0

Hi all,

I was at a customers site today, and had a real interesting one.

He had a browser hijacker/Malware/Virus that had been detected by Avast (or one of the three of four other AV softwares that he had installed and uninstalled in the past weeks). It was presenting annoying advert pop-ups and unwanted extra windows randomly appearing - some looked convincingly like Adobe upates etc.

It is called "ZequitaeKryoniece".

No results on Google Search or others for info on the software, No results on the offending PC with a windows search (including Hidden Folders). No results when running Junkware Removal Tool (JRT), Malwarebytes and ADWCleaner. BUT there it was running as a Windows Service - unknown author and it couldn't be stopped.

It was in C:/Program Files (x86) and could only be found if you used a DOS window to search for it.

It cannot be deleted (access denied on all attempts to delete, change attributes etc.) although my DOS skills are a bit rusty so I'm looking at this now.

However, I did manage to change MSConfig so it won't start at the PC start and deleted all references to it in the Windows Registry and then reset the PC's Web Browsers to not use a proxy server.

Several tests and re-boots seem to show the gremlin is no longer there but I'm worried about leaving a malicious program on a customer PC - even if it is "dormant"

Any ideas ?

Anyone heard of this before ?

3
Contributors
3
Replies
34
Views
2 Years
Discussion Span
Last Post by Rik_
0

Hello,

Try Malwarebytes it will ususally remove just about everything. The free version should do the trick. Make sure that you update the virus definitions.

0

Hi rch1231,

malware bytes has already been tried. Didn't work.

The client had, prior to my visit, tried 4 different AV/malware programs. One had found the problem but been unable to remove it.

This topic has been dead for over six months. Start a new discussion instead.
Have something to contribute to this discussion? Please be thoughtful, detailed and courteous, and be sure to adhere to our posting rules.