1 2 Previous Next 12 Replies Latest reply on Apr 12, 2014 2:27 PM by exbrit



      McAfee detected it, removed it, it appeared again.

      I removed it manualy, it appeared again.

      I went into safe mode, shift + del removed it, it appeared again.

      Right now is quaranteened, but I want it gone.

      Help please?

        • 1. Re: iswizard05

          Please try running the Latest Stinger release in Safe Mode/Networking.

          Leave it at the (Default) setting to repair. Follow up with Latest McAfee Rootkit Remover Release in Safe Mode/Networking. You can find these superb tools here:  https://community.mcafee.com/docs/DOC-2168


          (I might add when running McAfee Rootkit Remover, it is best to (Right click to open) and run in Administrator Mode.)


          Please save your downloads of each tool to a Desktop Folder, and close all other applications before Installing/scanning.


          You might wish to Download Malwarebytes Anti-Malware ( Free) Version only.

          Do not accept the (Trial) version or activate the (Pro) Version  The (Free Version) will suffice.

          Update the signatures before running a "Threat Scan"


          You mentioned that it was detected and is now "Quarantined"?

          Have you opened your McAfee Security Center>Navigation>Quarantined/Trusted Items>Delete?


          I hope this helps....






          Message was edited by: catdaddy on 4/11/14 8:40:07 PM CDT
          • 2. Re: iswizard05

            Where. ie in what folder is the file being detected and what name of file?








            on 12/04/14 7:07:35 EDT AM
            • 3. Re: iswizard05

              It's another toolbar I believe, for some registry cleaner or the like, and you probably downloaded it as an option (that you missed) with something else.  Always be very careful downloading.


              Run Malwarebytes Free, and maybe AdwCleaner and Junkware Removal Tool, all linked in the last link in my signature below.


              Btw, never use registry cleaners, they destroy your system eventually.


              If something keeps recurring you have to think where it could be, probably on something connected to your machine or in System Restore.


              So scan anything attached and as a last resort you could try temporarily disabling System Restore.

              • 4. Re: iswizard05

                Excellent Points.....I myself was thinking along the lines of it possibly being associated with the Baidu,Hao123,or the nasty Conduit Toolbar variants?


                Message was edited by: catdaddy on 4/12/14 6:23:55 AM CDT
                • 5. Re: iswizard05

                  Earlier incarnations of this apparently were identified as possible rootkits or Bitcoin Miners so it might be an idea to run RootkitRemover too and, as a precaution, look at the lower part of my last link and follow the Hijackthis advice.

                  Those specialist malware removal forums can work wonders.

                  • 6. Re: iswizard05

                    Once again, I totally agree. The OP may play close attention as to how the scan is run, mentioned in my post above. He can also read the "How to use" info supplied when obtaining the Tool.


                    These Days-Times it could almost be anything. Having said this...As we always suggest. Be very careful in what you Download/install. So many times it is most definitely "Bundled" with something.


                    Gotta Go....It is (Beautiful) outside today !

                    • 7. Re: iswizard05

                      iswizard05 is malware whose main (but not necessarily only) purpose is to hijack your machine's CPU/GPU processing power to work on cracking a mathematical puzzle in order to generate income for someone else. Not quite accurate, maybe, but close enough. That's Bitcoin mining.


                      The program is in one of the temp folders and in theory should be easy enough to remove using CCleaner (Free version). However, if it keeps reappearing then there are probably entries in the registry or in Task Scheduler to keep re-installing it after you delete it - which means either re-download it from somewhere on the internet or re-copy it from a hidden location.


                      Try deleting the temp files first, and see what happens. Two of the files (and running processes) to look for are dwm.exe and indexer.exe - so if you want to find out where they're stored, and what else is in there along with them, do a Search for "dwm.exe". As a matter of interest, I'd like to know what those other files are : especially to know if there's a file called "Rar$EXa0.595".


                      Running AdwCleaner and Malwarebytes Free should get rid of this, although some variants try to disable Malwarebytes.



                      http://blog.malwarebytes.org/fraud-scam/2013/11/potentially-unwanted-miners-tool bar-peddlers-use-your-system-to-make-btc/


                      • 8. Re: iswizard05

                        This is why I suggested that the OP run Malwarebytes (Free) in SafeMode/Networking, or Safemode itself.

                        Which in itself quite possibly refrains the "Active" malware from loading modules/drivers that would prohibit

                        Malwarebytes  from proceeding to remove such infection.


                        Although The Free Version lacks the "Chameleon" implementation, by running in above mentioned , It should assist Malwarebytes from having difficulty removing the here-in mentioned Malware.

                        • 9. Re: iswizard05

                          I've run all the cleaning applications suggested here (Stinger, Rootkit, AdwCleaner, Malwarebites, CCleaner, JunkwareRemoval) and none of them even detects the iswizard05.

                          1 2 Previous Next