Twotone Posted December 30, 2008 ID:43523 Share Posted December 30, 2008 I'm working on this PC for a customer of mine. I suggested a total reformat/reinstall after I get this taken care of and their stuff backed up.HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Services\ati3trxx (Rootkit.Agent) -> Delete on reboot.HKEY_LOCAL_MACHINE\SYSTEM\Controlset003\Services\ati3trxx (Rootkit.Agent) -> Delete on reboot.HKEY_LOCAL_MACHINE\SYSTEM\Controlset004\Services\ati3trxx (Rootkit.Agent) -> Delete on reboot.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlset\Services\ati3trxx (Rootkit.Agent) -> Delete on reboot.C:\WINDOWS\SYSTEM32\DRIVERS\ati3trxx.sys (Rootkit.Agent) -> Delete on reboot.I was able to delete the file and:HKEY_LOCAL_MACHINE\SYSTEM\Controlset001\Services\ati3trxx (Rootkit.Agent) -> Delete on reboot.HKEY_LOCAL_MACHINE\SYSTEM\Controlset004\Services\ati3trxx (Rootkit.Agent) -> Delete on reboot.The other two registry entries will not delete in safe mode. Any suggestions? Link to post Share on other sites More sharing options...
Tigger93 Posted December 30, 2008 ID:43528 Share Posted December 30, 2008 I'd just back up the data and reformat it. That's a nasty rootkit that is very difficult to rid of. Link to post Share on other sites More sharing options...
Twotone Posted December 30, 2008 Author ID:43531 Share Posted December 30, 2008 I'd just back up the data and reformat it. That's a nasty rootkit that is very difficult to rid of.Yes, that sounds like the best idea. I even did a Google search for the file I removed and found nothing. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now