I have this serous problem
For the first time I can not stop a program from running.
Something is on one laptop computer that is run as system legacy driver, and self protected and hidden on service as rootkit.
Anything I try to remove fails.
When a program or anti toolkit try to remove the hidden registry setting for make it stop I get this error : "a device attached to the system is not functioning"
So any idea that can help me stop it from running, or even delete it on start up ?
My one limitation is that the hard drive is on a laptop and I can not remove it and attact it to somewhere else.
This program not let me, touch the registry, do not let me touch the file, do not let me touch the file, The move on boot fail to delete it, the rootrepeal fail to delete it, the rootkiet reveal from sysinternals fail to reveal it ! everything fails.
Do how have any experience on this, or do you have any suggestion how to stop this driver from run ?
I have run the windows command mode, try to reveal the rootkit and stop this service from running. Unfortunately this @#@#@#$ think run as system legacy driver and windows xp run it even on command mode.
Then I try to delete this legacy note, but again this think find it and place it again.
Then I try to not give permission to the legacy note to use by the system - (and when reboot with command mode this not run) but some how by pass the security permissions and place again back everything I remove.
This #@#$@#@ program is run with the services.exe, that keeps all the services and every message I get is coming from services. Its monitor for internet connection ever 5 seconds trying to ping a big list of common url (like amazon, msn, etc) and if he see that is connected is starting sending emails....
For the moment I just have place filter/firewall on email port and block the 80 port on service and this works - this @#@#@ think can not by pass the firewall in this version.