Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

TopRebates Removal

This bug is also known as TrojanDownloader.Win32.Agent.y [Kaspersky] and is proving to be rather difficult to remove at times.

Destroy Autorun:
Delete the following keys
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates,
and/OR
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\webrebates0,

Reboot your system then:

Make sure you click start --> Run and type in msconfig. Then select the startup tab. Any references to the processes below.

End Processes (may or may not exist):
2805e.exe
arupdate.exe
cashback.exe
cb.exe
djtopr1150.exe
flash.exe
nls.exe
disp1150.exe
webrebates0.exe
webrebates1.exe
webrebates_cdt_installsilent.exe
unstsa3.exe

Unregister DLLs:
C:\windows\3_0_1browserhelper3.dll
C:\windows\neti.dll
C:\windows\system32\imgconv.dll
C:\windows\system32\vic32.dll

Remove Directories:
C:\Program Files\web_rebates
C:\Windows\winskw

Clean your Registry:

You should be back to normal IF this was your only problem. I suggest you post in our HJT forum since its not likely that this is your only bug. Read this first


Written By: Martin Krohn
Printer Friendly

Article Index:
Talk About it! -->