Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

A Difficult Infection to Remove - Request Help [Solved]


  • This topic is locked This topic is locked

#1
Michelle1123

Michelle1123

    Member

  • Member
  • PipPip
  • 26 posts
Hi

Few weeks back my home laptop (Win XP) got infected with a virus because I did the unthinkable. Clicked on an exe file which apparently had not come from a trusted source. It was an immediate reaction to double-click it and before I could stop it the damage was done!
Because of the error messages I was getting then, I remember (this was 6 weeks back) trying to get some info and some suggesting that it was VIRUT which people said would not go even if you format your HDD and the only way out is to get a new HDD. I am hoping that things can be better!
I was not able to get into it for the past few days but am now determined to see if I can find a way to resolve the issue. Key "symptoms":

- Unable to work in the regular boot mode. I get an error message which says something to the effect " Your system will shutdown in 60 seconds. And then it refers to a file at c:\windows\system32\services.exe and includes some error code which I am not able to note as the system shuts down.
- Can only work in the safe mode
- When I had earlier tried to work in the regular mode, several .exe files used to get generated. I am sorry I am not able to explain what all I did then as it is some time back but am now willing to go ahead as instructed to get to the bottom of this.

For starters, I am posting here my HijackThis log. On the date stamp : my laptop's battery failed recently (unrelated) and so it shows an old date as it has lost its system time.

Log pasted below. Thanks!!







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:57:56 AM, on 12/16/2003
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\3361\services.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://stat.winrar2009.cn:88/ic.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe calc.ifo beforemain
F3 - REG:win.ini: load=C:\WINDOWS\system32\mscbjx.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\msokqy.exe
O2 - BHO: (no name) - {05367F41-96DA-4EBE-94BC-B9883741BFE8} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: (no name) - {C2141CDF-1EEE-4884-B1B8-227D88617F19} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [12CFG515-K641-55SF-N66P] C:\RECYCLER\S-1-5-21-0243636035-3055115376-381863306-1556\pqlmq.exe
O4 - HKCU\..\Run: [kell] c:\program Files\Manson\liser.exe
O4 - HKCU\..\Run: [Administrator] C:\Documents and Settings\Administrator\Administrator.exe /i
O4 - HKLM\..\Policies\Explorer\Run: [exec] C:\WINDOWS\system32\msjjxln.exe
O4 - HKUS\S-1-5-18\..\Run: [kell] C:\Program Files\Manson\liser.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Administrator] C:\Documents and Settings\Administrator\Administrator.exe /i (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [kell] C:\Program Files\Manson\liser.exe (User 'Default user')
O4 - Startup: fmnupd32.exe
O4 - Startup: zqosys32.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activatemydsl...ads/tgctlcm.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1208022049440
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com...obat/nos/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\progra~1\Manson\liser.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O20 - Winlogon Notify: dffaaafbbacdae - C:\WINDOWS\system32\dffaaafbbacdae.dll
O20 - Winlogon Notify: ehfctvdm - fibytox.dll (file missing)
O20 - Winlogon Notify: vvascahb - C:\WINDOWS\SYSTEM32\vvascahb.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe
O23 - Service: Dhcp server (DhcpSrv) - Unknown owner - C:\WINDOWS\DLL\RUNDLL32.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: jmnhhgrtja35ujghuykj6r8io9iujg80 - Unknown owner - C:\WINDOWS\jmnhhgrtja35ujghuykj6r8io9iujg81.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: SupportSoft Sprocket Service (nxpclient) (sprtsvc_nxpclient) - SupportSoft, Inc. - C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\
O23 - Service: xdfhs3we5sejahag2hzdehwgasfq80 - Unknown owner - C:\WINDOWS\xdfhs3we5sejahag2hzdehwgasfq81.exe
O23 - Service: zgtkg3jrsyzdb6wtgw3rh3wahhrjkae80 - Unknown owner - C:\WINDOWS\zgtkg3jrsyzdb6wtgw3rh3wahhrjkae81.exe

--
End of file - 7353 bytes
  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there Michelle1123 I will need you to run two programmes for me please, the second can be run from safe mode

Download SysProt Antirootkit from the link below (you will find it at the bottom of the page under attachments, or you can get it from one of the mirrors).

http://sites.google....rotantirootkit/

Unzip it into a folder on your desktop.

