Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

difficult zero access type rootkit, cant get rid of it, kills antispyw


  • Please log in to reply

#16
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
ok the attrib command worked and i was able to delete the things above in all except the windows directory. when i ran attrib in windows, got this message: ACCESS DENIED c:\WINDOWS\Listdlls.exe
  • 0

Advertisements


#17
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP
You can run the commands on the individual files:

attrib -r -h -s ezamupag.dll

attrib -r -h -s duitshsn.dll

attrib -r -h -s {2521BB91-29B1-4d7e-9137-AC9875D77735}

Ron
  • 0

#18
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
ok it appears that worked on all the files you mentioned
  • 0

#19
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP
See if you can run the command:

sfc /scannow

it may ask for a CD. IF you don't have it point it to c:\windows and if that doesn't work then just SKIP or CONTINUE until its done.

Then try and boot into Safe Mode and see if you can run Combofix (turn off the antivirus when running Combofix)

IF it won't work run OTL again so I can see what is going on.

Ron
  • 0

#20
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
completed scannow command, then booted into safe mode. after that, cursor won't move with either the track pad or the cursor keys. restarted computer in normal windows mode, still can't move cursor. not sure how to reenable it.
  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP
What make and model is this netbook?
  • 0

#22
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
Asus eee 1000he. Keyboard also disabled. Arrow keys work when in f8 setup area but not on windows welcome screen.
  • 0

#23
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP
Sorry for not getting back to you last night but we had a major power outage.

First try resetting it:

http://support.asus....UNt&os=&no=1717

If the arrows work in F8 are you able to select options? Can you get back into command prompt? If so then:

C:\windows\system32\restore\rstrui.exe

if that works pick the earliest Restore Point available.


Does the keyboard work when you go into CMOS/BIOS setup?

There are three drivers that might be useful but I don't know how you would get them to the PC.

http://support.asus....1000HE&p=20&s=1


1. Intel® Chipset driver
Intel® Chipset driver for Win XP

2. ATK

ACPI Driver
ACPI Driver for Windows XP

3. Touchpad Driver Version 7.0.4.3
1. Enable the support of multi-touch function.
2. Enable the support of mis-touch avoidance function.
  • 0

#24
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
Well, i do have a bootable usb version of xPUD that could potentially allow installation of drivers. What do u think?
  • 0

#25
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP
I'd try it if the reset doesn't work.

Ron
  • 0

Advertisements


#26
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
in f8 i can scroll through the options
i don't have cmd prompt on its own in the list, but there is
safe mode, safe mode w networking, safe mode w command prompt

enable boot logging,enable vga mode, last known good config, directory services restore mode, debugging mode


i picked safe mode w cmd prompt and got a screen full of driver names within the system32/driver folders. after that, windows loaded and i still cant move the cursor.

tried last known good configuration and still cant move cursor.
  • 0

#27
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
ps: when i load xPUD OS from the USB, cursor moves as it should.
  • 0

#28
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP

i picked safe mode w cmd prompt and got a screen full of driver names within the system32/driver folders. after that, windows loaded and i still cant move the cursor.


You don't need a cursor in command prompt. Are you able to type anything?
  • 0

#29
antidotepls

antidotepls

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
even though i selected safe mode w cmd prompt, cmd prompt window never appeared. after the driver names, it went into a black safe mode screen, then windows startup screen appeared.
  • 0

#30
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,002 posts
  • MVP
At the Command Prompt login, If you hit the tab button can you get it to move to the correct login then hit Enter (or type in your password then hit Enter?

Ron
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP