Hello,
I have a PC that is infected with a number of spyware and virus goodies. I have managed to eradicate most of them. There is one that is eluding me however and I am looking for info on how to figure this out. The problem is as follows:
1) I use MSCONFIG to disable all startup applications.
2) I restart the PC and there are several programs re-enabled as well as a new goodie that got put in the startup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run entry. The gem that shows up in there has a random name like xxgfr.exe.
3) I can delete the entry from here and another one shows up.
4) I can stop the process and a new one appears with a different name in its place.
My questions are:
1) How can I figure out which process is monitoring for this process’ death and starting a new one?
2) How can I figure out which process is adding the entry to the registry after I have deleted it?
3) Is there some hook available that lets programs run on shutdown that can put this entry in the registry?
4) Is there a vulnerability in XP that lets a process be created/run that is invisible to the task manager? If so, how can I find it and go after it?
5) Is there a way to hook into XP to see who is writing the registry so I can detect who is doing this?
Thanks in advance.