Exterminate It! Antimalware

malpedia

Known threats:700,085 Last Update:March 01, 12:55

Testimonials

I purchased Exterminate It! yesterday, as a last ditch effort from having to scratch load an XP Pro workstation, which was infected with the WOWfx Trojan.

In short, your product eliminated all malware on the system. It was the only commercially available product that not only detected the problems, but eliminated them.

For the record, I attempted using:

The registered versions of Spyware Doctor, XSoft Antispyware, CA Antispyware and the free version of Adaware, which all recognized, but failed to clean my system.

Outstanding product.

IT Manager
Southland Data Processing

Mark A. R.

File: rs.dat

Location of rs.dat and Associated Malware

Check whether rs.dat is present in the following locations:

Windows 2000, Windows XP, Windows Server 2003 specific rs.dat file locations:

  • C:\Documents And Settings\USER_NAME\Application Data\Anti-spyware\rs.dat

Windows Vista, Windows Server 2008, Windows 7, Windows 8 specific rs.dat file locations:

  • C:\Users\USER_NAME\AppData\Roaming\Anti-spyware\rs.dat

If you find rs.dat file in any of these locations, your computer is very likely to be infected with the following malware:

IMPORTANT: Malware files can be camouflaged with the same file names as legitimate files. The rs.dat file is associated with malware only if found in the locations listed above.

Notes:

Different Variations of rs.dat File^

File SizeFile Md5Last Seen
9895CF0383C6BF5A6EFD2F9B62FBCBEAC1Jul 13, 2010
64160D30731D99DC26D9611D55DFD0136A9Jul 13, 2010
151BB3594039ED0CE62713574D8B3D448F4Jul 14, 2010
822206146D65DCC06992541220D5312769Jul 14, 2010
537266C73B1BF4F0DEC7B62962F2A1B98CJul 15, 2010
8172E868FBDB6AC710AB44D2B8192943F0Jul 17, 2010
227B1FEB22756588070E1B586E97865FD03Jul 18, 2010
46A1D0E976CBF80FED4012ED7FF5CF81A5Jul 19, 2010
17D18485315E528E3A0244969BCF400B2DJul 20, 2010
198A81A8D0F707EE6B2F2922D0DDD5B3835Jul 22, 2010
665672ED748FD7C3491C5E169A12F67D696Jul 22, 2010
12295E6F80CA9C5ABF12487FB76CFA040316Jul 23, 2010
1463A6C15F2E731DDA08C9224A7AB5F2129Jul 28, 2010
12761C936EC5ABEF643BB5D0782FCDF46CAJul 29, 2010
43207856E7B24266E3A8851FDA3142AD2A5Jul 29, 2010
3427F8D2054EC2272BBA52F6578DD2DBA1Jul 30, 2010
3294C0CDB207EAC113E37D649F81582759Jul 30, 2010
137E0C3937228119E227FB5272B9F331F35Aug 1, 2010
31B9F4FE898726B62F66F9A371A208B39CAug 4, 2010
99412C3A786CECBCADE502304C26189923Aug 4, 2010
2654F2AA2E962D9F58C4DEB5A0BC5E1D0E1Aug 5, 2010
7651AC95856E36F13161566CD0ED17483F4Aug 7, 2010
59374015B93958A120F7EE622B9B4F1B82Aug 7, 2010
3274328244E0DD08BC07B5B0C35EB515A82Aug 9, 2010
3933EBAAC0268EF9D4786CA67A334CC008BAug 10, 2010
774B8798C0E205EFFEB397263E6A8D01FDAug 10, 2010
1030E9D1D37F8956E9CC59F52DABD6CD5B1Aug 11, 2010
37044BACC5422D99FF7DA93030A7B930028Aug 11, 2010
1616DC335B13A6E7F7030075ABEAB407D0EAug 12, 2010
19704C3CCA815BE96AD4119B917AE0B95F4Aug 15, 2010
7968A16DA3C46E0749F42D2E9AF92045EBAug 17, 2010
166C5207ACDFF56243C2222FF12D704971DAug 17, 2010
63903C16D90B8E06C9C3BEC314D59EF5E7EAug 18, 2010
123499A3C423F2BD3EF6F3F670F99468A08Aug 24, 2010
548B68104333D0EE0292179D501DE817C4EAug 24, 2010
69172BB588344BAC34AEAA26497CC9F3B8Aug 24, 2010
859B848772559162F635F0DB0A95016E80Aug 25, 2010
1718FAAD95F634284B80E08A0E9CF21B421Aug 25, 2010
538F81FF3F1CDFAC154A6FB178091E6371BAug 27, 2010
21EA2926FE3609B6198A24B291F601E42FAug 28, 2010
129EF9725DE9C9ABDF022CD84B4BA0498D3Aug 28, 2010
29EA02CBE82C636C7C72A0107F8AE73F25Aug 28, 2010
63EBB0FCDD87D17941982464847B02D5D1Aug 31, 2010
3204D1083E0D39EB5A2ED408DE868608B2ASep 1, 2010
65D1BA99B04852BAAF525D26155482EE1FSep 1, 2010
147D4B550308E185E36715C76AC09B7295CSep 6, 2010
100BA2151DCE97ECA1E418C8000EC52303ASep 6, 2010
341999195A72716B1BBABD1997B50C5BA34Sep 8, 2010
602DFEDFE178A9C4BFC29022DD3E63B1F9ESep 8, 2010
44C65B8148083EFA1A411749D85A6B8E5BSep 9, 2010
9107B4455713189C6EAA3D3FE08CF089A4Sep 13, 2010
574CDE94E0B3DD3E819760FB3B32D59E3C8Sep 14, 2010
200FD6FC9DE63B5A0931F843B3A3C997F58Sep 15, 2010
32147D858BBDE9316755301CD9D21332AE3Sep 15, 2010
3289A3983C46B1AFC18DC35378C1F45FFA4Sep 19, 2010
597BAD2A8794A20E06CC301A2F9403EE1AESep 21, 2010
133AC3C2231E448F8A0D48D1903DEE0C223Sep 25, 2010
2904A6B2E3B7421E50C4E9EDE3965EB1E1Oct 2, 2010
2466A4849B501FEDF90912695696FE78CDOct 3, 2010
14547FDADE70DBF79F727E549D9795536A69Oct 9, 2010
3868554C0812796482BE9E0B44C20A0A8D6Oct 12, 2010
193C095CDA20C062F0AF382EB5D663D52A4Oct 14, 2010
11683BEE6406EE75E445FD42B5E553B793FOct 14, 2010
7250EEDB409AB1E20110A4DD93BD10134FOct 16, 2010
66CED4E7D073F771ACF9D79EF1C7096C99Oct 16, 2010
913BD4608F32D07B6FC58543900F9BC2A8Oct 18, 2010
1603B67ED00DFC557C31F7CA385258DD624Oct 18, 2010
232C402DDB975848C9AE5ACBEC9272D9F0Oct 21, 2010
41782FDF0A9D9301B2DC698D0A3059A00A6Oct 21, 2010
349557FBD2F4CDD4A2859E68E9075D2AACBOct 22, 2010
23523884FD93C5B3AD8184385F8DE8445D1Oct 26, 2010
1459C5A053C2EE97575E9767BFE03AA8DEEOct 27, 2010
469C938EE22BFC73FE8AAF491C15D4C4C2Oct 27, 2010
309AB56D7DB77B59CC1FFAC2D4762AE31BCOct 28, 2010
109DFC14CA565DF75EA46BBB7F6FAB23D44Oct 29, 2010
468A46F920958B85836D6A26BEAD5EA5B6Oct 29, 2010
18267F33A7C1CC576518FB52272829D0B14Nov 2, 2010
2677E7A2DDA65530F321533231452879527Nov 5, 2010
675A4E8F0CEFB7F7CA75B9B96B80A3568DNov 5, 2010
