• Announcements

    • LS.Andy

      Support for other products than adaware, ad block, web protection and Web Companion   05/05/2017

      Support for the following products is handled by the Lavasoft support team: Lavasoft Tuneup Kit Lavasoft PC Optimizer Lavasoft Driver Updater Lavasoft Registry Tuner Lavasoft Privacy Toolbox Lavasoft File Shredder Lavasoft Digital Lock

      For help with these products, contact the support team here: http://www.lavasoft.com/support/supportcenter/
Sign in to follow this  
Followers 0

Trojan Keylogger attack "Vista Antispyware 2012"

3 posts in this topic


My PC (Vista) is infected by a trojan.keylogger.
I'm constantly getting popups from "Vista Antispyware 2012" that my PC is infected by all kinds of malware and directing me to a site where to buy the antivirus ...
Every file I try to open is blocked saying it is infected by the trojan keylocker, also internet explorer. I cannot do anything anymore (i write this from another computer).
I managed to run Ad Aware pro anyway (full scan) but the problem remains after restarting.

What can i do ?? (I'm not a technical person).


Share this post

Link to post
Share on other sites
Hi peterma,

This infection changes settings on your computer so that when you start a program, it will instead start the infection. To fix this you must change a registry settings. From a clean computer, please download the following file and save it to a CD/DVD, external Drive, or USB flash drive.

FixNCR.reg http://download.bleepingcomputer.com/reg/FixNCR.reg

Transfer the CD etc. to the infected computer and double-click the FixNCR.reg file. Let Windows merge its content with the register.
Restart the computer.

Please, download RKill by Grinler to your Desktop:
On the page http://www.bleepingcomputer.com/download/anti-virus/rkill click the link [b]iExplore.exe Download Link[/b] and save it to your desktop.

Turn off your antivirus program and other security programs.
How? See http://www.bleepingcomputer.com/forums/topic114351.html

Double-click on the iExplore.exe icon to start RKill. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step.

If you get a message that RKill is an infection, that is a fake warning given by the infection. The trick is to leave the warning on the screen and then run RKill again.

Run RKill five times.

If you continue having problems running RKill, you can download the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead.

If you need to restart the computer you will have to run RKill again five times.

You should now be able to follow the instructions in the topic [url="http://www.lavasoftsupport.com/index.php?showtopic=30823"]Read This Before You Post![/url].

Share this post

Link to post
Share on other sites
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Thank You !

Share this post

Link to post
Share on other sites
This topic is now closed to further replies.
Sign in to follow this  
Followers 0