Zentom System Guard has my registry? bolloxed! December 5th, 2019, 9:04am
Home Calendar Search Register Login
Welcome, Guest. Please login or register.

Computer Q&A Board    Your Input    Questions  ›  Zentom System Guard has my registry? bolloxed!

 Pages: 1
Recommend Print
  Author    Zentom System Guard has my registry? bolloxed!
Posted: October 24th, 2011, 8:49pm Report to Moderator
Guest User

Hi All, One of my computers caught Zentom System Guard from a website I thought was okay and began displaying "System Warning, etc" messages in lower right corner plus all the other phoney stuff. I didn't fall for the "story" but it still loaded me up with .exe files which I have been hunting and deleting (over 20 so far) from the directories and in the registry. I found that the name "Kuerway Tech" was in the description of most of them and that helped somewhat.

However, regedit, process explorer and msconfig wouldn't stay displayed when I tried to use them. I renamed regedit.exe to test1.exe and it works okay and I finally got msconfig going, that let me shut down and then delete one of the bad files in startup.

Anyway, to your knowledge what would the guy probably have used to make these programs display, then exit in less than a second? I figured it was something in the registry, but I'm not knowledgable enough about the many regedit, etc entries to know what is correct and what isn't.

I'm still getting the "System Warning. Spyware protection is disabled. Your personal data is...blah , blah, etc" and when the computer boots it accesses the hard drive much heavier and longer than usual (say 2-3 minutes).

I'm using my laptop to research this so that I won't spread the trojan to my network or to the internet.

Any help or suggestions would be much appreciated. Mike
Posted: October 31st, 2011, 8:49am Report to Moderator
Guest User

   A registry entry itself would not do that unless it is in the startup list or something like that.
   If you do a search for Zentom System Guard, you should find several websites that describe how to remove it.  Here is one of the websites with instructions on how to remove (Click here to go to that website).
e-mail Reply: 1 - 2
Posted: October 31st, 2011, 4:33pm Report to Moderator
Guest User

Hi Ray, Thanks for getting back to me so quickly. I tried several websites like the one you suggested and have already done all they recommended, with no luck.

Anyway, it seems that I have just about cleared all the problems except one major one. The Windows firewall won't start. Error message says "the associated service not running". Then "Start Windows Firewall/Internet Connection Sharing (ICS) service?". Upon entering "yes", I get the error msg "Windows cannot start the service".

I used Services.msc to try and start it but get "Error 2: the system cannot find the file specified". It appears that the file is "C:\Windows\system32\svchost -k netsvcs". Windows Explorer shows the file "svchost" is exactly where it should be and there are 5 other copies of the file running (Process Explorer).

I've even tried "run"ning that command line, but with no success. Somehow the virus has hidden the file (not with attributes) when "-k netsvcs" is specified and I just have to find out how it's done.

Anyway, thank you very much for trying. I'll just keep puttering on this thing til I find the answer. If you should think of anything, let me know. Mike.
e-mail Reply: 2 - 2
 Pages: 1
Recommend Print

Locked Board Board Index    Questions  [ previous | next ] Switch to:

Thread Rating
There is currently no rating for this thread
Forum Rules
You may not post new threads
You may not post replies
You may not post polls
You may not post attachments
HTML is off
Blah Code is on
Smilies are on

Powered by E-Blah Platinum 9.6 © 2001-2006