1

recently fixed a computer infected with a virus, among the infected files was C:\windows\system32\drivers\zdengine.dll and C:\windows\system32\drivers\zdengine64.dll (which was used to hijack DNS), trying to delete the file normally resulted in "

You need permission from TrustedInstaller to remove this file

So, I tried in Safe Mode, even in Safe Mode I got the same error.

Hence the title. What is the correct way to remove a virus file protected by TrustedInstaller?

(I ended up disabling SecureBoot and boot a Linux live system and deleting the file from there and rebooting, but surely there must be a way to get rid of it without disabling SecureBoot and involving Linux, i guess?)

(PS: To anyone infected with zdengine.dll DNS hijacker and finding this from a google search: after deleting the file, you also have to run netsh winsock reset in cmd to restore normal DNS functionality)

3

You can stop TrustedInstaller from running then take ownership of the file. To stop TrustedInstaller, open Services, locates Windows Modules Installer, then click Stop.

Go to the file, right-click, then click Properties. Goto the Security tab > Advanced > Owner. Add yourself as the owner, give yourself full control. You should be able to delete the file.

Restart Windows Modules Installer service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.