ZLNWZWVEW - WTF is this?

[ReTeMa]

hi,

i have no idea what this ''unknown user service: ZLNWZWVEW.exe (file missing)'' is doing according to hijackthis report. i disabled this service.

please help - how can i completely remove this (or any other) bother service from pc?

tia

 

[smah]

If you're already using HiJackThis, let HJT remove the entry.

 

[linney]

A long shot here, but if you have ever run "Rootkit Revealer" it creates unknown (randomly named) Services and leaves them in Services until you manually remove them from the Registry, it also (if I remember correctly) creates randomly named exe files and leaves them in the users temp folder.

Removing adware & spyware
faq608-4650

Try the free version of "Ewido"

http://www.ewido.net/

 

[ReTeMa]

thx for replies.

i disabled and removed from services list - i have no idea how, but it disappeared.
linney - ewido found and deleted some ''TrackingCookie.2o7'' !

then i started regedit program and via ''find'' it found at least 20 entries ''LEGACY_ZLNWZWVEW''. when i hit delete key i got ''Cannot delete LEGACY_ZLNWZWVEW: Error while deleting key''.

any idea how to delete-remove these keys ?

tia

 

[tfg13]

Have you modified the permissions to allow control to admins/everyone? As an administrator of the machine, you should be able to right click the entry, select permissions, and set the permissions to full control for admins and/or everyone which should allow you to delete these entries.

 

[erikhertzel]

I would check for other malware as well. Just disabling the service doesn't mean that the machine is completely cleaned up the way you want it to be. Try the following:

Webroot Spysweeper

Download it here:

http://www.sabethacomputing.com/downloads.html

Webroot Spysweeper 14 day Trial

Update the defs and do a sweep.

I would also check it with some other virus scanners just to make sure.

http://housecall.trendmicro.com

http://www.pandasoftware.com/activescan

Best regards.

Erik

 

[pechenegs]

Try deleting that folder in safe mode!

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars