Malware That Recreates Itself

[Guest]

[naren]

During my testing I come accross malware which I cannot cleanup with anything. They recreate themselves.

I try to delete them through CCE autorun, regedit, MBAM, Hitman, etc but they recreate themselves.

Atlast I have to do CTM restore which has been always successful here.

How to delete those malware?

[SivaSuresh]

Dear,

You just described your problem but gave absolutely no useful information .

Please provide required information like the malware name, it's position, possible source, nature of infection. How do you know that it is a malware ? Did any of the above tools named it as malware ? What was the name given ?

Did you try a bootable rescue disk like Kaspersky Rescue Disk or Dr. Web CureIt or Comodo Rescue disk ?

[naren]

I know I can clean/delete many malware by downloading specific removal tools, etc. And since its a test system I restore with CTM instead of trying rescue discs.

What I meant was manual removal. Like HitmanPro found the malware & asked to reboot to remove it completely but after reboot the malware created itself again & HitmanPro again founds it if the scan is run again. So I can download specific tools for the malware if available & remove it.

But I meant scanners, cce, etc shows the malware location, etc so how to remove it manually. Coz even after going to the location & deleting it recreates itself.

[Grosbébé]

Hello

You just described your problem but gave absolutely no useful information .

Please provide required information like the malware name, it's position, possible source, nature of infection. How do you know that it is a malware ? Did any of the above tools named it as malware ? What was the name given ?

If you want to manually remove a malware, you need to follow a specific strategy. This strategy is not the same if you want to remove a file infector or if you want to remove something like ZAccess.
So we can't answer your question if we don't know which malware is detected.

Regards

[naren]

OK. Understood. Thanxx Replying.

Regards
Naren

[EricJH]

It sounds like the malware has one or more helpers. Does the malware file show up in Killswitch and does it have parents or siblings? Try suspending the file(s) before terminating and erasing them.

Are there suspicious drivers or services?

[Tags:]