A forum for reverse engineering, OS internals and malware analysis 

Win32/Bublik.B (alias Bebloh)

Forum for analysis and discussion about malware.

Re: Trojan Zeus (alias ZBot)

 #13365  by thisisu
 Tue May 22, 2012 5:42 pm
EP_X0FF wrote:For removal navigate to

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\userinit.exe
key "Debugger" will point to malicious file (in this case it was logonruser.exe). Delete key, reboot, delete dropper.
Additional notes:

The malicious file is moved to %sys32%
I did not find that removing the key alone and then rebooting as very effective as the key is practically instantly regenerated (therefore, as soon as you reboot, you still have the same problem).
I found the follow sequence of anti-malware tools most effective and least time consuming.
Roguekiller -> Detects and deletes the bad IFEO entry
Then run HitmanPro as it seems to consistently detect the bad .exe in %sys32%.
HitmanPro requires reboot in this case, but you should be good after that. ;)

Beware:
As EP_X0FF stated, deleting the IFEO is most important and should be prioritized. If you delete the bad .exe in %sys32% ONLY (and leave the IFEO entry still there), upon reboot, you will be stuck in infamous logon/logoff loop.
In this case, you must delete the bad IFEO entry while the OS is offline.
 Return to “Malware”