gwilks98

I was cleaning off someone's computer (massive infection) and I got everything off the machine, except for the hole that's responsible for it all.

I think I've traced it down to some registry values under HKLM>CurrentControlSet, (as confirmed by spybot) but nothing can get rid of these keys. I can't even manually delete them in safe mode.

All virus and spyware scans confirm the problem, but are unable to remove the threat.

The only think I can think of is that he's got some rootkit on there, but I'm not good enough with rootkit revealer to be able to tell for sure.

Anyone have any expierence with this?

__________________
"I know the pieces fit, cause I watched them fall away."

"Cold silence has
A tendancy to
Atrophy any
Sense of compassion."

MJK

Jeffbx

You need the ultimate boot CD for XP:

http://www.ubcd4win.com/

You can boot & run XP off of the CD, and then do whatever you want to the registry on the C:\ drive

Markel

I have had some customers that ended up with registry corruption that prevented them from deleting certain keys (that had to do with our software). Their problem ended up being corruption in the permissions (via regedt32). Seems that there was nothing that could be done to remedy it (short of reinstalling the OS).

__________________
stay low... keep moving...

mechmike0034

http://forums.gotapex.com/showthread.php?t=98404

Has a permissions repair tool:

http://wiki.djlizard.net/Dial-a-fix_...tration_errors

__________________
"The price of progress is trouble." (C. F. "Boss" Kettering)
"50% of the American public has below-average intelligence. 70% of the American public now has regular access to the Internet. Do the math." (unknown)

gwilks98

I'll give these suggestions a try and get back to you guys. Thanks.