Hi All, One of my computers caught Zentom System Guard from a website I thought was okay and began displaying "System Warning, etc" messages in lower right corner plus all the other phoney stuff. I didn't fall for the "story" but it still loaded me up with .exe files which I have been hunting and deleting (over 20 so far) from the directories and in the registry. I found that the name "Kuerway Tech" was in the description of most of them and that helped somewhat.
However, regedit, process explorer and msconfig wouldn't stay displayed when I tried to use them. I renamed regedit.exe to test1.exe and it works okay and I finally got msconfig going, that let me shut down and then delete one of the bad files in startup.
Anyway, to your knowledge what would the guy probably have used to make these programs display, then exit in less than a second? I figured it was something in the registry, but I'm not knowledgable enough about the many regedit, etc entries to know what is correct and what isn't.
I'm still getting the "System Warning. Spyware protection is disabled. Your personal data is...blah , blah, etc" and when the computer boots it accesses the hard drive much heavier and longer than usual (say 2-3 minutes).
I'm using my laptop to research this so that I won't spread the trojan to my network or to the internet.
Any help or suggestions would be much appreciated. Mike
Posted: October 31st, 2011, 8:49am
A registry entry itself would not do that unless it is in the startup list or something like that. If you do a search for Zentom System Guard, you should find several websites that describe how to remove it. Here is one of the websites with instructions on how to remove (Click here to go to that website).
Hi Ray, Thanks for getting back to me so quickly. I tried several websites like the one you suggested and have already done all they recommended, with no luck.
Anyway, it seems that I have just about cleared all the problems except one major one. The Windows firewall won't start. Error message says "the associated service not running". Then "Start Windows Firewall/Internet Connection Sharing (ICS) service?". Upon entering "yes", I get the error msg "Windows cannot start the service".
I used Services.msc to try and start it but get "Error 2: the system cannot find the file specified". It appears that the file is "C:\Windows\system32\svchost -k netsvcs". Windows Explorer shows the file "svchost" is exactly where it should be and there are 5 other copies of the file running (Process Explorer).
I've even tried "run"ning that command line, but with no success. Somehow the virus has hidden the file (not with attributes) when "-k netsvcs" is specified and I just have to find out how it's done.
Anyway, thank you very much for trying. I'll just keep puttering on this thing til I find the answer. If you should think of anything, let me know. Mike.