Start the Sysprot.exe program.

  • Click on the Log tab.
  • In the Write to log box select all items.
  • Click on the Create Log button on the bottom right.
  • After a few seconds a new Window should appear.
  • Make sure Scan all drives is selected and click on the Start button.
  • When it is complete a new Window will appear to indicate that the scan is finished.
  • The log will be created and saved automatically in the same folder. Open the text file and copy/paste the log here.

THEN

Download avz4.zip from here
  • Unzip it to your desktop to a folder named avz4
  • Double click on AVZ.exe to run it.
  • Run an update by clicking the Auto Update button on the Right of the Log window: Posted Image
  • Click Start to begin the update
Note: If you recieve an error message, chose a different source, then click Start again


  • Start AVZ.
  • Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Analysis" check box.
  • Click on the “Execute selected scripts”.
  • Automatic scanning, healing and system check will be executed.
  • A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
  • It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
  • All applications will work properly after the system restart.

When restarted

  • Start AVZ.
  • Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Analysis" check box.
  • Click on the "Execute selected scripts".
  • A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on Posted Image to insert the attachment into your post

  • 0

#3
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Thanks Essexboy. I was able to complete the tasks and am attaching the three files required.

INFO: The first time I ran AVZ as per the instructions it was under SAFE with NETWORKING mode as autoupdate was required. After the required re-boot the second time I ran AVZ under SAFE mode (without NETWORKING)


Also, including here are other observations which may be useful:


-------------
Whenever I boot the system I get the following message in a dialog box. This surely happens in the SAFE mode, not sure it would happen in the regular boot process:

RUNDLL

Error loading calc.ifo
The specified module could not be found.
--------------

Was able to get Sysprot.exe on to the infected system and check all of "write to log" options. When I click Create Log I got an error message like this after a couple of seconds when I thought the process had already begun as the status bar showed:

"SysProt AntiRootkit v1.0.1.0
Failed to start service. Sysprot AntiRootkit needs to be run with Admin privileges.

I am using Adminstrator login though.

When I did this 3 times, the same message (above) came but once I fleetingly saw a message saying a log was created but missed the location thinking I will be able to find it in some folder but that did not happen. Two of the three times this happened the .exe was run from the zipped folder off the thumb drive but the last time I ran it after copying the .exe file into my desktop and running it.

Finally on an attempt everything ran well and I got the log saved.

-------------------

During the scan with AVZ, some time into the scan, the following message was thrown:

"mktrrepi.exe has encountered a problem and needs to close. We are sorry for the inconvenience." And then it had the standard message in the same dialog box saying " Please tell Microsoft about your problem -- Send Error Report or Don't Send"


///// and I chose "Dont Send"


Also, few times a window titled cmd.exe related to windows/system32 used to pop up and then close on its own during the scan process. This has happened earlier too unrelated to the scan process.

------------------

When I re-started after the AVZ process, I again got the following message (same as listed above):

RUNDLL

Error loading calc.ifo
The specified module could not be found.
-------------------------------
Earlier and then after running the above processes, I still find that under : Start-> All Program->Startup there are two programs which surely look at exe files called fmnupd32 and zqosys32.
----------------------

I am using a second laptop to download files and transfer into the infected system using a USB thumb drive as the infected system does not have a browser. I probably deleted earlier or it got deleted.

Every time I put the USB stick into the infected computer a file m.exe gets created on it.

Attached Files


  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK then lets see if we can get the Microsoft files back in the majority :)

First though I did not realise you were using a pen drive, so I would like you to run the following programme on both computers

1 - Flash Drive Disinfector
Download Flash_Disinfector.exe by sUBs from here and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.

    Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder...it will help protect your drives from future infection.

