Windows Forum

Ask something
Question Locked

Okay, security pros, time strut your stuff.

0 helpful
7 replies

by oz_media

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a NASTY case of ZLOB aka Alureon, well my notebook does, not me.

I have managed to scan and find a bunch of registry files and but they progagate the registry as soon as tey are deleted/syste rebooted etc. After cleaning, nothing shows on a safe mdoe scan, but as soon as the system boots normally, it all comes alive again.

There seems to be three or four files noted as rootkit files that don't show up in Windows or from a command prompt, Hidden files are turned on and I've tried using the -s and /a /h commanda from the command prompt, still can't see the files.

So, if I can find out how to delete the following hidden files, I should be okay after a manual reg clean.

Rootkit - HKEY Classes Root>msqpdxvx
Rootkit - HKEY Current User>maqpdxvx
Rootkit - HKEYLM>Software>Classes>msqpdxvx
Rootkit - C:\Windows\System32\msqpdxwqsctmei.dll
Rootkit - C:\Windows\System32\Drivers\msqpdxmbcbcrrx.sys

C:\resycled
D:\resycled (not sure about these two either)

Many many thanks to anyone with any answers to delete these files. Is there a utility that i can use to see, delete them?

Things I've tried: Manual searching in both safe and normal mode for hidden files, using hidden file attributes to find them in CMD prompt. Several scanners (they see stuff but can't delete it0, System restore is OFF.

**********Oh yeah, OS is Win Vista Home Premium*************

7 replies

by oz_media

Unfortunately it seems that I have a variant of teh ZLOB as all the files and processes menione dhere and online on other forums point to entries that don't exist.

As noted in my last post, there are a couple of hidden files i can view in Windows or from CmD prompt as well as a couple of rootkits.

However, one of the other vid links has some comments on root kit editing software that I will try for now.

Any other input is greatly appreciated, like how ot get to these hidden files from CMD or how to dig out these rootkits.

Using Rootkit revealer, I can se ebut not manipulate the files. GRRRRRR! Two full days of this now, starting to lose it!

by ---tk---

booting to a Linux Live CD, and manually removing the files that way.... As long as the program ntfs-g3 works correctly, it should work... or if you install linux on a flash drive, install wine, and edit the registry with in linux... might work too... while your in there I would probably dump the temp file... just incase its hiding in there...

by oz_media

Never really thought of using livelinux to get into Win files. I'm not too bright though, since leaving the network/security world a few years back I realize just how things have changed recently!?

Being a typical dumba$$, I completely forgot that AVG has a free root kit removal tool, the scan is looking pretty good so far, perhaps deleting the roots and then manually cleaning out the reg will do it, or at least kill it off enough that it doesn't take over my life all but a few stray files here and there that will be nixed over time.

I dunno, just thinking in text.

by oz_media

Your efforts got me started, Tig pointed me to kassner and a search for his rootkit articles lead me to AVG rootkit removal tool, and IT WORKED !!!!!

As I said to Tig, TR is the best place inline!

You guys ROCK!, Thank yuo so much for your prompt replies, may you have a safe and very happy holiday with your loved ones close by.

I bow to your excellence!

This discussion is closed to new replies.