Question Need help permanently removing explorer.exe (WR64.SYS) virus ?

Jul 14, 2022
1
0
10
So everytime I open up my pc my CPU is running at 100% usage and it goes back down to just a few percent whenever I open up task manager (so a virus that hides itself is what that is surely).
The process causing this is Explorer.exe and I've found that if I can go go to the details of that process fast enough and "end the process tree" the problem goes away but remains after a pc restart
I was also searching the internet and found out that there is a file on my pc in "AppData\Roaming\Microsoft\libs" called "WR64.SYS" that also gets restored every time I restart my computer after removing it and maybe has something to do with the Explorer thing but not sure

Malwarebytes just detects the WR64.SYS file and removes it but as I said it is there again after a restart
HitmanPro scan shows the WR64.SYS file as well
Mbar sadly finds nothing

Wondering if anyone has any experience with this and has a way of actually removing the virus somehow without reinstalling windows 10

Thanks to anyone that might have something
 

USAFRet

Titan
Moderator
This is specifically the other part of what good backups are for.

Physical drive fail is one.
Nasty virus is the other.

45 minutes of recovering a full drive backup made before this system got infected.

3 options:
  1. Recovery from a full drive backup. But if you had that, we wouldn't be having this discussion
  2. System Restore point? Does one exist?
  3. Full wipe and reinstall. And don't download whatever gave you this virus.