I have had following links in my Favorites:
http://free.hcworld.com
http://free-spy-cam.net
http://web-cams-chat.com
and I couldn’t remove them.
After couple of hours investigation I have realized that there runs process called C:\winnt\epknxff.exe (see in Task Manager) and there is also register entry called O4 - HKCU\..\Run: [xlynbbp] c:\winnt\rmcyviw.exe. Note that instead of rmcyviw.exe can be in register entry mentioned one of the following: aarjuge.exe, abjkjsu.exe, acrlqvq.exe, aidhaou.exe, aquiyhp.exe, avyydnm.exe, batbvit.exe, bfrfpgn.exe, bfvgdbx.exe, bhanton.exe, bmfpmpf.exe, bpekvou.exe, cknndnn.exe, cmvaelu.exe, cueiaqj.exe, daoumay.exe, djlmhei.exe, dlhloyb.exe, dtjigxp.exe, dvptkji.exe, dxbgovu.exe, dxhldxh.exe, dxwdvpg.exe, ehfykro.exe, eijafno.exe, ejwywtw.exe, epknxff.exe, ewigcvu.exe, fpfbrup.exe, frntpyi.exe, gbkbavw.exe, gjrdkit.exe, glxxekq.exe, gqyrsnl.exe, gvpnhnq.exe, hhadqhv.exe, hjtpgmp.exe, hlgfnmb.exe, huluhcw.exe, hveouyk.exe, hygjyfr.exe, ibxvppu.exe, idxbeyh.exe, igscgph.exe, ihrngbj.exe, ihwtslx.exe, iqcfvmv.exe, ivnviyk.exe, jbsmdnn.exe, jgkdiaj.exe, jhufepn.exe, jmdxnrb.exe, jpccoer.exe, jrosphw.exe, jsxhyug.exe, klebjgr.exe, ksxksmq.exe, kvwfucg.exe, kxxcdea.exe, lgswvsa.exe, lrlddmo.exe, lwiqsor.exe, lwiygqn.exe, mbnjrce.exe, mgsmqky.exe, mncqjnv.exe, mtqccuf.exe, mvcvetu.exe, mwxrgwa.exe, nchndxb.exe, nqwqysi.exe, nscweqw.exe, nwpthiv.exe, oeqjhmw.exe, ofytwfp.exe, ojsvpee.exe, okscxfr.exe, oreffby.exe, ouetdem.exe, psxacma.exe, pvsvbyq.exe, qadukfb.exe, qbjktvd.exe, qkbihew.exe, qmerfnk.exe, qojmecf.exe, qqtpsjx.exe, ragcctp.exe, rcidhfv.exe, rhxabyo.exe, riutgng.exe, rlyteqj.exe, rmcyviw.exe, saoevaf.exe, sehojmb.exe, sflqryv.exe, suyomaq.exe, sxxrolc.exe, thsqkty.exe, tmfjire.exe, tmqkvpj.exe, toujsuq.exe, tqegtpw.exe, ujujdeg.exe, ulpjdxj.exe, upensnp.exe, uqwdxce.exe, uukulbk.exe, vbglrjd.exe, vohissb.exe, waqgocl.exe, wcuxtle.exe, wdbmasa.exe, wpoqdgc.exe, wugarnh.exe, wvvdsgl.exe, xdffrfq.exe, yxaugxc.exe
To fix this problems you need to do following:
1. to stop the process epknxff.exe in Task Manager
2. to remove registry entry (e.g. by HijackThis)
3. to remove links from your Favorites
4. to restart computer
Be aware that all listed exe files are placed in your C:\winnt\ directory. All of them presumably are the same sized (46 080 bites in my computer) and they are created in the same time.
I hope this helps.
Komentáre