{"id":206,"date":"2014-06-03T06:10:48","date_gmt":"2014-06-03T06:10:48","guid":{"rendered":"http:\/\/www.adlice.com\/?p=206"},"modified":"2022-12-21T10:40:08","modified_gmt":"2022-12-21T10:40:08","slug":"remove-necurs","status":"publish","type":"post","link":"https:\/\/www.adlice.com\/de\/remove-necurs\/","title":{"rendered":"How to Remove Necurs (Guide)"},"content":{"rendered":"\n

Analysis<\/h4>\n\n\n\n

Necurs is a rootkit<\/strong>, having a kernel driver and a protected service. The kernel driver has a self-protection feature<\/strong> against service key removal. It also filters which kernel driver can load to avoid antirootkits enter kernelmode and try to defeat it.<\/p>\n\n\n\n

It keeps persistence with a randomly named service key, started at boot time<\/strong>. For deep analysis, please refer to that excellent post<\/strong><\/a>.
 
\"necurs\"<\/a><\/p>\n\n\n\n


Removal<\/h4>\n\n\n\n

It’s necessary to act offline.<\/strong> You need to boot on a live CD\/USB to remove the malware while it’s not loaded, with the help of RogueKiller’s Honey module. It’s integrated, no worry.<\/p>\n\n\n\n

Download RogueKiller and place it where you will easily find it (C:\\\\). Simply start on the live CD and start RogueKiller<\/a>, then do the usual Scan\/Removal<\/strong>. If you don’t do that offline, you will see an error at service key removal<\/strong>, because the rootkit protects that service key..<\/p>\n\n\n\n

Please check out the demo video to remove that nasty piece of malware.<\/strong> OTLPE can be found here<\/a>.<\/strong><\/p>\n\n\n\n

\n