Member Avatar for Markzyyy

Hi,
Well i'm new here.. but i got an annoying thing.

I got a virus called Raktemp.exe.
NOD32 kept moving it to Quarantaine, and now it's there 33 times..
I installed adobe dreamweaver cs4 today..

But i guess it will come back sometimes, and i just wanna make sure i don't have some bad virus he doesn't see anymore.

Also in my windows folder i found welik.exe countaining a trojan horse..
But i cant delete it.

i hope you can help me,


Thanks.
Mark.

  • 4 Contributors
  • 3 Replies
  • 197 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by markwright

Dani AI

Generated

Brief summary and targeted next steps: multiple quarantined copies of Raktemp.exe plus an undeletable welik.exe in the Windows folder point to a likely persistent infection. and correctly steered the thread toward antivirus scanning and forum help; suggested trying another AV. The immediate priorities are (1) verify whether those binaries are malicious, (2) identify how they persist, and (3) remove persistence safely without restoring quarantined items.

Verification (hash + reputation): compute a strong file hash and check it on a multi-engine scanner before taking destructive action. Example command (Windows builtin):

certutil -hashfile "C:\Windows\welik.exe" SHA256

Record the SHA256 and submit that hash to an online multi-engine scanner or share it in the thread rather than attaching the binary. Check the file’s digital signature and the exact file path — unsigned or oddly-located executables in System folders increase suspicion. If Dreamweaver CS4 was installed from an unofficial source, treat the installer as a potential vector.

Finding and removing persistence: use a handle/process viewer to see which process holds the file and a startup autorun enumerator to find Run/RunOnce/services/scheduled-task entries. If file locks prevent deletion and the file is confirmed malicious, ownership and permissions can be reclaimed (example):

takeown /f "C:\Windows\welik.exe"
icacls "C:\Windows\welik.exe" /grant Administrators:F
del /f /q "C:\Windows\welik.exe"

Caveat: altering or deleting signed Windows system files can break the OS. Compute and save hashes before deletion and only delete confirmed-malicious items.

When to escalate: if persistence cannot be removed, use a trusted offline rescue environment (vendor rescue disk/USB) to scan and clean, or consider a clean reinstall when confidence in full removal is low. Share relevant NOD32 logs, Autoruns output, and file SHA256 values (not raw executables) so responders can validate detections.

Recommended Answers

All 3 Replies

Member Avatar for Xlphos

Hello Markzyyy,

I suggest you read the read me's Here. You may also have better look posting this in the virus forum - you are more likely to get a better response rate.

Member Avatar for xcellpro6

Hi Mark

Restart your computer into safe mode by pressing the F8 key on start up Keep pressing until safe mode comes up. choose Safe Mode then let the system start

The icon will be larger than normal this is ok. Click on start and find the folder called Eset. Find NOD32 and click on it ... the menu will appear for Nod32. Then click on the drive you want to check... then click on Actions.... this is where you tell Nod32 what to do with the virus if it finds one.... Click on clean and then on the right hand side select delete. this means that if the virus cannot be cleaned it will delete it. Dont worry at this time about the ones in the quaratine. Now click on Scan and clean and let the system do a full scan ... give it time.... once the scan is done check the results... Restart PC in normal mode go to Nod 32 and open quarantine click on the first item there then scroll to the bottom hold the shift key down and click on last one ......right click the highlighted items and select Delete ..... restart machine items in quaratine should be gone

hope this helps let us know

Darren

Member Avatar for markwright

Hi,
Try to remove it by quick heal.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.