RKill - What it does and What it Doesn't - A brief introduction to the program

Fixed.

I ran this program earlier today trying to set up Malwarebytes to get rid of a google redirect virus - but as soon as I ran it all my .exe file extensions got blown out

now every .exe (when I attempt to open it) says "this file does not have a program associated with it for performing this action - create an association in the folder options control panel"

I have restarted multiple times but the file associations are still not working

This is a way bigger issue for me than the virus was - can somebody please tell me how to restore these associations - this is not at all an area of expertise for me and I am very concerned that if I have to go off of "Googled" instuctions - this bad day will continue to spiral downward as I will likely mess up my cpu even more than I already have

I run XP - A thousand thanks -

Edited by dochallenbeck, 12 April 2010 - 03:41 PM.

Rkill wont help with the TDL3 infection.

Try this,

http://download.bleepingcomputer.com/reg/FixExe.reg

Hi Grinler,

This seems like a great program that I hope I never have to use

I just want to let you know, just in case you don't, that the link you posted for Dr.Web CureIt, brings up a page written in, I am guessing, Russian. Any chance you could add a link to the English page for it?

If not, that is cool, just thought I would throw this out there.

Thanks for all you do

It has been in English for me every time, Stang. You could also search for Free Dr. Web and get there. The URL is just www.freedrweb.com, click on the Free Download link in the upper right for CureIt! to get things started.

Grinler, thanks again for RKill and now thanks for Dr. Web. I was having a problem with my wife's laptop and discovered that an Mp3 she obtained from... not iTunes... was a trojan. It has been removed and so now hopefully I can ensure that she's clean. Much appreciated.

Edited by Eric RBA, 13 April 2010 - 08:33 AM.

My pleasure. Its english for me as well when I visit it.

Wow, this is strange, figures it only happens to me since strange things happen to strange people.

I clicked on it again, same thing, the only part that was in English was the top banner and nowhere on that did it say download. I typed in the address Eric posted, same thing. I looked in the upper right corner, could not see anything there in English so I could not tell that what said download.

Then I noitced that in the very top right corner, there was a drop down thingie, so I clicked on it even though I could not tell what it said. Lo and behold, there was the option for English and now the page is in English for me too.

Sorry I couldnt figure that out before I made my above post.

Have a great day everyone and thanks again for everything

Hi Grinler,

This seems like a great program that I hope I never have to use

I just want to let you know, just in case you don't, that the link you posted for Dr.Web CureIt, brings up a page written in, I am guessing, Russian. Any chance you could add a link to the English page for it?

If not, that is cool, just thought I would throw this out there.

Thanks for all you do

There's a drop down menu at the top right of the screen where you can select English. Took me awhile to figure it out too.

Thank you Diane

Good Day!

I tried Rkill for my computer infected with Interent Security 2010. The first couple of versions of Rkill were immediatly deleted by the Malware. The screensaver and the MSDOS version were not, but when the black screen came up, the cursor blinks twice, then a error message appears saying "an unknow error has occured" I have been patient 10+ minutes, and did not click on the error message thinking it was the malware, but nothin has occured since except more pop-ups from the malware.

What am I doing wrong?

Did you use the rkill.scr or the rkill.pif? For some reason I am getting the same problem on rkill.pif. I will be taking it offline till i get it resolved.

Would this help with the fakexpa virus list? which consists of alot of rogue programs bundlled into one.. kinda.

Yes, it kills the ave.exe and related executables.

Hello Everyone....

My laptop got infected last night, and after Googling I found this and it looked exactly what I need...

Unfortunately it does'nt seem to work for me yet....

As soon as I start rkill.com (or any of the other named ones), I get a windows error dialog titled 'pev.rkexe' saying 'pev.rkexe has encountered a problem and needs to close. We are sorry for the incovenience" with close and debug buttons. It doesnt look like the warning by AntiMalware which I can ignore and keep trying. If i keep pressing close for a few times, the program terminates and i see the rkill.log file which does'nt contain any processes killed. If I leave the message box, nothiing seems to happen.

Anything I can do different? I have not tried rebooting/safe mode yet.

Update: I kept trying and one version (explorer.exe) manages to run without that message box. But if finshes quickly and the log doesnt mention any processes killed.
I can see some funny proccesses in the task manager which I am not able to shut down manually.

BTW do I need to have the internet connection running to run Malwarebytes? I tried running that and got a MBAM_ERROR_LOAD_DATABASE(0,7) error.

Edited by kb12345, 27 April 2010 - 10:05 PM.

If it produced a log that showed no processes killed, then it did not find anything wrong. That does not mean you are not infected, but just not with anything that rkill targets.