[KB3157] How do I remove Win32/Goblin malware?



  1. Click the link below to download the ESETGoblinCleaner tool. Save the file to your Desktop:

  2. Click Start All ProgramsAccessoriesCommand Prompt.
    • Windows 8 users: Press Windows key + F to search, click Apps, enter Command Prompt into the search bar and then click Command Prompt.
  3. Type the command cd %userprofile%Desktop (do not replace "userprofile" with your username–type the command exactly as shown) and then press Enter.
  4. Enter the command: ESETGoblinCleaner.exe followed by the path or file you want to scan. For example, the following will scan the entire C drive: ESETGoblinCleaner.exe C:.
    • You can add the string >usernameDesktopGoblinLog.txt after the path or file you want to scan to have the ESETGoblinCleaner tool record a log file of the scan and save it to your desktop. For example: ESETGoblinCleaner.exe C: > %username%DesktopGoblinLog.txt
  5. Once the cleaner is done scanning all specified files/folders, it will display scan results in the command prompt (see Figure 1-1).

Figure 1-1

  1. Open the main program window of your Windows ESET product.
  2. Click Computer Scan → Custom scan and select In-depth scan from the Scan profile drop-down menu.

Figure 1-2

  1. Select the check box next to Computer and click Scan. The scan will remove any remnants of the malware still left on your system.

    Windows XP users: Select the check box next to My Computer and then click Scan.

Figure 1-3

Contact ESET Technical Support.

Need Assistance in North America?

If you are a North American ESET customer and need assistance, visit helpus.eset.com to chat with a live technician, view product documentation or schedule a consultation with an ESET Home Advisor.