Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

RKill - What it does and What it Doesn't - A brief introduction to the program


  • Please log in to reply
981 replies to this topic

#31 ShiNi_GoD

ShiNi_GoD

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 28 April 2010 - 12:42 PM

Hi, first I'd like to thank you for all the hardwork. this is my question, i downloaded Rkill to a USB and copied it to the infected computer, this computer has been infected simultaneously by antivirus soft, Security tool, antimalware doctor, XP animalware 2010 and some AKM antivirus thing. I executed all versions of Rkill and the DOS screen pops out and the it disapears with no log. I left all warning go but and tried to execute it again but with no result. The onlione the seemed to work was Explorer version of Rkill but it only got to the screen saying to be patient and then the program ended. Am I doing something wrong? is it because I'm multiinfected? is there comething i can do? I know thi is not the best place to post this but please help!!!!!

BC AdBot (Login to Remove)

 


#32 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:31 PM

Posted 28 April 2010 - 03:10 PM

Antivirus soft likes to kill rkill fast. You just have to keep running it until it sticks. Wish I had a more technical method but thats the one that works.

You can also try in safe mode.

#33 ken545

ken545

    Malware Response Team


  • Malware Response Team
  • 1,685 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Space Coast of Florida
  • Local time:05:31 PM

Posted 28 April 2010 - 07:06 PM

Hello Larry, want to add my two cents, this program is wonderful. Took a clients laptop home this evening, infected with a rootkit and a couple of rogues, MBAM would not even install, after running RKill, it installed and cleaned up a bunch and them was able to run CF which took out the rootkit and even more junk everything is now coming up roses.

Thanks for a great program

Ken :thumbsup:

mvp_host.pngConsumer Security 2007-2008-2009-2010-2011-2012-2013-2014



donate.gif Please consider a donation to help me keep up my fight against malware.

 

Just a reminder that threads will be closed if no response in 3 days


#34 AustinTerry

AustinTerry

  • Members
  • 284 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin, TX
  • Local time:04:31 PM

Posted 02 May 2010 - 11:54 AM

I had tried to use RKill in the past without much success, but this time on a friends infected laptop, that I could not run or install any programs since it could not see the Sytem32\RunDll.exe file, even in Safe Mode, but while in Safe Mode, I was able to install and run RKill. Then I was able to install and run MBAM and it was able to clean up 3 rogue AVs, and another bug in the registry.

Then was able to boot into Normal Mode, run RKill again, MBAM, MS Security Essentials, and now SUPERAntiSpyware, and all is coming up clean!

THANKS Lawrence! You the MAN! :thumbsup:

#35 jwa131

jwa131

  • Members
  • 0 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 03 May 2010 - 09:28 AM

Have you taken down the download links again? I am unable to download.

#36 edgarwin

edgarwin

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:31 PM

Posted 06 May 2010 - 09:37 AM

Hi!

I'm using rkill.com and rkill.scr to try to stop a massive malware infection running here. I've read carefully the whole thread and i know your point is i must be persistent, but i've come across some trouble, i think.

When i execute rkill, it lasts for about 5 seconds alive before shutting down. No matter how many times i try. NOW, sometimes a red circle message turns up saying that file c:\rkill.log cannot be found; when i click OK, it shuts down. Does this mean it has actually tried to save a log in that location and it can't, or it can't open it?

Because the reason for that would be that my hard disk is h:, not c: . Does it try to save the log in c: by default? If it does, any solution?

Thanks a lot. I'm so willing to make it work; it seems a great idea.

#37 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:31 PM

Posted 06 May 2010 - 10:25 AM

As for getting it to run, not much I can do. As I said in my first post sometimes you have to just keep running it until it catches, and if that does not work, reboot into safe mode with networking and try your cleanup from there.

As for the drive lever of the log, you are right. I was putting it in the C: drive.

I have fixed it so that it will create the log on whatever drive Windows is installed to.

