Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Truean]

So I noticed my browser was being hijacked, went into task manager and ended the process tree of "ralinkregistrywriter.exe" and only that file. Problem solved.

I know enough to know the thing is probably still floating around somewhere. Who knows where. Unfortunately there are now fake (bad) links to Malwarebytes. Can somebody give me a clean link to it/any other suggestions for avoiding this crap in the future? It isn't like I go a lot of places besides here anyhow.

[Scelly9]

http://www.techspot.com/downloads/4716-malwarebytes-anti-malware.html

Try that link, it's the official one from their website. Try not to download .exe files when they should be PDFs or something, and especially .rar or .zip files.

[Truean]

Thank you. Seems the file itself survived the scan and removal process. I can still just end the process tree in task manager though at least. Would be nice to find it but for some reason it doesn't show up in searches, go figure.

[Scelly9]

Can you right-click the process in task manager and choose open file location? I would suggest trying to exterminate it. As a lawyer, someone accessing your files could be bad.

[Truean]

Can you right-click the process in task manager and choose open file location? I would suggest trying to exterminate it. As a lawyer, someone accessing your files could be bad.

[nods] agreed. Will try.

Edit: Works, sends me to its location. Appears to be in my wireless adapter folder.... Odd.

[MetalSlimeHunt]

Once you've found its program files you should probably go and delete its registry files as well, otherwise it could re-install from them.

[Scelly9]

Edit: Works, sends me to its location. Appears to be in my wireless adapter folder.... Odd.

Not that odd. People are much more likely to leave something alone if it's in a critical part of their computer's files.

Once you've found its program files you should probably go and delete its registry files as well, otherwise it could re-install from them.

Don't try this if you don't know what you are doing. You have a rather high chance of bricking your computer.

[MetalSlimeHunt]

Once you've found its program files you should probably go and delete its registry files as well, otherwise it could re-install from them.

Don't try this if you don't know what you are doing. You have a rather high chance of bricking your computer.

You don't have a high chance of doing that. The only way you could brick your computer like that is by deleting the entire registry.

Hell, I once had most of my registry files corrupted by a particularly nasty piece of malware and managed to fix it without much trouble. There are sites which offer legit registry repair programs.

[miauw62]

Like Combofix.

Not a fake, rogueamp used it in a few of his vids.

[Truean]

Edit: Works, sends me to its location. Appears to be in my wireless adapter folder.... Odd.

Not that odd. People are much more likely to leave something alone if it's in a critical part of their computer's files.

Once you've found its program files you should probably go and delete its registry files as well, otherwise it could re-install from them.

Don't try this if you don't know what you are doing. You have a rather high chance of bricking your computer.

Yeah, that is honestly what I am afraid of. Thankfully, the program seems to be running in the background and no longer must I deal with the browser hijacks. I think Malwarebytes may have solved the problem..... Not sure. [thinks]

[Scelly9]

Programs that run in the background can easily hijack your entire computer. Use regedit to look around in your registry files and find anything with ralinkregistrywriter.exe in it.

[rutsber]

Make sure you back up the registry before you do any changes, just in case you accidentally delete something you didn't want to.

[miauw62]

Did a quick google, apparantly ralink registry writer is a legitimate program, but some malware disguises itself as it.
Its probably in the wireless adapter folder because ralink has something to do with wireless routers.

I hate to nag, but try combofix.
(dont download it from combofix.org tough, download it from here)
more info about combofix.