Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

TopRebates Removal
NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

This bug is also known as TrojanDownloader.Win32.Agent.y [Kaspersky] and is proving to be rather difficult to remove at times.

Destroy Autorun:
Delete the following keys
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates,
and/OR
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates0,

Reboot your system then:

Make sure you click start --> Run and type in msconfig. Then select the startup tab. Any references to the processes below.

End Processes (may or may not exist):
2805e.exe
arupdate.exe
cashback.exe
cb.exe
djtopr1150.exe
flash.exe
nls.exe
disp1150.exe
webrebates0.exe
webrebates1.exe
webrebates_cdt_installsilent.exe
unstsa3.exe

Unregister DLLs:
C:\windows\3_0_1browserhelper3.dll
C:\windows\neti.dll
C:\windows\system32\imgconv.dll
C:\windows\system32\vic32.dll

Remove Directories:
C:\Program Files\web_rebates
C:\Windows\winskw

Clean your Registry:

You should be back to normal IF this was your only problem. I suggest you post in our HJT forum since its not likely that this is your only bug. Read this first


Printer Friendly

Article Index:
Talk About it! -->