Re: kZObaV.exe

From: Bigbruva (Richardh_at_dontusethis.ws)
Date: 01/28/05


Date: Thu, 27 Jan 2005 19:03:04 -0800

You are unlikely to find a match to this file name as this looks very much
like a random file name generated to help hide the true identity of the
malware. Have you tried booting into Safe mode (press F8 during a reboot)
and doing the scans from there?

If not, try this and see if the scanners are able to remove the malware.

Let us know how you get on.

BB

"RipperT" <RipperT@discussions.microsoft.com> wrote in message
news:53ABEBD8-C77A-4F90-BF9F-4BA27D3E0D83@microsoft.com...
> Hello all,
> I have two instances of a running process called kZObaV.exe. The path,
> according to HijackThis, is C:\Windows\System32\kZObaV.exe. I cannot find
> it
> in that folder. Running a search does not find it. I cannot end it's
> process
> from task manager. I have updated and run: McAfee Anti-virus, Adaware,
> Spybot, CWSShredder, HijackThis and run an online virus scan,
> (TrendMicro's
> Housecall). HijackThis is the only program that found it and I attempted
> to
> 'fix' it through HijackThis, but it just won't budge. I have deleted every
> instance of it from the registry. Its still there. Googling it returns
> nothing so I can't find any info on it. Anybody seen it before or have any
> ideas?
>
> Thanx,
>
> RipperT