Poweliks removal without admin permissions?


  1. Posts : 44
    Windows 7 Pro 64 bit
       #1

    Poweliks removal without admin permissions?


    Thanks a million (trillion these days?) all you volunteers who help us clueless geek wannabees. You are the bombs for doing this!

    So...back to work!

    Every user & group now has special permissions with checks in grayed-out boxes. Trusted Installer as a user seems to have total control of the PC. I can't run anything UAC needs permission for, and cannot get elevated admin rights in safe mode.

    I tried a Hiren's-style CD full of various utilities in safe mode to change the admin password back to mine. Said it was successful, but it wasn't. I think this nasty bug takes ownership of anything you work with - mouse click, command line, even security web pages. It glitched for a second and I saw it replace the ESET page with something else, then overlay that with maybe a spoof of the ESET page that took 10 seconds to load!

    The concept I'm thinking of is using my Vista PC to sterilize a thumb drive and load all the offline installers found in the various Poweliks and similar threads onto it in case I need them. (I'd like to be able to run the online installers from the thumb drive, too, but don't know how.)

    Then boot my 7PC into safe w/ networking and run this ESET Poweliks remover from the thumb drive if possible:

    FULL REMOVAL PACKAGE
    ESET | Antivirus, Internet Security Software & Virus Protection :: Download :: Thank You
    http://download.eset.com/manuals/ese...tguide_enu.pdf
    http://download.eset.com/manuals/ese...rguide_enu.pdf
    ADDITIONAL INFO FOR PACKAGE
    http://kb.eset.com/library/ESET/KB%2...icesRepair.exe
    How do I remove a Poweliks or Gootkit infection? - ESET Knowledgebase
    KernelMode.info
    How do I remove a Poweliks or Gootkit infection? - ESET Knowledgebase

    Any thoughts, my beloved security geeks? Or point me in the right direction if I've veered off the path.
      My Computer


  2. Posts : 8,608
    Windows 7 Ultimate 32bit SP1
       #2

    MBar appears to work on Poweliks https://www.malwarebytes.org/antirootkit/
      My Computer


  3. Posts : 44
    Windows 7 Pro 64 bit
    Thread Starter
       #3

    Screenshots


    Thanks for responding, Jacee. I'm sure MBar would remove it, but...
    "Every user & group now has special permissions with checks in grayed-out boxes. Trusted Installer as a user seems to have total control of the PC. I can't run anything UAC needs permission for, and cannot get elevated admin rights in safe mode."

    Maybe this will clarify some things.

    Here's Properties for the MWB anti-rootkit scanner I just downloaded from your link (is there an offline version?):

    Poweliks removal without admin permissions?-1rootkitdownld.jpg
    My User Name is "Household", so the underlined location is correct. Because the program hasn't been run yet (due to changed "Run as Admin" password), this info hasn't been changed.

    Poweliks removal without admin permissions?-2rootkitusers.jpg
    My User Name should appear in this list, right? The Object Name appears correct.

    Poweliks removal without admin permissions?-3rootkit.jpg
    I've noticed flashes of Notepad in Chinese or similar sometimes. Is Language Neutral correct?

    Poweliks removal without admin permissions?-1mav.jpg
    Here's Properties for MWB that I downloaded, at most, 2 weeks ago.
    I see the date "Sunday, December 14, 2014" on a lot of Properties pages for program shortcuts and files/folders.
    C:\Users\Public\Desktop should be C:\Users\Household\Desktop
    The file size/on-disc size is odd.

    Poweliks removal without admin permissions?-2mav.jpg
    TrustedInstaller takes ownership of everything I open. It doesn't show as a User here, but appears at log-in alongside Household (me). As I said, my password no longer works.

    I'm going to try this advice to see if I can get admin rights. I'll let you know what happens.
    Last edited by UberGoober; 29 Apr 2015 at 17:55. Reason: Clarity
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 01:46.
Find Us