Lately there has been a rise in rootkit based Zlob fake codecs and video players. The rootkit belongs to TDSServ family, and is quite difficult to remove using standard anti-malware tools. Now, we will see how to remove these rootkit based Zlob malware. This removal procedure holds good for Zlob variants that drop kernel mode rootkits such as BrakePlayer, Moon-Player, TurboPlayer and Light-Track etc.
The removal process consists of three steps:
Download the following tools and install them (do not run them as of now):
Removing rootkit driver file and its Registry entry:
Note: If GMER does not detect any rootkit in its preliminary system scan (in Step 1 above), then you may not have kernel-mode rootkit variant of Zlob (or GMER is not detecting it ;)). Proceed to the section below.
Update: Zlob rootkit driver can also be removed using SysProt AntiRootkit. More information can be found here.
Removing other malware files dropped by Zlob installer:
Removing stray "shell open command" (a.k.a malicious autorun.inf file):
The removal process consists of three steps:
- Removing rootkit driver file and its Registry entry
- Removing other malware files dropped by Zlob installer
- Removing stray "shell open command" entry (a.k.a malicious autorun.inf file)
- Launch GMER.exe. As soon as GMER starts, it performs a preliminary system scan. If it finds any traces of rootkit, it will ask you to run a full PC scan. Click "No" for this prompt.
- Now, click on "Rootkit/Malware" tab and then select only "Services" checkbox (deselect all other scan options). Click "Scan" button to start scan. An example is shown in screenshot below.
- GMER should show the rootkit service after the scan. Right-click on that entry and click "Delete Service". Click "Yes" for the prompts that pop up. An example screenshot is shown below.
- Reboot the PC.
- Run GMER again and repeat steps 1, 2, 3 and 4 again (GMER will again detect the same rootkit service again).
Note: If GMER does not detect any rootkit in its preliminary system scan (in Step 1 above), then you may not have kernel-mode rootkit variant of Zlob (or GMER is not detecting it ;)). Proceed to the section below.
Update: Zlob rootkit driver can also be removed using SysProt AntiRootkit. More information can be found here.
Removing other malware files dropped by Zlob installer:
- Run Malwarebytes' Anti-Malware (MBAM), click "Update" tab and then click "Check for updates" button to download latest malware database.
- Once the update completes, click "Scanner" tab and select the "Perform full scan" option. Select all the hard disk partitions (C:\, D:\ etc) and then click "OK" to start scan.
- Once the scan completes, remove all the malware that MBAM may report. An example screenshot is shown below.
- Reboot the PC.
- Go to Start Menu > Search option to open Windows Search tool. Make Search to look in sytem/hidden folders and files. Finally, search for files named autorun.inf. An example screenshot is shown below.
- These autorun.inf files contain few commands which instruct Windows Explorer to load a Zlob malware file (generally, %rootdrive%\resycled\boot.com) whenever a user double-clicks on drive icons. Delete all the autorun.inf files found in hard disk partitions (for ex: C:\, D:\ etc)
- Reboot the PC.
Finally, run an online scan at F-Secure or TrendMicro to make sure that the PC is clean. Hopefully, the Zlob rootkit will be gone for good by this time!
