will determine if any further action is necessary.<<
This infection may hide all the files on your computer. To make files visible again, download the following program to the Desktop:
Double-click on the Unhide.exe icon on the Desktop and allow the program to run.
TAlso, this infection may change your desktop background to a solid black color, and, if so, we need to change it back to the default Windows theme or to your preference.
If you are using Windows XP, please click on the Start button and then select Control Panel. When the Control Panel opens, please click on the Display icon. From this screen you can now change your Theme and desktop background so that it no longer shows the black background.