Welcome to TechSpot!
If you are infected with System Check it is important that you do not delete any files from your Temp folder or use any temp file cleaners
Please follow these steps:
Preliminary Virus and Malware Removal.
NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.
When you have finished, leave the logs for review in your next reply .
NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.
Note: You can skip GMER for now and run Malwarebytes and DDS. If you cannot run one or either, please go on to the directions below:
- System Check is a fake (Rogue) computer analysis and optimization program.
- The 'alerts' tell you the problems have lead to corrupt and missing data
- It will display false error messages and security warnings.
- It "hides" Icons, desktop, programs and files so that they appear to be missing and some programs can't be run
- This can be installed through hacked sites that exploit vulnerabilities on the system or through fake online scanner pages
- The malware is configured to automatically start when you logon to Windows.
- It can also be started if you click on any of these alerts.
Note: You may not experience all of the above, but it is important to tell me what problems you do have.
============================================
See below. Do this if needed: Press Windows+R key> type
cmd> OK
1. If your task manager is disabled,copy and run this command
Code:
Echo y | reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr
Press Enter
2. If you're desktop is blank and unable to right click on it ,run this command
Code:
Echo y | reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoDesktop[/b]
Press Enter
==============================
Please print out the following instructions. It is important that the order of the scan below be followed exactly. Please read through all of the instructions before you begin.
--------------------------
The following can be run first to allow you to 'see' the programs, files,etc.
But it is important that you understand that this does not remove the malware, only the attribute to hide these features. So it is important that you continue with the cleaning:
1. Download
Unhide.exe and save to the desktop.
- Double-click on Unhide.exe icon to run the program.
- This program will remove the +H, or hidden, attribute from all the files on your hard drives.
Note: This does not remove the malware- only the attribute that hides icons and programs. It is important that you continue.
================================
2.
Boot into Safe Mode with Networking
- Restart your computer and start pressing the F8 key on your keyboard.
- Select the Safe Mode with Networking option when the Windows Advanced Options menu appears, using your up/down arrows to reach it and then press ENTER.
=======================================
3.
To end the processes that belong to the rogue program:
Please click on
RKill
- At the download page, click on Download now button for iExplore.exe download link and save to the desktop
- Double click on the iExplore.exe icon
- Please be patient- it may take a bit.
- The black Window will close when through and you can continue.
Note: If you get a message that RKilll is malware, ignore it> it's from the malware.
=======================================
Do not reboot your computer after runningRKilll as the malware programs will start again.
================================
4. This malware frequently comes with the TDSSrootkit, so do the following:
- Download the file TDSSKiller.zip and save to the desktop.
(If you are unable to download the file for some reason, then TDSS may be blocking it. You would then need to download it first to a clean computer and then transfer it to the infected one using an external drive or USB flash drive.)
- Right-click the tdsskiller.zip file> Select Extract All into a folder on the infected (or potentially infected) PC.
- Double click on TDSSKiller.exe. to run the scan
- When the scan is over, the utility outputs a list of detected objects with description.
The utility automatically selects an action (Cure or Delete) for malicious objects.
The utility prompts the user to select an action to apply to suspicious objects (Skip, by default).
- Select the action Quarantine to quarantine detected objects.
The default quarantine folder is in the system disk root folder, e.g.: C:\TDSSKiller_Quarantine\23.07.2010_15.31.43 Save log and post in next reply.
- After clicking Next, the utility applies selected actions and outputs the result.
- A reboot is required after disinfection.
====================================
If TDSSKiller requires you to reboot, please allow it to do so. After you reboot, reboot back into Safe Mode with Networking again
====================================
5.
Update and rescan with Malwarebytes:
- Select Perform Full Scan on the Scanner tab
- Click on the Scan button.
- When scan has finished, you will see this image:
- Click on OK to close box and continue.
- Click on the Show Results button.
- Click on the Remove Selected button to remove all the listed malware.
- At end of malware removal, the scan log opens and displays in Notepad. Be sure to click on Format>Uncheckk Word Wrap before copying the log to paste in your next reply.
==============================
6.
Correct Display Changes if needed:
If the desktop background is black or if the theme has been removed:
For Windows XP: Click on Start> Control Panel> Display> change theme and/or background if needed.
For Windows Vista or Windows 7: Click on Start> Control Panel> Appearance & Personalization> Select
Change Theme or
Change Desktop Background
=====================================
7. Some items may not show on the Start menu. To add them back:
- Right click on Start> Properties
- Taskbar and Start Menu Properties screen appears
- choose Start Menu tab> Click on Customize
- For Windows XP> Choose Advanced tab
- Check the items you want back on the Start Menu
- When finished> click on OK> Apply and close.
====================================
You can now reboot back into Normal Mode
==================================
Please leave logs for the following in your next reply:
Malwarebytes
DDS (2 logs
RKill
TDSSKiller
===============================
My Guidelines: please read and follow:
- Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
- Read my instructions carefully. If you don't understand or have a problem, ask me.
- If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
- Follow the order of the tasks I give you. Order is crucial in cleaning process.
- File sharing programs should be uninstalled or disabled during the cleaning process..
- Observe these:
[o] Don't use any other cleaning programs or scans while I'm helping you.
[o] Don't use a Registry cleaner or make any changes in the Registry.
[o] Don't download and install new programs- except those I give you.
- Please let me know if there is any change in the system.
If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
=====================================
