MR APP Rootkit - how can I remove it?

Jo4

My anti virus, Avast, found MR APP in my program files folder and displayed the following message "A suspicious hidden object (rootkit) has been detected on your system. This may be a sign of a malware infection. It is recommended to remove the object immediately." It then gives the option to delete now but it cannot get it deleted despite numerous attempts. I have Googled MR APP but I cannot find anything relevant.

Can anyone tell me how I can remove this please?

GunJack

first, set avast to do a boot time scan (i.e. it will scan before most of windows loads up) it takes a while, but once set, reboot the pc and let it do..

also, mbam in safe mode should pick up elements.

if still present after these, try GMER rootkit remover or avast mbr scanner (aswmbr). Combofix may be a last resort, but sometimes you just can't get the little beggars and a reinstall may be required

Jo4

GunJack wrote: »

first, set avast to do a boot time scan (i.e. it will scan before most of windows loads up) it takes a while, but once set, reboot the pc and let it do..

also, mbam in safe mode should pick up elements.

if still present after these, try GMER rootkit remover or avast mbr scanner (aswmbr). Combofix may be a last resort, but sometimes you just can't get the little beggars and a reinstall may be required

Thanks!!

Avast did a boot time scan but it wasn't able to remove it.

Gillor

As GunJack said , be prepared for a re-install.

Rootkits can be are notoriusly difficult to remove as they burrow deep into your system and even when you think you have removed everything you can never be sure.

However there are several things you can try. GMER is one but you almost need a degree in computer sciences to interpret it's results.

Others are TDSS Killer, Norton Power Eraser, Malwarebytes Anti-Rootkit and Dr. Web Cure-It.

Run them all and if everything then looks ok follow up by scanning with something like Emsisoft Emergency Kit and ESET Online Scanner and then clear any recent system restore points.

However if you use your computer for online banking and suchlike I would personally go for a re-install.

waddler_8

What's the exact filename & location?

eg: C:\directory\folder\subfolder\filename.ext

With it being found in your program files folder I'd initially suspect a false positive.

"A suspicious hidden object (rootkit) has been detected on your system. This may be a sign of a malware infection. It is recommended to remove the object immediately."

Jo4

waddler_8 wrote: »

What's the exact filename & location?

eg: C:\directory\folder\subfolder\filename.ext

With it being found in your program files folder I'd initially suspect a false positive.

"A suspicious hidden object (rootkit) has been detected on your system. This may be a sign of a malware infection. It is recommended to remove the object immediately."

C:\Program Files\MR APP

It was downloaded on Sunday night apparently and I wasn't trying to download anything. I cannot even remember what I was doing online because I have been unwell for a few days.

dogmaryxx

Is https://www.e-rewards.com present in your add/remove programmes?

installation folder: C:\Program Files\mr app

http://www.shouldiremoveit.com/e-Rewards-Notify-42442-program.aspx

System

Hi

I would try sysinternals (but it may not suit your OS), the link may help...

http://technet.microsoft.com/en-gb/sysinternals/bb897445

paddyrg

Rootkits are hardcore - effectively they're more in control of your computer than you are. They've hidden deep inside for a reason. They may have held the doors open for other malware (remember antivirus are far, far from complete protection.

Personally, I'd be inclined to flatten and rebuild so at least you know it's good, otherwise it's like catching your Mrs cheating - trust is gone and you're never truly certain whether or not you can rebuild a relationship involving online banking with that niggling doubt

Jo4

dogmaryxx wrote: »

Is www.e-rewards.com present in your add/remove programmes?

installation folder: C:\Program Files\mr app

http://www.shouldiremoveit.com/e-Rewards-Notify-42442-program.aspx

www.e-rewards.com is not present in my add/remove programs.

Jo4

dogmaryxx wrote: »

Is www.e-rewards.com present in your add/remove programmes?

installation folder: C:\Program Files\mr app

http://www.shouldiremoveit.com/e-Rewards-Notify-42442-program.aspx

Trying http://www.shouldiremoveit.com/e-Rewards-Notify-42442-program.aspx now so fingers crossed it works.