how to remove virus protected by TrustedInstaller?

Question

recently fixed a computer infected with a virus, among the infected files was C:\windows\system32\drivers\zdengine.dll and C:\windows\system32\drivers\zdengine64.dll (which was used to hijack DNS), trying to delete the file normally resulted in "

You need permission from TrustedInstaller to remove this file

So, I tried in Safe Mode, even in Safe Mode I got the same error.

Hence the title. What is the correct way to remove a virus file protected by TrustedInstaller?

(I ended up disabling SecureBoot and boot a Linux live system and deleting the file from there and rebooting, but surely there must be a way to get rid of it without disabling SecureBoot and involving Linux, i guess?)

(PS: To anyone infected with zdengine.dll DNS hijacker and finding this from a google search: after deleting the file, you also have to run netsh winsock reset in cmd to restore normal DNS functionality)

Answer 1

You can stop TrustedInstaller from running then take ownership of the file. To stop TrustedInstaller, open Services, locates Windows Modules Installer, then click Stop.

Go to the file, right-click, then click Properties. Goto the Security tab > Advanced > Owner. Add yourself as the owner, give yourself full control. You should be able to delete the file.

Restart Windows Modules Installer service.