Windows Repair – rogue. How to remove Windows Repair virus

15 Responses

  1. dein Freund says:

    Super, du hast mir den Tag gerettet!

  2. GeoD says:

    Is it possible the iexplore.exe file is infected with the virus, and is used as the relaunch of Windows Repair?

    I followed your manual instructions to remove Windows Repair, and found that in Safe Mode, it was easy as Windows Repair didn’t run.

    I searched the virus and HD looking for the a file that might be the process file, but didn’t find one.

    When I rebooted XP.SP3 into full mode for the first time, I let it set for a while to see what would happen. Within a short period of time, Windows Repair had regenerated itself.

    The second time I manually removed it, I looked for a process with a more suspicious view, and found that iexplore.exe was loading as a process, even in Safe Mode. I killed it and it came back. I renamed the file to iexplore.sus and it never returned.

    I started as a computer consultant when IE was introduced and have never found an instance of iexplore.exe loading as a process when Internet Explorer was not open, so I suspect iexplore.exe is infected.

    I have been having problems trying to install Outlook after a recent OS re-install – I opted not to install Outlook Express, not knowing Outlook needed it. In trying to install OE after the fact, I had to uninstall IE 6.0, and had reinstalled it, and trying to determine if I had IE 6.0 back to the version equal to XP.SP3 when I was hit with the Windows Repair virus. I’m wondering if IE was missing a security update and was vulnerable. Any thoughts, anyone?


  3. Jessica says:

    Ho un problema Windows repair si è inserito nel mio computer non so che cosa devo fare qualcuno mi puó aiutare spiegandmi in modo chiaro dove devo andare e cosa fare per rimuoverlo?

  4. stephuk says:

    I have done a few scans (both in safe mode with networking and normal mode) and each time it freezes at 49% and I have to manually restart the computer. Could u please help with this, I cant think of anything else to do..

  5. ale says:


    i had a competitor offer which was unable to detetct and remove this horrible malware.


  6. zak says:

    i am attempting to unhide the files and i keep getting a message not resetting system file – C:\Users\my name\ntuser.dat this is followed by 7 other lines starting the same and saying different file names

  7. bob says:

    i did the attrib in console and it is saying access denied to all of the folders. just scrolling through all of the folders saying access denied…. any help?

  8. Mariusz says:


  9. C says:

    My background is stuck on solid colors. Any suggestions? Thx in advance.

  10. Nicki says:

    I keep freezing at 76% what should I do?

  11. Destiny says:

    I’m so glad that the internet awlols free info like this!

  12. When you run the unhide (attrib) command and you can’t get access, you need to do a few thing. Run the command prompt in Admin mode, then if you are still denied access use either Hiren’s mini windows or ERD/DART windows and run this same command.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.