Root Kit Zero Access / Win32 Patched HN Trojan

Silver-Cat

Trying hit man now.
All the ones I tried that shut down now give an error message when I try to run them.
Oops same just happened to hit man. It got hit. Arghhhhhh

dacouch

When you open malware, right click on it and select "Run as administrator"

I followed the bleepingcomputer instructions when I had a problem and it eventually got rid of it

Silver-Cat

everything is now diverting to a website called stopzilla!
I can't open any anti virus . malware now.
they all ran once then closed

RussJK

Perhaps if you list what you've tried, and what the outcome was. Have you tried in safe mode yet?

Silver-Cat

hiya yes I have tried safe mode.
I immediately kill the processes with rkill which gives the below as stopped:
\\.\globalroot\Device\svchost.exe\svchost.exe
C:\Program Files\Kontiki\KHost.exe
C:\Windows\System32\grpconv.exe

I have tried:
hitman pro. ran once, was closed within a few seconds, now when run says windows cannot access the specified device, path or file. you may not have the appropriate permissions to access the file

malware bytes - exactly same result as hitman pro
hijack this exactly the same result as hitman pro

windows defender - finds trojan dropper, quaranteed and the removed. now finds nothing.

most google searches are diverting me to something called stopzilla especially if I use the word virus in the search

RussJK

Oh okay, that's different. As Dacouch said, try right clicking on the files and do 'Run as Administrator'. Also can try CTRL SHIFT ESCAPE (to bring up the task manager, alternatively CTRL ALT DELETE), then choosing File > Run Task.

Did you use the LEFT CONTROL method with Hitmanpro?

RussJK

Try the Gdata one. It's already named similarly to a vital Windows file, so might be able to run.

Alternatively Try installing Malwarebytes with this instead: http://www.users.on.net/~russ/minstall.scr to install it
and if needed, this one to run it once installed http://www.users.on.net/~russ/mrun.scr

RussJK

Also please stop trying Windows Defender. I've never seen it be useful.

Silver-Cat

It ives the same message when I select to run as administrator.
Somethings messed up somewhere.
Internet is very very slow.

RussJK

Alternative Trend link: http://www.users.on.net/~russ/svchost.exe