I've managed to totally remove '<name> <number>GB (Secured by Kaspersky Internet Security 2017).bat' trojan on many PCs:
1. Install CCleaner. Yes, they were previously infected with malware. Piriform admitted it and updated their software.
-Run it. Run the Cleaner menu to clean your PC from internet cache, temp files etc. Some pc has more than 10Gb of junk. Then, run the Registry menu to clean your registry. I've done this on many PCs. Turns out okay to delete/clean the Registry entries. After that, run the Tools>>Startup. Delete entries that asks your pc to run random.letters.exe and also *\AppData\Roaming\Kaspersky Internet Security 2017 Personally I've deleted all and all PCs are okay
Does this clean the trojan? not yet. But you know it's there by looking at the Startup list. Your PC is going to be clean from junk when you've run the Cleaner and Registry menu though. Lesser files = faster scanning. Right?
2. Install Norton Power Eraser. Run it. It'll run rootkit scan and ask to restart. You must have not disconnect your Personal Hotspot when using this baby. Yeah I know you wanna save your dataplan but the NPE will ask to connect to internet after it restarts the PC and after it scans the computer. No internet? It'll repeat the process. It will not eat your bandwidth.
NPE will tell u it found at least 3 entries of virus. Proceed to delete. Create restore point is necessary. If error occurs, just proceed without restore point. Don't be afraid. The key is this. Run all scanning programs one-by-one. I've run adwcleaner and NPE consecutively, boy, lucky I chose that create restore point menu.
PC will restart. After that, it'll run again. Most of the time NPE will detect another 1 or 2 *.exe infected files. Send it to cloud (there's these cute cloud icons). NPE will suggest you delete those files. You'd want to delete them.
3. YOUR PC isn't clear from the water yet. Install adwcleaner. Run Scan for Adware/PUPs. It'll need internet to update to latest definition. You'll see these: PUP.Optional.Legacy, [Key] -HKU or HKCU or HKLM. Reboot to clean. Do it. When you google for this little helper, you'd want to click the link where it says Download - AdwCleaner - ToolsLib
Your PC will be free CLEAN. Yay!. You'll see Deleted: [Key] - HKU or HKCU or HKLM.
Just to be sure. Run CCleaner and run the Tools>>Startup. If you see one string of *\AppData\Roaming\Kaspersky Internet Security 2017 just delete it. And you're good to go.
4. One more thing. Install SMADAV from SMADAV.net
-Everytime you put in your thumbdrive, Just right click and scan with this. It'll help unearth your hidden folders.
I know some of you couldn't find your files just yet. Relax and don't format that thumbdrive.
When you view your files, press Alt+T. OR set to View hidden files. I've come across situation where the files are simply not there!. Relax. You want to type <Thumbdrive letter>:\System Volume Information
For example:
F:\System Volume Information
All your hidden files are here.
5. Copy files you wanted to save onto your desktop.
6. Format your thumbdrive.
7. Copy those precious little gems of files back to your thumbdrive.
Guys / Gals, you can only run all steps from the pc using internet. Don't expect to copy all installers (ccsetup535.exe, NPE.exe, adwcleaner_7.0.2.1.exe and smadav2017rev65.exe) from your thumbdrive to the infected PC. It'll eat all your files and you're back to square one. Next time, don't worry so much. If there's any infected PC, run steps 1 to 4. And clean them thumdrives.
-skali-
Hope these helps. I am familiar with the softwares that I use. They're all free or have a free version. Yes, some of you might prefer some other cleaners. Your PC, your choice. I did and it worked. I've helped my friend to clean all PCs in his cybercafe that's what I did.
Click to expand...
Problems? See this thread at archive.org.
![[IMG]](images/storyImages/SuspectVirus2.png)
![[IMG]](http://s22.photobucket.com/user/foxfaisal/media/SuspectVirus2.png.html)