219664CACFCB2D3C3FBB115C7E3B4FB458Nov 7, 2010
87B73B2D20521834263EC681D1A7DC96DCNov 7, 2010
1879C7205F795C7A5E26C097DABEF989C8ANov 7, 2010
258A94CCF04967B94723E7696CA0F98C1F5Nov 8, 2010
704840FBB1D5F3AC0BD635E661A60CE33A4Nov 8, 2010
278A9A105E66809C96E14A1FF2073703E68Nov 9, 2010
89D6564687021232350B86653ABB219AF7Nov 12, 2010
914B0635A9D7D19467DBA6114ECD162299Nov 16, 2010
459F11739137F6750C8936047BC77E471B7Nov 16, 2010
830A13725ED93129E13BFCAFB332A3F9E5Nov 18, 2010
1120D103B633CF546EEBE0EB248D86033D3Nov 18, 2010
195452B5DCABB41C2703C31EEE4732AFB96Nov 20, 2010
6347CE2B2A912098C3D07E44423820DD3C0Nov 22, 2010
2327B3B048B5DC70BE8C57DC23A5C7041A4Nov 22, 2010
98716223F117678FA390E2B247EF5E2956Nov 28, 2010
16243C29D3D446833F54A3E2BDD3BD89C33Dec 1, 2010
97B4A28FC6DAEAD8D77B4F0B2B26F8FA7CDec 2, 2010
546CA5A65E133682B5F0560B5366B6F389Dec 3, 2010
5046EF1CC4B9DC618EDB5B070C36989B04CDec 3, 2010
86687F219AD6C6FF42906C1FC431CC9281Dec 5, 2010
145B0465957DC8049536A3F3958709F7513Dec 12, 2010
2473F5F80692F00E7E31C2E32BEE08F747Dec 14, 2010
18484DD70B771C776F080764256F220FA5Dec 18, 2010
392A969134F60774CB88B81C97A2CCA7CAEDec 19, 2010
8E07C2AD4767268F2CB15C542296F8FFDDec 20, 2010
159B69C15C17C599EE4011E97B8650F85FDec 23, 2010
45F3C6763A33D9745405F1694130BE9DFBDec 23, 2010
88B6C1378DFD1E6509D955730EA5BA11A4Dec 23, 2010
8AD52ABCD5E054E8E8551D8BC01291366Dec 24, 2010
265B80CC59EB9FDE9156F316DC82EE87A24Dec 27, 2010
550E4AA56497F52D77FB00690FE85C7E15Dec 28, 2010
22DB56BD549C8191DD51886BF0D7E5B8D7Dec 29, 2010
7B6B87887FBA9B794A09719F679B9FEFFJan 1, 2011
680C55DBD5301F36802BCDD23A5DCE655EJan 2, 2011
55F1808E07EC9C4E32129D975145382CDFJan 3, 2011
886B3D83F90D79BB83FC751E8C44CF6C0BJan 5, 2011
3241C4887D41FED088022DB16F61FF2DA64Jan 5, 2011
101DBC3F55EC945B40C0A1F1ED83B741482Jan 9, 2011
1655B07998AFBA1FDDFF844D531DFE3662Jan 9, 2011
78B85B92BC0A2D086B36579BCCEB02F25Jan 9, 2011
36AD0055E0AEE605610FDC8C92CA8E50CCJan 11, 2011
348A0DF4E97F900E8FE4F256FF428C3591Jan 11, 2011
6073C2D747789599E5D47A2403E22CD95BJan 11, 2011
356E95101A058B5AD41C6E13B22F55D30C7Jan 14, 2011
2576D4376BF99984D8DBD8C6811BCD2E00AJan 20, 2011
221EBD4C932EC152E1827ABE5DF22E0DFD7Jan 28, 2011
189C64A4FEA2A81538D70F1B298B28F7E67Jan 30, 2011
33DF5AC944A755A60E2B85B531FEF8FECEFeb 2, 2011
1321B37BCCAA7AA3B49B1C18DD77F3C17F3Feb 8, 2011
9581ABA72645369B96D247C46CDF788275Feb 21, 2011
218BB802CBCC0580BE42FA6A2D75E5B085CFeb 21, 2011
7B6DD3DFAB043D012563DC1349441DDF4Mar 9, 2011
836706AA958E3D2CA176E74CB71B0F6B4Mar 14, 2011
8852846AEF36E8D70DDD467DFE329FDB4Mar 29, 2011
38F1CD0933710F9D45A8057B06F04D68D5Mar 29, 2011
961430D52A9C6B02764622F46AE3E37630Apr 7, 2011
1077CCB5A0A0D37E9EB84B1636B3608934CApr 9, 2011
4285B8439B489AE4218284CACDEBBD9F9Apr 16, 2011
2471D70A17EED8136069A3584E344C016A8Apr 22, 2011
218C973E7E5A837C6D492E5FFE6C62AE757May 2, 2011
55E41C73F7DC8A5E05A3AEE6331C507BFBMay 6, 2011
821D84011F5D6E8023BAE17F674F7B9D0AMay 10, 2011
595F35DD3D8F7C99455E209DA23D4EB0B2Jul 15, 2011
7683A7377173F65A74CAFFDBF38EAB31CEJul 30, 2011
26595302EFDCCECD3A646BCE7CF39451AE4Sep 4, 2011
83C1C2876D7EFE9316743DC0D8F81F345BSep 23, 2011
14504CD46B19DBA0BE0CBFD2E3E3ED1B76Oct 4, 2011
14B7CD34194D263BFA5F2F8050A0BBFF5FOct 14, 2011
152BD41627F1E09EF9FA681F543832BDE6Nov 3, 2011
143650135EBFD212CE5C8D80EFA69186BANov 29, 2011
13560F0BD3E0E86B8B554D6966BDE43C2E2Dec 5, 2011
13AB41D207858F7F08962BAF3CB19D561BDec 14, 2011
2527B53F32B4AAEFC07D068E84736F12A0EJan 1, 2012
53F12183E1BDE118336F40A7404A810FD7Jan 17, 2012
710B8F54D1A4A788C779414FF0D2F04D78Jan 24, 2012
159A3F5A6CEFF951BC73710F13A743831BJan 31, 2012
3956EA1B02DDE19209BE79C690F7012016AFeb 17, 2012
76C3D073BB4FDBB095CDEC7217EB260F8BFeb 21, 2012
30317475034A75F236444B94CBB1CF5F56Mar 21, 2012
555BB405A182FDE1BD224CDACBC439C39FApr 7, 2012
6375DFC80AA46338667E46C73D1E3055ECJul 13, 2012
416FEA7C47ABF413AB4B91BA73D19028C28Jun 14, 2014

