PC Hell: How to Remove Ping.exe Rootkit

What is Ping.exe virus?

Ping is an internal command within Windows, it normally resides in the c:\windows\system32 directory and is used to test connectivity from the system. However, a rogue antivirus has been known to leave a rootkit with the ping.exe file. When infected, the ping.exe file will take almost 100% of system resources and cause popups and other misc. system instability. If you have recently encountered a rogue antivirus and after removing it your system appears to not be responsive, then you are probably dealing with the Ping.exe rootkit. It infects the hard drive and is virtually undetectable by various anti-malware programs.

How Do You Remove the Ping.exe rootkit?

Step by Step Procedure for Removing Ping.exe Malware

1) Restart Your Computer in Safe Mode (with Networking) by pressing F8 when the computer boots and selecting the appropriate option.

2) Download RKill from Bleeping Computer to your desktop. Double-click on it and run it. This program will try to kill any malicious processes currently running on your system.

3) Now that the computer is somewhat stable, open a web browser and download Malwarebytes Anti-Malware from their site

4) After Malwarebytes has downloaded, install it and try to update it. In one particular occasion, it was unable to update and I had to update it manually. In order to update Malwarebytes manually, you'll need to download the mbam-rules.exe file and run it.

5) Reboot Your Computer

If you are still experiencing a 100% system resource issue with Ping.exe, follow these steps

1) Download TDSSKiller, unzip it, and Save it to your desktop.

2) Double-click on TDSSKiller.exe to run. If the program does not run, you may have to rename it to something like explore.exe, 123.exe, or something else before running it. The virus is trying to block the program from running, so renaming it will in some cases allow it to run.

3) Click on the Start button to start a scan and allow it to completely run

4) Allow TDSSKiller to fix any issues it finds and reboot the computer.

Generally, the steps above will remove the Ping.exe infection and return your system to normal working condition.

In my case, the TDSSKiller found and disinfected the primary hard drive

MBR (0x1B8) (2839639fa37b8353e792a2a30a12ced3) \Device\Harddisk0\DR0
\Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - infected
\Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)

Run a Thorough Virus Scan

Finally, as an extra precaution, scan your computer with online virus scanner like Housecall, BitDefender, or eTrust or download and install an antivirus program and run a complete scan. A list of online scanners is below, some however will only scan but not remove issues.

Online Virus Checkers
Trend Micro Housecall - will scan and remove threats
BitDefender Scan Online - will scan and remove threats
ESet (NOD32) Online Scanner
Kaspersky Online Scan - will scan and remove threats
Panda Activescan - appears to only scan for but not remove threats
McAfee FreeScan - appears to only scan for but not remove threats
eTrust Antivirus Web Scanner - will scan and remove threats
Symantec Security Check - will scan and remove threats
Dr.Web Online Check - user can upload and test for threats on particular files

Trojan Scanner
TrojanScan by WindowsSecurity.com

Spyware Scanners
Malwarebytes AntiMalware
Super AntiSpyware
Spybot Search and Destroy

Congratulations! Your computer should be free of the Ping.exe rootkit!

Search PCHell.com
site search by freefind	advanced

Removal of Ping.exe Virus

What is Ping.exe virus?

How Do You Remove the Ping.exe rootkit?

Step by Step Procedure for Removing Ping.exe Malware

Run a Thorough Virus Scan

Links to Other Important Information