THEN

AVZ FIX

  • Double click on AVZ.exe
  • Click File > Custom scripts
  • Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )
    begin
    SearchRootkit(true, true);
    SetAVZGuardStatus(True);
     QuarantineFile('C:\WINDOWS\system32\msdjnrtr.exe','');
     DeleteService('bbf9fa5');
     StopService('bbf9fa5');
     SetServiceStart('bbf9fa5', 4);
     DeleteService('709899b6');
     StopService('709899b6');
     SetServiceStart('709899b6', 4);
     TerminateProcessByName('c:\pxhojtod.exe');
     BC_DeleteFile('c:\pxhojtod.exe');
     DeleteFile('c:\pxhojtod.exe');
     BC_DeleteFile('C:\WINDOWS\system32\dffaaafbbacdae.dll');
     DeleteFile('C:\WINDOWS\system32\dffaaafbbacdae.dll');
     BC_DeleteFile('C:\WINDOWS\system32\msxm192z.dll');
     DeleteFile('C:\WINDOWS\system32\msxm192z.dll');
     BC_DeleteFile('C:\WINDOWS\system32\vvascahb.dll');
     DeleteFile('C:\WINDOWS\system32\vvascahb.dll');
     BC_DeleteFile('C:\Documents and Settings\Administrator\Administrator.exe');
     DeleteFile('C:\Documents and Settings\Administrator\Administrator.exe');
     BC_DeleteFile('%SystemRoot%\System32\logon.scr');
     DeleteFile('%SystemRoot%\System32\logon.scr');
     BC_DeleteFile('C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\fmnupd32.exe');
     DeleteFile('C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\fmnupd32.exe');
     BC_DeleteFile('C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\zqosys32.exe');
     DeleteFile('C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\zqosys32.exe');
     BC_DeleteFile('C:\RECYCLER\S-1-5-21-1026209070-6953395547-160821351-9855\wnzip32.exe');
     DeleteFile('C:\RECYCLER\S-1-5-21-1026209070-6953395547-160821351-9855\wnzip32.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msats.exe');
     DeleteFile('C:\WINDOWS\system32\msats.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msbowb.exe');
     DeleteFile('C:\WINDOWS\system32\msbowb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msltk.exe');
     DeleteFile('C:\WINDOWS\system32\msltk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqexso.exe');
     DeleteFile('C:\WINDOWS\system32\msqexso.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstan.exe');
     DeleteFile('C:\WINDOWS\system32\mstan.exe');
     BC_DeleteFile('Explorer.exe rundll32.exe calc.ifo beforemain');
     DeleteFile('Explorer.exe rundll32.exe calc.ifo beforemain');
     BC_DeleteFile('fibytox.dll');
     DeleteFile('fibytox.dll');
     BC_DeleteFile('logon.scr');
     DeleteFile('logon.scr');
     BC_DeleteFile('vvascahb.dll');
     DeleteFile('vvascahb.dll');
     BC_DeleteFile('C:\WINDOWS\system32\rundll32.exe');
     DeleteFile('C:\WINDOWS\system32\rundll32.exe');
     BC_DeleteFile('c:\windows\system32\svchost.exe:ext.exe:$DATA');
     DeleteFile('c:\windows\system32\svchost.exe:ext.exe:$DATA');
     BC_DeleteFile('C:\Documents and Settings\xxx\Local Settings\Temp\zgtkg3jrsyzdb6wtgw3rh3wahhrjkae43.exe');
     DeleteFile('C:\Documents and Settings\xxx\Local Settings\Temp\zgtkg3jrsyzdb6wtgw3rh3wahhrjkae43.exe');
     BC_DeleteFile('C:\WINDOWS\system32\lsass.dll');
     DeleteFile('C:\WINDOWS\system32\lsass.dll');
     BC_DeleteFile('C:\WINDOWS\system32\msceqfcl.exe');
     DeleteFile('C:\WINDOWS\system32\msceqfcl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscercip.exe');
     DeleteFile('C:\WINDOWS\system32\mscercip.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscevc.exe');
     DeleteFile('C:\WINDOWS\system32\mscevc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscfln.exe');
     DeleteFile('C:\WINDOWS\system32\mscfln.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscfm.exe');
     DeleteFile('C:\WINDOWS\system32\mscfm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscfoby.exe');
     DeleteFile('C:\WINDOWS\system32\mscfoby.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscgewg.exe');
     DeleteFile('C:\WINDOWS\system32\mscgewg.exe');
     DeleteFile('C:\WINDOWS\system32\mscgt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscgt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mschetcx.exe');
     DeleteFile('C:\WINDOWS\system32\mschetcx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msciv.exe');
     DeleteFile('C:\WINDOWS\system32\msciv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscjkp.exe');
     DeleteFile('C:\WINDOWS\system32\mscjkp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msclrnvx.exe');
     DeleteFile('C:\WINDOWS\system32\msclrnvx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscmsn.exe');
