PDA

View Full Version : "Command Service" malware



Davka
2007-02-18, 22:47
This one's a real pain. The machine I'm cleaning belongs to a teenage girl, and it was so infested I would have wiped and started over, but she lost her OS recovery CD, so I'm stuck with a cleanup.

After running AVG, Ad-Aware, Spybot, Hijack This and a few other more obscure programs, I seem to have removed everything but one nasty little persistent critter that Spybot identifies as "Command Service." I turned the service off, disabled it, deleted it, re-ran Spybot in safe mode, and it managed to pull out 2 of the 5 instances of the malware. But Spybot still finds 3 instances, which it cannot remove, even when I allow it to run on reboot.

Any ideas?

-------------------------

BTW - here's a more detailed list of what I've tried so far, just to minimize redundant suggestions:

Programs:

- AVG free (safe mode and standard)
- Ad-Aware (safe mode and standard)
- Adware Away (safe mode and standard)
- Hijack This (doesn't see the file)
- Spybot (safe mode and standard)
- smitRem.exe (safe mode)
- Kaspersky free trial
- TrendMicro online scan (housecall)

Actions:

- Deleted the service via DOS command (sc delete cmdservice)
- Removed all references to command.exe from the registry
- Searched the hard drive for command.exe, including hidden and system files (not found)
- Invoked the hallowed name of Foo Bar while pounding on the keyboard rhythmically

Alas, the computer gods are not smiling on me today.

Davka
2007-02-19, 03:59
OK, I fixed it, but it involves a registry hack, so I'm not going to post it here.

Thanks for checking out my post, folks!

pskelley
2007-02-20, 00:44
Member fixed the issue, thanks for posting to let us know:bigthumb:
As the problem appears to be resolved this topic has been closed.
If you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.
Anyone else with similar problems please start a new topic.