[KB3157] How do I remove Win32/Goblin malware?

• Your ESET product detects the threat Win32/Goblin, Win32/Goblin.C.Gen or Win32/Goblin.e.gen.
   

1. Click the link below to download the ESETGoblinCleaner tool. Save the file to your Desktop:
   
   ESETGoblinCleaner.exe
    
2. Click Start → All Programs → Accessories → Command Prompt.
   • Windows 8 users: Press Windows key + F to search, click Apps, enter Command Prompt into the search bar and then click Command Prompt.
      
3. Type the command cd %userprofile%Desktop (do not replace "userprofile" with your username–type the command exactly as shown) and then press Enter.
    
4. Enter the command: ESETGoblinCleaner.exe followed by the path or file you want to scan. For example, the following will scan the entire C drive: ESETGoblinCleaner.exe C:.
   • You can add the string >usernameDesktopGoblinLog.txt after the path or file you want to scan to have the ESETGoblinCleaner tool record a log file of the scan and save it to your desktop. For example: ESETGoblinCleaner.exe C: > %username%DesktopGoblinLog.txt
5. Once the cleaner is done scanning all specified files/folders, it will display scan results in the command prompt (see Figure 1-1).

Figure 1-1

6. Open the main program window of your Windows ESET product.
    
7. Click Computer Scan → Custom scan and select In-depth scan from the Scan profile drop-down menu.

Figure 1-2

8. Select the check box next to Computer and click Scan. The scan will remove any remnants of the malware still left on your system.
   
   Windows XP users: Select the check box next to My Computer and then click Scan.

Figure 1-3

Need further assistance? Contact ESET Technical Support.