Member Avatar for markie2003

I found this on my computer and can't seem to get rid of it, or find any thing about it. What do you think?

  • 3 Contributors
  • 7 Replies
  • 88 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

This thread documents a typical persistence case: found an unknown executable that kept reappearing and suggested a deletion tool; the OP later reported success. For readers encountering the same symptom, the immediate goal is twofold — identify the sample and hunt down whatever is recreating it — because deletion alone often leaves a persistence mechanism behind.

To identify the sample, save a copy to removable media and submit it to VirusTotal for vendor detections and family clues. Use Sysinternals tools to find persistence: Autoruns shows Run keys, services, scheduled tasks, driver loads and other auto-start locations, and Process Explorer reveals live handles and parent/child relationships so you can see what process spawns the executable. Run current on-demand scanners (for example, Malwarebytes) and an offline rootkit scan such as if the file keeps coming back.

If traces remain after those steps, create rescue media from a trusted vendor and run full offline scans, or consider a clean OS reinstall when drivers or unknown services persist. Back up personal files only after scanning them, rotate passwords after cleanup, and keep OS and security software patched to prevent reinfection.

Recommended Answers

All 7 Replies

Member Avatar for dlh6213

Doesn't look good; locate the file, right-click on it, select Properties, and post whatever info you can get on it (Company, version, etc.)

Member Avatar for markie2003

Well I found it in C:\windows\system32\jiorzm.exe. No other info available. I tried to delete it. It just keeps rewriting itself. Micro soft anti soft ware caught it and I have it blocked from start up.I still can't get rid of it.

Member Avatar for markie2003

Found more on this bug. Type file application. size 75kb. version . Second , location C\windows\prefetch , 45kb . The rest is unknown.

Member Avatar for dlh6213

Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip

Unzip the file to your desktop.

Go offline until this is completed (you may wish to print these instructions).

Boot into Safe Mode and do a search for jiorzm.exe and delete any instances found.

If any could not be deleted, run Pocket Killbox and paste the full file path in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now?, Click Yes to reboot. (Note: the 'file path' will be something like C:\windows\system32\jiorzm.exe or C\windows\prefetch\jiorzm.exe)

Reboot (normally), empty your Recycle Bin and search for the file again to make sure it's gone.

Member Avatar for markie2003

Sorry it took so long to get back to you. I ran killbox but could not find it any place. I think it is gone. Thanks for your help.

Member Avatar for dlh6213

Glad to hear it; thanks for letting us know.

Member Avatar for crunchie

This thread is now closed. If you need it reopened, please send a PM to one of our Mods.

Include the link to the thread and detail why you need it reopened.

If this is not your thread please start a New Topic.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.