Member Avatar for Baby.D

Hey, I don't know how I got it but I have a virus called MS Removal Tool which is taking over my ability to surf the net and open files. What is the most efficient way to remove it's annoying-ness.

-

  • 3 Contributors
  • 5 Replies
  • 309 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Following 's update that the infection was cleared after running Malwarebytes (suggested by ), the following follow-up checklist fills gaps that often remain after a FakeAV/rogue-scanner cleanup and helps prevent reinfection.

Run at least one independent on-demand scanner (different engine from the first) and a rootkit check to catch leftovers. Inspect startup and scheduled tasks with Autoruns (Sysinternals) and remove unfamiliar entries. Examine the hosts file at C:\Windows\System32\drivers\etc\hosts for unexpected redirects and restore it to defaults. Look for unknown services/drivers in Services.msc and Device Manager, clear temp folders and the Recycle Bin, then rescan.

Treat credentials and recovery points as potentially compromised: change passwords (banking/email) from a known-clean device, and create a new System Restore point only after confirming the system is clean; delete old restore points that may contain malware. Back up personal files and capture a full disk image so a fast rollback is available if problems recur.

If symptoms persist (recurring popups, unexplained outbound connections, new user accounts, blocked security tools), a clean reinstall is often safer and faster than continued remediation. For complex cases or verification, vendor removal guides and specialist malware-removal communities can provide targeted next steps; include which tools were already run (MBAM and any secondary scanners) and any specific error messages to avoid duplicated effort.

Recommended Answers

All 5 Replies

Member Avatar for Baby.D

Won't even let me open mbam. Says something about the '.exe' being infected.

Member Avatar for crunchie

Please post in the Viruses, Spyware and other Nasties forum for ALL virus related problems.

Member Avatar for Baby.D

Sorry, my bad.

This thread is now solved though. I mbamed but had to do it in 'Safe Mode with Networking' to avoid the popup.

Thanks for your help!!

Member Avatar for crunchie

Should run it in normal mode now as MBA-M only works at 100% efficiency in normal mode.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.