#38 gibeog

gibeog

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 07 May 2010 - 10:51 AM

thank you so much!! This morning while browsing google on IE i somehow got the Antispyware Soft virus..
Well needless to say I got it around 8 am, and it is now 11 am and nothing worked until i found a link to RKill!

I mean it took 40-50 times before i got it to stick, but it got rid of it quick when it finally ran through!
I've now been able to fix my host file, run an antivirus scan and as soon as thats done run Malwarebytes!

Great Great program that i will continue to use!! :thumbsup:

#39 lauriefree

lauriefree

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 09 May 2010 - 12:29 PM

Is it possible rkill might terminate itself? I run it and almost immediately get the log window, which states "Ran as Doug on 05/09/2010 at 13:25:02.


Processes terminated by Rkill or while it was running:


C:\Documents and Settings\blahblah\Desktop\rkill.com


Rkill completed on 05/09/2010 at 13:25:04.

Thanks.

#40 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:31 PM

Posted 09 May 2010 - 12:31 PM

Most likely malware causing it to terminate.

#41 lauriefree

lauriefree

  • Members
  • 34 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 09 May 2010 - 12:34 PM

I'll run malware bytes. I downloaded rkill after 2 computers in the house got the fake security warning thing, bankerfox or the like. If you have any other suggestions, I'd appreciate it.

#42 criscOSU

criscOSU

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 09 May 2010 - 08:28 PM

Hello,

I recently had to remove some malware from a family members computer (anti-malware doctor). I attempted to remove it according to instructions found on bleepingcomputer.com. The instructions involved using rkill.exe then then installing malware bytes to remove the malware.

rkill did it's job, and i was able to run malware bytes and remove the malware. However, after malware bytes removed the infected files and I restarted my computer i was no longer able to run ANY programs. Whenever i would double-click on any program, or program shortcut, it would bring up the "open with" window where you need to select a program to open it with. After trying a few small fixes (such as replacing rundll32 which was suggested to me by a friend of mine) with no success i got frustrated and decided to simply re-format and re-install windows.

Could this have been an unintentional side-effect of rkill, or was it more likely due to files that were corrupted/removed when removing the malware?

Thanks.

#43 Grinler

Grinler

    Lawrence Abrams

  • Topic Starter

  • Admin
  • 42,942 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:05:31 PM

Posted 10 May 2010 - 09:10 AM

No, I do not think rkill would have caused this.

My guess is that the particular malware changed the exe associations. You can use this to fix it, if it is not fixed already:

http://download.bleepingcomputer.com/regFixExe.reg

#44 AustinTerry

AustinTerry

  • Members
  • 284 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin, TX
  • Local time:04:31 PM

Posted 11 May 2010 - 03:15 PM

Hello,

I recently had to remove some malware from a family members computer (anti-malware doctor). I attempted to remove it according to instructions found on bleepingcomputer.com. The instructions involved using rkill.exe then then installing malware bytes to remove the malware.

rkill did it's job, and i was able to run malware bytes and remove the malware. However, after malware bytes removed the infected files and I restarted my computer i was no longer able to run ANY programs. Whenever i would double-click on any program, or program shortcut, it would bring up the "open with" window where you need to select a program to open it with. After trying a few small fixes (such as replacing rundll32 which was suggested to me by a friend of mine) with no success i got frustrated and decided to simply re-format and re-install windows.

Could this have been an unintentional side-effect of rkill, or was it more likely due to files that were corrupted/removed when removing the malware?

Thanks.


I had the same problem, but before I did any of the above. Running RKill and MBAM actually fixed the problem for me.
Here is a link to that thread so you can see for yourself...

http://www.bleepingcomputer.com/forums/t/314085/cwindowssystem32rundll32exe/

#45 Zoogergirl00

Zoogergirl00

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:31 PM

Posted 12 May 2010 - 04:58 PM

When I try to run rkill, it asks what program I want to try to open it with..... Which program should I select?




9 user(s) are reading this topic

0 members, 9 guests, 0 anonymous users