     DeleteFile('C:\WINDOWS\system32\mscmsn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscmvirs.exe');
     DeleteFile('C:\WINDOWS\system32\mscmvirs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscnuozg.exe');
     DeleteFile('C:\WINDOWS\system32\mscnuozg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscqqltv.exe');
     DeleteFile('C:\WINDOWS\system32\mscqqltv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscqvs.exe');
     DeleteFile('C:\WINDOWS\system32\mscqvs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscqyiih.exe');
     DeleteFile('C:\WINDOWS\system32\mscqyiih.exe');
     DeleteFile('C:\WINDOWS\system32\mscrb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscrb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msctxb.exe');
     DeleteFile('C:\WINDOWS\system32\msctxb.exe');
     DeleteFile('C:\WINDOWS\system32\mscuvoc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscuvoc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscvrj.exe');
     DeleteFile('C:\WINDOWS\system32\mscvrj.exe');
     DeleteFile('C:\WINDOWS\system32\mscvzdqh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscvzdqh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscwuo.exe');
     DeleteFile('C:\WINDOWS\system32\mscwuo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscwvzf.exe');
     DeleteFile('C:\WINDOWS\system32\mscwvzf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscxeai.exe');
     DeleteFile('C:\WINDOWS\system32\mscxeai.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscyeeh.exe');
     DeleteFile('C:\WINDOWS\system32\mscyeeh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscyh.exe');
     DeleteFile('C:\WINDOWS\system32\mscyh.exe');
     DeleteFile('C:\WINDOWS\system32\mscza.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mscza.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msczfk.exe');
     DeleteFile('C:\WINDOWS\system32\msczfk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdberkp.exe');
     DeleteFile('C:\WINDOWS\system32\msdberkp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdbmclw.exe');
     DeleteFile('C:\WINDOWS\system32\msdbmclw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msddeh.exe');
     DeleteFile('C:\WINDOWS\system32\msddeh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdeq.exe');
     DeleteFile('C:\WINDOWS\system32\msdeq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdgu.exe');
     DeleteFile('C:\WINDOWS\system32\msdgu.exe');
     DeleteFile('C:\WINDOWS\system32\msdgwbrp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdgwbrp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdigug.exe');
     DeleteFile('C:\WINDOWS\system32\msdigug.exe');
     DeleteFile('C:\WINDOWS\system32\msdije.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdije.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdjk.exe');
     DeleteFile('C:\WINDOWS\system32\msdjk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdjnrtr.exe');
     DeleteFile('C:\WINDOWS\system32\msdjnrtr.exe');
     DeleteFile('C:\WINDOWS\system32\msdmapo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdmapo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdpg.exe');
     DeleteFile('C:\WINDOWS\system32\msdpg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdqtb.exe');
     DeleteFile('C:\WINDOWS\system32\msdqtb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdrhp.exe');
     DeleteFile('C:\WINDOWS\system32\msdrhp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdsini.exe');
     DeleteFile('C:\WINDOWS\system32\msdsini.exe');
     DeleteFile('C:\WINDOWS\system32\msdsvxu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdsvxu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdull.exe');
     DeleteFile('C:\WINDOWS\system32\msdull.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdveejy.exe');
     DeleteFile('C:\WINDOWS\system32\msdveejy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdxqr.exe');
     DeleteFile('C:\WINDOWS\system32\msdxqr.exe');
     DeleteFile('C:\WINDOWS\system32\msdzil.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdzil.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msdzo.exe');
     DeleteFile('C:\WINDOWS\system32\msdzo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseaks.exe');
     DeleteFile('C:\WINDOWS\system32\mseaks.exe');
     DeleteFile('C:\WINDOWS\system32\msedcrgl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msedcrgl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msedgp.exe');
     DeleteFile('C:\WINDOWS\system32\msedgp.exe');
