How to Remove "download.tmp" Virus from Infected PC?

You have a virus or malware that keeps coming as "download.tmp"? This keeps showing up requesting an outgoing connection from your firewall, every hour (on the hour I think)? Please don’t worry. This post may help you resolve it.

What is "download.tmp"?

Program: download.tmp
Remote Address: mtpool117.penguinwear.net http
Path: C:\Users\Vyn\AppData\Local\Temp...\download.tmp

"download.tmp" is a high risk computer worm which can mutate itself to spread widely and seriously damage the infected computer system, leaving the computer usable. It is often embedded onto some programs or software or deployed into the spam email attachments. It can also invade a computer by taking good advantage of the vulnerability of Internet, especially the Local Area Network. Once you download and install the infected files or programs to your computer, this risky worm will sneak into your computer and start damaging your computer.

"download.tmp" can change your important settings to mess up your computer. As it changes your browser settings, you will find your browser homepage and search engine replaced by the suspected ones. And you can also find many pop-up ads when you are browsing the web. What’s worse, this worm virus can even damage your firewall protection and allow the remote hackers to access and control your computer. As a result, your confidential data and even financial information will be stolen by the hackers. Therefore, you should try your best to remove "download.tmp" virus.

How to Remove "download.tmp" Virus?

Guide 1: Manually Remove “download.tmp” by Yourself
Guide 2: Automatically Remove “download.tmp” with SpyHunter

Guide 1: Manually Remove “download.tmp” by Yourself

Step 1. Restart your computer in Safe mode.

Keep tabbing F8 key before the Windows start-up logo appears until you get to Advanced Options, select Safe Mode, and hit ENTER.



Step 2. End up the trojan processes in Windows Task Manager.

Press Ctrl+Shift+Esc or Ctrl+Alt+Delete to open Windows Task Manager, find malicious processes and click End process.



Random.exe

Step 3. Navigate to Registry Editor and clean up all “download.tmp” registry entries.

Press Win+ R key at and same time to open Run Commend Box. Open Registry Editor by typing “regedit” in Runbox and clicking OK.



Look through the registry entries and find out all listed harmful items. Right click on them and terminate the related entries.



HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "<random>" = "%AppData%\<random>.exe"
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "<random>" = "%AppData%\<random>.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments "SaveZoneInformation"=1
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%AppData%\<random>.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe "Debugger"="svchost.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe

Step 4. Show hidden folders and files.

Windows XP

Start button > Control Panel > Appearance and Personalization > Folder Options > Show Hidden Files or Folders



Remove the checkmark from Hide extensions for known file types. And remove the checkmark from Hide protected operating system files (Recommended).

Windows 7 / Vista

Libraries > Folder Options > Tools > Show Hidden Files or Folders




Remove the checkmark from Hide extensions for known file types and Hide protected operating system files (Recommended)

Windows 8 /8.1

Windows Explorer > View > Hidden Items



Delete “download.tmp” Virus associated files.

%UserProfile%\Application Data\Microsoft\[random].exe
%System Root%\Samples
%User Profile%\Local Settings\Temp
%AppData%\<random>.exe
%CommonAppData%\<random>.exe
C:\Windows\Temp\<random>.exe
%temp%\<random>.exe
C:\Program Files\<random>
C:\ProgramData\[random numbers]\

Step 5 Restore your browser 

Internet Explorer

Open Internet Explorer, then click on the gear icon (Tools for Windows XP users) at the top (far right), then select Manage add-ons.

 Navigate to Search Providers, remove S.yimg.com from the list and enable the one you want.

Follow the pictures below to get back your Home Page. If you fail to remove this website, you can reset your browser settings.

Delete random URL in the homepage box and type in www.google.com or other.

Mozilla Firefox

Open Firefox, simultaneously tap Alt+T keys and select Options. Click the General tab and move to the Home Page. Type in www.google.com or other. and click OK.

Open Firefox, press Alt + H, and select Troubleshooting Information > Refresh...

Google Chrome

Click on the Customize icon(wrench or 3 bar icon) next to the address bar. Select Settings from the drop-down list and then navigate to  Search > Manage search engines…Click X on the URL of the search tool you want to remove. Click Done.

Find Show advanced settings...and then go to Reset settings.

 

Step 6. Remove leftover and speed up your PC.

You can download and install RegCure Pro to speed up and optimize your PC. It is packed with the tools you need to boost your PC's speed and performance.

• Clean away Windows registry errors
• Eject active viruses, spyware and other malware
• Stop unneeded processes 
• Delete startup items
• Delete privacy files

Click the icon to download RegCure Pro.

Guide 2: Automatically Remove “download.tmp” with Powerful Removal Tool

SpyHunter is an adaptive real-time spyware detection and removal tool. It  can help you remove Rogue:JS/FakeCall.D and all the threats in your PC. It will never bundle with any programs and can get along with existing security programs without any conflicts. Please feel relieved about usage.

Click the download button below to get SpyHunter

After detecting all the threats in your system, you can click on “Fix Threats” to remove them.



Warm Reminder:

SpyHunter is a powerful real-time malware protection & malware removal tool for inexperience computer user. It can help you remove all the detected threats automatically. So all you need to do is install it for immediate and ongoing protection.