2

I have a virus that runs as a process every time I boot up my computer (unless booted in safe mode). The virus is non-malicious, all it does is redirects my searches in google.com.au (any browser) to cse.google.com which I assume tracks the searches I make or something. The virus is in my windows\temp folder as a few different files, some with slightly different names, but all starting with "g" and then some random letters and numbers (they randomize every time I restart pc). The files either have a .tmp or .exe extension. Image of virus in the windows\temp folder.

If I delete the files, they say they cannot be deleted because they are open in Google Chrome, so when I close chrome process and then delete the programs, the virus is gone, until I reboot my PC and the files are back in the temp folder and the process is running again.

I have tried numerous antivirus, anti malware and other virus removal programs, but none of them even detect this virus! Except for rkill.exe which only ends the process and does not delete it, so it starts back up again.

How can I remove this virus from my computer for good? Is it possible to see what exactly is creating these files in my temp folder so that the source can be deleted as well? If I am at least able to stop this process from starting when I boot my PC, then that will also solve my problem, but it is not in the windows startup files. Any help appreciated!

Baibro
  • 201

1 Answers1

0

Zoek is a cleanup program that removes certain system elements including your web browsers. Since the program is scriptable, it is possible to specify a custom task list to clean specific items.

Zoek is therefore ideal in the case of an infection to clean its Web browsers and certain system components.

In the example, we will clean up different parts of the system, including browsers.

Cleaning is quite long so be really patient.

Download zoek.exe and save it to your Desktop :

Important: Disable your AntiVirus and AntiSpyware programs so they do not interfere with the running of the program.

  • on Windows Vista, 7/8/10, right-click Zoek.exe and select: Run as Administrator

  • give it a few seconds to appear

  • copy/paste the entire script inside the codebox below into the input field of Zoek:
createsrpoint;
ipconfig /flushdns >> C:\zoek-results.log;b
chrdefaults;
ffdefaults;
iedefaults;
resethosts;
emptyclsid;
emptyfolderscheck;delete
shortcutfix;
emptyalltemp;
autoclean;

enter image description here

  • close any open programs.
  • click the Run script button, and wait. It takes a few minutes to run.
  • when the tool finishes, the zoek-results.log is opened in Notepad: the log can also be found on the systemdrive, normally C:\zoek-results.log
  • if a reboot is needed, the log will be opened after the reboot.
Hackoo
  • 1,410