SOLVED Tons of viruses won't go away.

[Cookieman]

If no luck with the kaspersky site then try Panda...

To perform an online scan with Panda ActiveScan

• Click on Scan Your PC Now
• A "pop up" window will appear, or a new tab will open.
• Click on Register
• Choose the option you like most, but we recommend the Free Registration.
• Click on Register
  
• Enter your e-mail address, and create a password.
• Select "I do not want to receive any type of information". (unless you want to receive such information)
• Click on Send
• Confirm registration, and continue by entering your user name and password, then click on Enter
• Select Full Scan, then Click on Scan Now
• Wait for the components to be loaded and installed. Don't close this window or go to another page while it is downloading. You can continue using the Internet by opening another window in your browser.
• If it finds any malware it can disinfect, the Disinfect button will be enabled. Click on Disinfect
• Please ignore the offer to buy the program. Click on Export To
  
  
• Export the log and save it to your desktop.
• Please post the contents of that log to your reply.

* Turn off the real time scanner of any existing antivirus program while performing the online scan.

Avast users note:

Please do continue with the online scan at Panda if you receive an alert. It is a false positive from Avast because Panda Antivirus does not encrypt its virus database.

 

[draceena]

I agree on the reinstall at this point....sounds like something crazy is going on and nothing short of a nuke-n-pave will really fix it.

Heck I get paranoid and thinking of reinstall if my anti-virus even just pops to say it blocked something and my system is perfectly fine...lol

 

[Veedaz]

nuke-n-pave

I know Boot and Nuke (DBAN) would sort it, if you need to get a HDD clean/wiped this is the tool, i have used it many times

Link > http://www.dban.org/

 

[BetaMan]

Nee... A few weeks ago, I vowed to myself that I would not reinstall, then isolated myself on Ubuntu for three weeks. Or more, I don't know. But now I'm back and I need to fix this. I'm trying panda right now. Wish me luck.

 

[BetaMan]

Oh, wow. I haven't told you guys that I actually found the problem, and now I need help. I've got something called the "temp.exe" virus. The process cannot be ended because the PID is dynamic, so when Task Manager tries to end it, the PID has changed. Anyway, I'm sure this is the problem, this "temp.exe". The description is "recycler" and I've seen a few folders named that around my system. HALP!

 

[kitesurfa]

not come across the virus but things to try and kill it.

Search registry and find the key that runs it when your PC is first swiched on and delete it.
next delete the running file with software like http://lockhunter.com/ or FileASSASSIN.
If above doesn't work use Explorer or My Computer to find the location of 'temp.exe' then Reboot and F8 and boot to C:> prompt then CD to the required directory and delete manually before Rebooting to windows to test.

Other tip...
Use a Firewall to stop files like this connecting to the web, which should show what the software is and the location it is on your PC. (ZoneAlarms is good for this)

 

[clifford_cooley]

Can you boot to Ubuntu and remove the file from outside Windows 7 bootup. If it is not on the computer to load then it won't be a problem.

I know I would have options to remove it manually with Hiren's BootCD using NTFS4DOS.

 

[kitesurfa]

NTFS4DOS - http://www.free-av.com/en/download/11/avira_ntfs4dos_personal.html

 

[clifford_cooley]

Thanks kitesurfa

I've downloaded it myself

 

[Veedaz]

File Assassin from Malwarebytes is a great tool (and a powerful one) as it can

use advanced programming techniques to unload modules, close remote handles, and terminate processes to remove the particular locked file

File Assassin > http://www.malwarebytes.org/fileassassin.php

 

[BetaMan]

Thanks, Veedaz, I'll try that.

 

[BetaMan]

WOAH!! So I find the file, right? It's in my System32 folder and the description is "Recycler" and the Company is "Microsoft Corp." could this be a glitch and not a virus?

 

[BetaMan]

I... Did it!!!!! One of the temp.exe instances finally got a static PID, so I Right-Clicked it and found the file location. It was a gold mine of exe files, all with names things like "temp", "recycler", and the classic, "myporn". So I deleted all, or tried at least, and they all went down the drain (or Compost [Recycle Bin]) except of course good old "temp". So I booted into Ubuntu, deleted it, did another search for "temp" and found another folder, deleted that, booted back up into 7, and yippeee! Processor speeds are normal again. Thank you everyone for your support and help!

-BetaMan

 

[luckysaad]

To Remove Virus in you Computer Follow this instructions

Restart you Computer Safe Mode with Networking How To Restart? To get into the Windows Safe Mode with Networking computer is booting press and hold your "F8 Key" which should bring up the "Windows Advanced Options Menu" as shown below. Use your arrow keys to move to Safe Mode with Networking and press your Enter key. Then Download Update and Scan Use Malwarebytes' Anti-Malware Press This Link http://www.download.com/Malwarebytes-Ant…

Download and Scan By using Remove Fake Antivirus description
This application is used to remove fake Antiviruses from your computers press herehttp://www.softpedia.com/get/Antivirus/R…

Download and Scan by Use Super Anti-spyware Press herehttp://www.superantispyware.com/

Download and Scan by Use Norman Malware Cleaner Press herehttp://majorgeeks.com/downloadget.php?id…


After Finish Remove Virus/Malware/Trojan Fake Anti-Virus Worm and
Rougue Spyware and
Adware
Restart You Computer To Be Normal Don't Forget to said to me Thanks if My Advice will help you.