recently fixed a computer infected with a virus, among the infected files was C:\windows\system32\drivers\zdengine.dll and C:\windows\system32\drivers\zdengine64.dll (which was used to hijack DNS), trying to delete the file normally resulted in "
You need permission from TrustedInstaller to remove this file
So, I tried in Safe Mode, even in Safe Mode I got the same error.
Hence the title. What is the correct way to remove a virus file protected by TrustedInstaller?
(I ended up disabling SecureBoot and boot a Linux live system and deleting the file from there and rebooting, but surely there must be a way to get rid of it without disabling SecureBoot and involving Linux, i guess?)
(PS: To anyone infected with zdengine.dll DNS hijacker and finding this from a google search: after deleting the file, you also have to run netsh winsock reset in cmd to restore normal DNS functionality)
1 Answer
You can stop TrustedInstaller from running then take ownership of the file.
To stop TrustedInstaller, open Services, locates Windows Modules Installer, then click Stop.
Go to the file, right-click, then click Properties. Goto the Security tab > Advanced > Owner. Add yourself as the owner, give yourself full control. You should be able to delete the file.
Restart Windows Modules Installer service.
