This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

How do i remove a hidden/stealth rootkit?

1 min read

This thread's last reply is from December 17, 2009, 10:37 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Hi,

I now have a problem where my network is constantly running slow to get "page not found" or it keeps disconnecting.

I tried Windows Defender and spybot- nothing could be found. I then used Trojan Remover and it established a suspicious file which was hidden. This was:

C:\Windows\system32\drivers\nacqspn.sys

and the registry:

HKLM\SYSTEM\CurrentControlSet\Services\nacqspn

I tried to delete it or rename it, but TR failed to do it both times.

I then tried other tools like Killbox, Hijack this etc...all cannot delete it.

I get the message, "The device attached to the system is not functioning".

I then downloaded GMER and it confirmed it was a malicious rootkit. But even that could not delete it.

All of these processes have been done normally as well as in SAFE MODE.

I would be very grateful if somebody could offer me some advice on how to get rid of this problem.

Thank you.

Brendan
By posting just a description of your problems it is likely that your topic will be passed by and you will not receive the help you're looking for.

We need to know what's running on your computer so that we can give you appropriate instructions, and this information is provided by a HijackThis log.

This thread will now be closed.

If you still need help, please start a new thread with:-
  • A HijackThis log.
  • Details of the problems you're experiencing.
  • Any messages or error codes you may have got.


If for any reason you can't run HijackThis, please let us know in your post.