Please download TFC
by Old Timer and save it to your desktop.alternate download link
- Save any unsaved work. TFC will close ALL open programs including your browser!
- Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
- Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
- Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.
Please download Dr.Web CureIt
and save it to your desktop. DO NOT perform a scan yet.alternate download linkNote: The file will be randomly named (i.e. 5mkuvc4z.exe).
Reboot your computer in "Safe Mode
" using the F8
method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".Scan with Dr.Web CureIt
- Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
- Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
- The Express scan will automatically begin.
(This is a short scan of files currently running in memory, boot sectors, and targeted folders).
- If prompted to download the Full version Free Trial, just ignore and click the X to close the window.
- If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
If you cannot boot into safe mode or complete a scan, then try doing it in normal mode. Be aware, this scan could take a long time to complete.
- After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
- In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
- Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
- Please be patient as this scan could take a long time to complete.
- When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
- Click Select All, then choose Cure > Move incurable.
- In the top menu, click file and choose save report list.
- Save the DrWeb.csv report to your desktop.
- Exit Dr.Web Cureit when done.
- Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
- After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)
Now rescan again with Malwarebytes Anti-Malware, but this time perform a Full Scan
in normal mode and check all items found for removal. Don't forgot to check for database definition updates
through the program's interface (preferable method
) before scanning and to reboot afterwards. Failure to reboot normally
(not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs
tab and copy/paste the contents of the new report in your next reply.