Windows 7: Rkill – Repair Tool of the Week.

Comments from Corrine & Jacee sought!

Refer link -
https://mvp.support.microsoft.com/co...awrence+Abrams

Rkill is made by a Microsoft MVP “Lawrence Abrams” and is available in 4 different extensions. An .EXE, .COM, .SCR and a .PIF

Read more -
Rkill – Repair Tool of the Week | Technibble

Thanks JMH,

I have a friend that just got hit by Internet Security 2010 Fake AntiVirus

Having a terrible time removing it, since it has dis-abled IE, MalwareBytes, Trojan Remover, etc.

Hope this works

I have never used Rkill, but I have made some notes on it from a respected source:

It is intended to terminate active rootkits. If your anti-virus program flags it as a malicious process, ignore the flag.


If a rootkit is active it may lie to or block access to MBAM.

DO NOT REBOOT after running Rkill, until you have run MBAM.

Note any malware Rkill reports as having terminated.

Open and run MBAM to fix any malware problems it detects. Save the report.

Delete any restore points

Run online scanners

Run Rkill again, don't reboot, then rerun MBAM.

rkill definitely has come in handy when people I am helping cannot launch standard programs such as MBAM because they are blocked by the infection.

Take a look at the instructions here: Remove Internet Security 2010 (Uninstall Guide)

1) Do NOT delete restore points until the computer is clean. The only harm in an infected restore point is having to start the cleanup process over again. That is better than a borked system by a bad removal process.

2) It is only necessary to run rkill again if unable to run MBAM or other programs after the restart. Note, however, if you get a message that rkill is an infection, the message is most likely a fake warning by the rogue. Leave the warning on the screen and then run Rkill again.

A big "THANKS" for that.

I have no reason to believe I have a rootkit, but I just ran the program.

I ran the exe version and the com version. Both completed within maybe 15 seconds. I got no onscreen report of any kind--the window simply disappeared.

Is this normal behavior when no issues are found? I would have guessed I would see a notice of some kind onscreen.

@JMH -- You're welcome.

ignatzatsonic, Rkill isn't the only tool of its nature nor is it a fancy program -- it is a tool Grinler created to accompany the tutorials and for our use in the forums. Since it did not find any known malware processes to kill, it closed.

OK.

Thanks Corrine; I just wanted to confirm I understood default behavior. I will keep it around and hope I never need it.

No need to keep it around. It is best downloaded fresh if needed so you can benefit from updates that would include additional processes.