Why Is It Important to Remove Malware Files?^

It is imperative that you delete malware-associated files as soon as possible because they can be used - or are already being used - to inflict serious damage on your PC, including:

  • Disrupting the normal functioning of the operating system or rendering it completely useless.
  • Hijacking valuable private information (credit card numbers, passwords, PIN codes, etc.)
  • Directing all your Web searches to the same unwanted or malicious sites.
  • Dramatically slowing down your computer.
  • Gaining total control of your PC to spread viruses and trojans and send out spam.

How to Remove rs.dat^

  1. To enable deleting the rs.dat file, terminate the associated process in the Task Manager as follows:
    • Right-click in the Windows taskbar (a bar that appears along the bottom of the Windows screen) and select Task Manager on the menu.
    • In the Tasks Manager window, click the Processes tab.
    • On the Processes tab, select rs.dat and click End Process.
  2. Using your file explorer, browse to the file using the paths listed in Location of rs.dat and Associated Malware.
  3. Select the file and press SHIFT+Delete on the keyboard.
  4. Click Yes in the confirm deletion dialog box.
  5. Repeat steps 2-4 for each location listed in Location of rs.dat and Associated Malware.
  6. Notes:

    • The deletion of rs.dat will fail if it is locked; that is, it is in use by some application (Windows will display a corresponding message). For instructions on deleting locked files, see Deleting Locked Files.
    • The deletion of rs.dat will fail if your Windows uses the NT File System (NTFS) and you have no write rights for the file. Request your system administrator to grant you write rights for the file.

Deleting Locked Files^

You can delete locked files with the RemoveOnReboot utility. You can install the RemoveOnReboot utility from here.

After you delete a locked file, you need to delete all the references to the file in Windows registry.

To delete a locked file:

  1. Right-click on the file and select Send To -> Remove on Next Reboot on the menu.
  2. Restart your computer.

The file will be deleted on restart.

Note: In the case of complex viruses that can replicate themselves, malware files can reappear in the same locations even after you have deleted those files and restarted your computer. Exterminate It! Antimalware can effectively eradicate such viruses from your computer.

To remove all registry references to a rs.dat malware file:

  1. On the Windows Start menu, click Run.
  2. In the Open box, type regedit and click OK. The Registry Editor window opens.
  3. On the Edit menu, select Find.
  4. In the Find dialog box, type rs.dat. The name of the first found registry value referencing rs.dat is highlighted in the right pane of the Registry Editor window.
  5. Right-click the registry value name and select Delete on the menu.
  6. Click Yes in the Confirm Value Delete dialog box.
  7. To delete all other references to rs.dat, repeat steps 4-6.
IMPORTANT: Malware files can masquerade as legitimate files by using the same file names. To avoid deleting a harmless file, ensure that the Value column for the registry value displays exactly one of the paths listed in Location of rs.dat and Associated Malware.