This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

manual cleanup of memory infection?

Hi there,

Whilst Sophos is able to quarantine and "cleanup" infections such as .exe's, .dll's and .htm i've unfortunately been infected with a Troj/ZbotMem-A that resides within my memory. Sophos suggests a manual removal, and whilst i've managed to manually remove items Sophos has not been able to remove itself before, I am not entirely sure how to clean my memory or the infected "explorer.exe" in my system files without causing collateral damage.

As a university student using sophos on a desktop i don't exactly have a system administrator to turn to.

Sophos lists this as a low threat, but symantec lists the damage as high, and currently sophos is running well into over 2 thousand cleaned/removed infected files.

Also what worried me is that the virus/trojan has gotten to my registry as well so i imagine it's going to perform some nasty business on startup too. What was also worrying was that Windows Firewall blocked an attempting breach of security that tried to come through my media player. I suppose it still got onto my system though...

I guess i should end this post already so i can get some responses about this little devil.

Grahame.

:5376


This thread was automatically locked due to age.
Parents
  • Thanks for the speedy and informative reply.

    I've managed to reduce the infection spread from the thousands to just tens, but i can't seem to remove the original source from the memory. After restarting the computer (when the physical infection seems to be braught to a hault) the same original infection remains present in the memory. Perhaps sophos simply isn't finding what's allowing the infection to come back...

    Reading the article, it appears that a safe mode boot allows a more thorough scan?

    :5379
Reply
  • Thanks for the speedy and informative reply.

    I've managed to reduce the infection spread from the thousands to just tens, but i can't seem to remove the original source from the memory. After restarting the computer (when the physical infection seems to be braught to a hault) the same original infection remains present in the memory. Perhaps sophos simply isn't finding what's allowing the infection to come back...

    Reading the article, it appears that a safe mode boot allows a more thorough scan?

    :5379
Children
No Data