Comments on: Zlob (Trojan.Zlob) Removal Instructions http://www.xp-vista.com/spyware-removal/zlob-removal-instructions Your Ultimate Source for Windows Security Fri, 20 Nov 2009 02:55:09 -0500 http://wordpress.org/?v=2.8.4 hourly 1 By: Thomas http://www.xp-vista.com/spyware-removal/zlob-removal-instructions/comment-page-1#comment-19603 Thomas Mon, 15 Dec 2008 16:38:09 +0000 http://www.xp-vista.com/forums/other/zlob-removal-instructions#comment-19603 my comp have Trojan.Zlob.G but my firewall cannot block it then what i need to do?? my comp have Trojan.Zlob.G but my firewall cannot block it then what i need to do??

]]> By: Omegamon http://www.xp-vista.com/spyware-removal/zlob-removal-instructions/comment-page-1#comment-19473 Omegamon Fri, 12 Dec 2008 00:14:57 +0000 http://www.xp-vista.com/forums/other/zlob-removal-instructions#comment-19473 I have Trojan.Zlob.G and it does nothing to my computer, because my firewall stops it from working, but i can't locate the file in any way. I have Trojan.Zlob.G and it does nothing to my computer, because my firewall stops it from working, but i can’t locate the file in any way.

]]> By: Wally C http://www.xp-vista.com/spyware-removal/zlob-removal-instructions/comment-page-1#comment-18798 Wally C Wed, 12 Nov 2008 04:15:00 +0000 http://www.xp-vista.com/forums/other/zlob-removal-instructions#comment-18798 I too found I had downloaded a fake codec and now it's putting lots of desktop.ini's in most of my folders. This causes boot.com to be reloaded everytime I open the folder. I feel very stupid because I'm a programmer by profession. The solution? It's not easy to do. I've found two pieces of FREE software from sysinternals (you can download them free from the Microsoft developer network website). The firts is called 'Process Explorer'. This shows ALL processes (programs) running on your machine - even the ones that are 'hidden'. It also allows you to kill them - but depending on what you kill you can either cause your machine to crash or if you kill the trojan but don't kill the root then it will just come back. The second is call 'Process Monitor'. This allows you to monitor ALL activity thats going on in your machine. You can even log everything from boot up - and it shows parent processes too (the ones that cause the trojan to reappear). But be warned if you do a full logging of boot up the log can grow up to almost 2 Gigabytes. But it will allow you to find the source of the trojan and then remove it from the registry so you can then remove all the other things that it starts without them restarting again once you kill them. But a word of warning. If you're not comfortable editing the Windows registry then please please please get someone competent to do it for you because you can do a hell of a lot of damage if you don't know what youre doing. Good luck. I too found I had downloaded a fake codec and now it’s putting lots of desktop.ini’s in most of my folders. This causes boot.com to be reloaded everytime I open the folder. I feel very stupid because I’m a programmer by profession.

The solution? It’s not easy to do. I’ve found two pieces of FREE software from sysinternals (you can download them free from the Microsoft developer network website).

The firts is called ‘Process Explorer’. This shows ALL processes (programs) running on your machine – even the ones that are ‘hidden’. It also allows you to kill them – but depending on what you kill you can either cause your machine to crash or if you kill the trojan but don’t kill the root then it will just come back.

The second is call ‘Process Monitor’. This allows you to monitor ALL activity thats going on in your machine. You can even log everything from boot up – and it shows parent processes too (the ones that cause the trojan to reappear). But be warned if you do a full logging of boot up the log can grow up to almost 2 Gigabytes. But it will allow you to find the source of the trojan and then remove it from the registry so you can then remove all the other things that it starts without them restarting again once you kill them.

But a word of warning. If you’re not comfortable editing the Windows registry then please please please get someone competent to do it for you because you can do a hell of a lot of damage if you don’t know what youre doing.

Good luck.

]]>