More along the lines of malware disinfection

I thought I would ask this considering the level of response I had on the last thread I started, in the hope that someone might suggest a technique for this problem.

When removing malware of one sort or another, I have had the situation quite a few times where a dodgy dll/exe couldn't be removed/renamed in normal or any safe mode, and attempts to remove its links from the registry to stop it from starting result in the malware recreating those links instantly (for example, a bit of malware inserts itself into the winlogon notify list). Normally I will boot off the XP CD to the recovery console and rename the offending file(s) there, however, the Windows XP recovery console does not allow you into the "Documents and Settings" folder (access denied), and I have had it once or twice where a bit of malware is stored inside that directory structure and has full privs on the system.

On one occasion I tried inserting an extra command into the session manager's BootExecute key, just telling it to delete the file in question. Admittedly I was hastily trying multiple strategies, so I don't know whether this particular strategy worked, but I doubt it did since the delete command is stored in cmd.exe. Perhaps a batch file could have done it but I doubt that the BootExecute system would allow commands to spawn other processes.

Anyway, any ideas, as I probably will come up against this scenario again :)


--
Mike Moratz-Coppins
mike@xxxxxxxxxxxxxxxx
http://www.mikeymike.org.uk/

Relevant Pages

  • RE: More along the lines of malware disinfection
    ... When removing malware of one sort or another, ... On one occasion I tried inserting an extra command into the session ... manager's BootExecute key, just telling it to delete the file in ... Admittedly I was hastily trying multiple strategies, ...
    (Focus-Microsoft)
  • Re: Sudden freezes, and bits missing
    ... Yes I have SP2 on cd. ... >> So, either there is some mistake in the command, or alternatively ... > gone through the malware scanning process and when I found that it didn't ... > really consider giving the system a repair installation and loading SP2 ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Sudden freezes, and bits missing
    ... > So, either there is some mistake in the command, or alternatively ... prompt window it would seem to me that there's something even more ... gone through the malware scanning process and when I found that it didn't ... really consider giving the system a repair installation and loading SP2 ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: 8 character limit?
    ... Google on "the program issued a command but the command length is" ... One was a Pace dongle problem.... ... Safe Mode isn't; though it's safer than ... it cannot be counted on to suppress malware. ...
    (microsoft.public.windowsxp.general)
  • Re: When I click my disk drive, it gives me a strange
    ... So I ran the command you told me to and it ran successfully. ... Regedit and msconfig don't seem to be working at all. ... Did you go through the link Gerry provided which is quite extensive, and the links I gave you for malware removal? ...
    (microsoft.public.windowsxp.general)
Quantcast