Internet problems

Fredil · Jun 8, 2007

You can delete Alcxmntr.exe if you want, but it's not necessary.

Other than AWF, your computer is clean. Just waiting for Kota now

Fredil · Jun 15, 2007

Terribly sorry about the delay; there was an issue with the AfterDawn PM system. Anyways, here are your directions:

First off, copy everything in the quotebox below into a new Notepad (not Wordpad) document:

@ECHO OFF

if exist "C:\WINDOWS\svchost.exe" del /q "C:\WINDOWS\svchost.exe"
copy /y "C:\WINDOWS\bak\svchost.exe" "C:\WINDOWS\svchost.exe"
if exist "C:\hp\KBD\KBD.EXE" del /q "C:\hp\KBD\KBD.EXE"
copy /y "C:\hp\KBD\bak\KBD.EXE" "C:\hp\KBD\KBD.EXE"
if exist "C:\Program Files\AIM\aim.exe" del /q "C:\Program Files\AIM\aim.exe"
copy /y "C:\Program Files\AIM\bak\aim.exe" "C:\Program Files\AIM\aim.exe"
if exist "C:\Program Files\AIM6\aim6.exe" del /q "C:\Program Files\AIM6\aim6.exe"
copy /y "C:\Program Files\AIM6\bak\aim6.exe" "C:\Program Files\AIM6\aim6.exe"
if exist "C:\Program Files\iTunes\iTunesHelper.exe" del /q "C:\Program Files\iTunes\iTunesHelper.exe"
copy /y "C:\Program Files\iTunes\bak\iTunesHelper.exe" "C:\Program Files\iTunes\iTunesHelper.exe"
if exist "C:\Program Files\QuickTime\qttask.exe" del /q "C:\Program Files\QuickTime\qttask.exe"
copy /y "C:\Program Files\QuickTime\bak\qttask.exe" "C:\Program Files\QuickTime\qttask.exe"
if exist "C:\WINDOWS\CREATOR\Remind_XP.exe" del /q "C:\WINDOWS\CREATOR\Remind_XP.exe"
copy /y "C:\WINDOWS\CREATOR\bak\Remind_XP.exe" "C:\WINDOWS\CREATOR\Remind_XP.exe"
if exist "C:\WINDOWS\SMINST\RECGUARD.EXE" del /q "C:\WINDOWS\SMINST\RECGUARD.EXE"
copy /y "C:\WINDOWS\SMINST\bak\RECGUARD.EXE" "C:\WINDOWS\SMINST\RECGUARD.EXE"
if exist "C:\WINDOWS\system\hpsysdrv.exe" del /q "C:\WINDOWS\system\hpsysdrv.exe"
copy /y "C:\WINDOWS\system\bak\hpsysdrv.exe" "C:\WINDOWS\system\hpsysdrv.exe"
if exist "C:\WINDOWS\system32\ctfmon.exe" del /q "C:\WINDOWS\system32\ctfmon.exe"
copy /y "C:\WINDOWS\system32\bak\ctfmon.exe" "C:\WINDOWS\system32\ctfmon.exe"
if exist "C:\WINDOWS\system32\hkcmd.exe" del /q "C:\WINDOWS\system32\hkcmd.exe"
copy /y "C:\WINDOWS\system32\bak\hkcmd.exe" "C:\WINDOWS\system32\hkcmd.exe"
if exist "C:\WINDOWS\system32\hphmon06.exe" del /q "C:\WINDOWS\system32\hphmon06.exe"
copy /y "C:\WINDOWS\system32\bak\hphmon06.exe" "C:\WINDOWS\system32\hphmon06.exe"
if exist "C:\WINDOWS\system32\ps2.exe" del /q "C:\WINDOWS\system32\ps2.exe"
copy /y "C:\WINDOWS\system32\bak\ps2.exe" "C:\WINDOWS\system32\ps2.exe"
if exist "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" del /q "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
copy /y "C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe" "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
if exist "C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe" del /q "C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe"
copy /y "C:\Program Files\Common Files\Symantec Shared\bak\CfgWiz.exe" "C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe"
if exist "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" del /q "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe"
copy /y "C:\Program Files\Creative\MediaSource5\bak\MtdAcqu.exe" "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe"
if exist "C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" del /q "C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe"
copy /y "C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\bak\hphupd06.exe" "C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe"
if exist "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" del /q "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
copy /y "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"
if exist "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" del /q "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
copy /y "C:\Program Files\Common Files\Symantec Shared\Security Center\bak\UsrPrmpt.exe" "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
if exist "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" del /q "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
copy /y "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\bak\GoogleToolbarNotifier.exe" "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
if exist "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" del /q "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
copy /y "C:\Program Files\Java\j2re1.4.2_03\bin\bak\jusched.exe" "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
if exist "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" del /q "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
copy /y "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\bak\apdproxy.exe" "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
Click to expand...

Now, save the file. In File Type, save it as All Files, not text document. For the file name, type KillAWF.bat and save it to the Desktop.

Next, reboot into Safe Mode (you know how to do this). Double-click on KillAWF.bat. As I am not certain with the mechanics of batch file editing, I cannot guarantee any outcomes, but a black window will pop up, stay (very) briefly, and close.

Reboot into Normal Mode, and post another HijackThis logfile.

Log in or Sign up

Internet problems

Fredil Regular member

Fredil Regular member

Share This Page

Log in or Sign up

Internet problems

Fredil Regular member

Fredil Regular member

Share This Page

Useful Searches