It is possible that you have Ramnit
, a file infecter. If Ramnit
has has infected this machine, it can and will infect all the machine's executable files .exe, .scr, .rar, .zip, .htm, .html. It may corrupt and damage some files beyond repair.I recommend that you back up all your important data from this machine to a USB memory stick.Step 1
Download Flash_Disinfector.exe by sUBs
and save it to your desktop.
- Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
- The utility may ask you to insert your USB memory stick. Please do so and allow the utility to clean it.
- Wait until it has finished scanning and then exit the program.
- Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder - it will help protect your drives from future infection.
You can safely back up files to this device and transfer to another machine, without risk of infectionStep 2
Copy any important files you need to keep from the suspect machine.
Do not backup any executable files (.exe .scr .html or .htm) or compressed files (zip/cab/rar) files that may contain .exe or .scr files
I would strongly suggest that you reformat you machine as it is the only way to be sure that the infection is gone. We can try and remove it but I have to warn you that the odds are not good, file infecters are very difficult to clear. If too many system files are damed, we may have an unbootable machine.
If you want to reformat, please come back to me. If you want to try and clear it, follow the following instructions exactly.Please print out these instructions» Step 1 «
On a clean machine, download Malwarebytes' Anti-Malware from Here
and save to a flash /usb disk» Step 2 «
Download combofix from http://download.blee...Bs/ComboFix.exe
and save it to your USB disk.» Step 3 «
On a clean machine, download Avira Rescue CD from here
. Follow the intructions here
, to burn a bootable CD. » Step 4 «
Insert Avira, and boot and run in the infected machine again follow the instructions from here
. I suggest you print out the instructions from the Avira forum. Once that's done, reboot your system normally, if you can (let me know if you can't before doing anything else)» Step 5 «
Insert your flash disk into the infected machine and double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.» Step 6 «
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish, so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy & Paste the entire report in your next reply.
- Copy ComboFix from your USB to your desktop but do not run it yet
- Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See http://www.bleepingc...opic114351.html
- Double click on ComboFix.exe & follow the prompts.
- Accept the disclaimer and allow to update if it asks
- Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
- A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix. Allow it to install the Recovery Console then Continue. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.
A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.
A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.