If you believe your computer is infected, and you need assistance, then please following the directions below:


A. Run FRST:

Download Farbar Recovery Scan Tool (FRST) from one of the following links. I recommend saving it to your Desktop, or copying it to your Desktop from your Downloads folder when the download is finished.

32-bit Download for 32-bit editions of Windows.

64-bit Download for 64-bit editions of Windows.

Note: Only one of the two downloads above will work on your computer. If your computer has a 32-bit Windows (x86), then the 64-bit download will not work. If your computer has a 64-bit edition of Windows (x64), then the 32-bit download will not work. If you don't know whether your version of Windows is 32-bit or 64-bit, then you can try both downloads, and simply follow the instructions below for the one that works. Attempting to run both of them will not harm your computer, and the one that is not compatible will simply show you an error message and then exit.

  1. Run the FRST download that works on your computer, and on most versions of Windows you should be asked if you want to allow it (please click Yes/Continue/Allow/etc if asked).

  2. When FRST runs, it will show you a disclaimer. You will need to click Yes in order to continue using FRST.

  3. Press the Scan button.

  4. When the scan is done, it will save a log as a Text Document named FRST in the same place the tool was run from (if you had saved FRST on your Desktop, then the FRST log will be saved there, otherwise check your Downloads folder).

  5. Please create a new topic in our Malware Removal section, and attach the FRST log to your message (when typing your message simply scroll down to find the attachment controls).

  6. The first time the FRST tool is run it saves another log (a Text Document named Addition - also located in the same place as the FRST tool was run from). Please also attach that log file along with the FRST log file to your topic.


B. Run Emsisoft Emergency Kit:

Download Emsisoft Emergency Kit and save it to your desktop. Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop. Leave all settings as they are and click the Extract button at the bottom. A folder named EEK will be created in the root of the drive (usually c:\).

  1. After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.

  2. The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates. Please click Yes so that it downloads the latest database updates.

  3. When the update process is done, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.

  4. Click on Scan to be taken to the scan options. If you are asked if you want the scanner to detect Potentially Unwanted Programs, then click Yes.

  5. Click on the Full Scan button to start the scan.

  6. When the scan is finished click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.

  7. When the scan is done and any threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.

  8. Please save the log in Notepad on your desktop, and attach it to your forum topic.

  9. When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.


C. If you are unable to complete the previous steps:

If, for whatever reason, you are unable to complete the steps detailed above, then please download Rkill from one of the following seven links:



Save one of those 7 onto your desktop and try to run it. If the infection blocks it, then try one of the others. After running it, please try to follow the instructions above for FRST and Emsisoft Emergency Kit. If it does not work, then go ahead and create a new topic in our Malware Removal forum letting us know that none of the instructions worked, what symptoms your computer is experiencing, and what version of Windows it has so that we can suggest the next step to take.

Sometimes you have to run Rkill multiple times before it terminates all malicious processes. Also, Rkill's effect is temporary, and if you restart your computer before you run the scan with Emsisoft Emergency Kit then you may have to run Rkill again before you can run Emsisoft Emergency Kit.

Note: Rkill is only effective against certain types of infections. If running Rkill does not make it possible to run Emsisoft Emergency Kit, then go ahead and let us know what is happening with your computer, and we will suggest steps to take in order to deal with the issues.



D. Please be patient:

Unfortunately we cannot be on the forums all of the time, so please be patient and wait for someone to assist you.