Issue
- Unable to install ESET products
- ESET is not functioning or is giving error messages
- Error communicating with EKRN
- Analysis of application protocols (POP3, HTTP) will not function
- Your ESET product detects the threat Win32/TrojanDownloader.Necurs.A
Details
The Win32/Necurs infection is designed to deny read access to malicious files and is able to run at the kernel level. As a result, this particular malware can sometimes go undetected on a computer running ESET products.
Solution
I. Run the ESETNecursCleaner tool
-
Download and save the .exe file to your Desktop (or your default "Downloads" directory) by clicking the following link:
Download ESET Necurs Cleaner
- Double-click ESETNecursCleaner.exe to run the tool. You must click Agree to agree to the End User License Agreement the first time that you use the tool.
-
If you receive the message "Threat not found—You don't have Win/32Necurs in your system" your computer is not infected with Necurs malware.
If you receive the message "Win32/Necurs found in your system", press Y to confirm that you want to remove the rootkit.
Figure 1-1
Click the image to view larger in new window
- Bookmark this article once cleaning is complete, and then press Y to restart your computer. Use the bookmark to re-open this article after your computer restarts.
Figure 1-2
Click the image to view larger in new window
- Follow the instructions from Part II below to perform a scan that will remove any remaining malicious files.
II. Perform a computer scan
-
Open the main program window of your Windows ESET product.
- Click Computer Scan → Custom scan... and select In-depth scan from the Scan profile drop-down menu.
Figure 2-1
-
Select the check box next to Computer and click Scan. The scan will remove any remnants of the malware still left on your system.
Windows XP users: Select the check box next to My Computer and then click Scan.
Figure 2-2
