Member Avatar for SimonTB473

Hi all,

I was at a customers site today, and had a real interesting one.

He had a browser hijacker/Malware/Virus that had been detected by Avast (or one of the three of four other AV softwares that he had installed and uninstalled in the past weeks). It was presenting annoying advert pop-ups and unwanted extra windows randomly appearing - some looked convincingly like Adobe upates etc.

It is called "ZequitaeKryoniece".

No results on Google Search or others for info on the software, No results on the offending PC with a windows search (including Hidden Folders). No results when running Junkware Removal Tool (JRT), Malwarebytes and ADWCleaner. BUT there it was running as a Windows Service - unknown author and it couldn't be stopped.

It was in C:/Program Files (x86) and could only be found if you used a DOS window to search for it.

It cannot be deleted (access denied on all attempts to delete, change attributes etc.) although my DOS skills are a bit rusty so I'm looking at this now.

However, I did manage to change MSConfig so it won't start at the PC start and deleted all references to it in the Windows Registry and then reset the PC's Web Browsers to not use a proxy server.

Several tests and re-boots seem to show the gremlin is no longer there but I'm worried about leaving a malicious program on a customer PC - even if it is "dormant"

Any ideas ?

Anyone heard of this before ?

  • 3 Contributors
  • 3 Replies
  • 375 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by Rik_

Dani AI

Generated

Practical, forensic-first checklist for 's report of a stubborn service found under Program Files (x86) (detected as a running Windows service and resisting deletion).

Start with evidence collection and identification: capture the file hash and any service/display name before making destructive changes. Example command (run elevated):

certutil -hashfile "C:\Program Files (x86)\ZequitaeKryoniece\sample.exe" SHA256

Use the hash for a sample lookup/submission to multi-engine scanners and to document the case.

If the service is running and cannot be stopped from Services.msc, identify the PID and remove handles before deleting:

sc queryex "ServiceName"
taskkill /PID <PID> /F
sc delete "ServiceName"

If the file is locked by a handle, use Sysinternals tools (Process Explorer / Handle) to find and close the handle, or kill the owning process. After the process is stopped, take ownership and remove restrictive ACLs so files/folders can be deleted:

takeown /F "C:\Program Files (x86)\ZequitaeKryoniece" /R /D Y
icacls "C:\Program Files (x86)\ZequitaeKryoniece" /grant Administrators:F /T
attrib -s -h -r "C:\Program Files (x86)\ZequitaeKryoniece" /S /D
rd /s /q "C:\Program Files (x86)\ZequitaeKryoniece"

If deletion still fails, escalate to an offline environment: boot WinRE/WinPE or a Linux live USB and remove the files and the service registry key under HKLM\SYSTEM\CurrentControlSet\Services\<ServiceName>. Also search for other persistence (scheduled tasks, WMI, drivers, Run keys, browser helpers, LSPs). Reset networking artifacts with netsh winsock reset if proxies or LSP tampering were observed.

Final validation: run offline/rootkit-capable scanners, verify no unexpected outbound connections, and check Autoruns for leftover entries. If uncertainty remains about kernel-mode components or rootkits, reimage the machine — a full reinstall is the only definitive guarantee. Note that and pointed toward AV tools; when those fail, the offline/delete + registry cleanup workflow above and reimaging are the safest escalation paths.

Recommended Answers

All 3 Replies

Member Avatar for rch1231

Hello,

Try Malwarebytes it will ususally remove just about everything. The free version should do the trick. Make sure that you update the virus definitions.

Member Avatar for SimonTB473

Hi rch1231,

malware bytes has already been tried. Didn't work.

The client had, prior to my visit, tried 4 different AV/malware programs. One had found the problem but been unable to remove it.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.