I have a NASTY case of ZLOB aka Alureon, well my notebook does, not me.
I have managed to scan and find a bunch of registry files and but they progagate the registry as soon as tey are deleted/syste rebooted etc. After cleaning, nothing shows on a safe mdoe scan, but as soon as the system boots normally, it all comes alive again.
There seems to be three or four files noted as rootkit files that don’t show up in Windows or from a command prompt, Hidden files are turned on and I’ve tried using the -s and /a /h commanda from the command prompt, still can’t see the files.
So, if I can find out how to delete the following hidden files, I should be okay after a manual reg clean.
Rootkit – HKEY Classes Root>msqpdxvx
Rootkit – HKEY Current User>maqpdxvx
Rootkit – HKEYLM>Software>Classes>msqpdxvx
Rootkit – C:\Windows\System32\msqpdxwqsctmei.dll
Rootkit – C:\Windows\System32\Drivers\msqpdxmbcbcrrx.sys
C:\resycled
D:\resycled (not sure about these two either)
Many many thanks to anyone with any answers to delete these files. Is there a utility that i can use to see, delete them?
Things I’ve tried: Manual searching in both safe and normal mode for hidden files, using hidden file attributes to find them in CMD prompt. Several scanners (they see stuff but can’t delete it0, System restore is OFF.
**********Oh yeah, OS is Win Vista Home Premium*************