     DeleteFile('C:\WINDOWS\system32\mseegju.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseegju.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseel.exe');
     DeleteFile('C:\WINDOWS\system32\mseel.exe');
     DeleteFile('C:\WINDOWS\system32\mseflgj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseflgj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msefn.exe');
     DeleteFile('C:\WINDOWS\system32\msefn.exe');
     DeleteFile('C:\WINDOWS\system32\msefpi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msefpi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseiddn.exe');
     DeleteFile('C:\WINDOWS\system32\mseiddn.exe');
     DeleteFile('C:\WINDOWS\system32\msejrx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msejrx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msekoco.exe');
     DeleteFile('C:\WINDOWS\system32\msekoco.exe');
     DeleteFile('C:\WINDOWS\system32\msektf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msektf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mselkdf.exe');
     DeleteFile('C:\WINDOWS\system32\mselkdf.exe');
     DeleteFile('C:\WINDOWS\system32\mseln.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseln.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mselozi.exe');
     DeleteFile('C:\WINDOWS\system32\mselozi.exe');
     DeleteFile('C:\WINDOWS\system32\mselu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mselu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msemeb.exe');
     DeleteFile('C:\WINDOWS\system32\msemeb.exe');
     DeleteFile('C:\WINDOWS\system32\msemevr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msemevr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msemm.exe');
     DeleteFile('C:\WINDOWS\system32\msemm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseodqjj.exe');
     DeleteFile('C:\WINDOWS\system32\mseodqjj.exe');
     DeleteFile('C:\WINDOWS\system32\mseoponh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseoponh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msepw.exe');
     DeleteFile('C:\WINDOWS\system32\msepw.exe');
     DeleteFile('C:\WINDOWS\system32\mseqzof.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseqzof.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mserxs.exe');
     DeleteFile('C:\WINDOWS\system32\mserxs.exe');
     DeleteFile('C:\WINDOWS\system32\msesry.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msesry.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msetlqy.exe');
     DeleteFile('C:\WINDOWS\system32\msetlqy.exe');
     DeleteFile('C:\WINDOWS\system32\mseuwus.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseuwus.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msevcu.exe');
     DeleteFile('C:\WINDOWS\system32\msevcu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msewi.exe');
     DeleteFile('C:\WINDOWS\system32\msewi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseyegmb.exe');
     DeleteFile('C:\WINDOWS\system32\mseyegmb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mseyyn.exe');
     DeleteFile('C:\WINDOWS\system32\mseyyn.exe');
     DeleteFile('C:\WINDOWS\system32\msezrs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msezrs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfacegm.exe');
     DeleteFile('C:\WINDOWS\system32\msfacegm.exe');
     DeleteFile('C:\WINDOWS\system32\msfajcy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfajcy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfaklry.exe');
     DeleteFile('C:\WINDOWS\system32\msfaklry.exe');
     DeleteFile('C:\WINDOWS\system32\msfaq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfaq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfbpou.exe');
     DeleteFile('C:\WINDOWS\system32\msfbpou.exe');
     DeleteFile('C:\WINDOWS\system32\msfcinzp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfcinzp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfcwcy.exe');
     DeleteFile('C:\WINDOWS\system32\msfcwcy.exe');
     DeleteFile('C:\WINDOWS\system32\msfeu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfeu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msffse.exe');
     DeleteFile('C:\WINDOWS\system32\msffse.exe');
     DeleteFile('C:\WINDOWS\system32\msfgasru.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfgasru.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfhz.exe');
     DeleteFile('C:\WINDOWS\system32\msfhz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfiyxn.exe');
     DeleteFile('C:\WINDOWS\system32\msfiyxn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfjfi.exe');
     DeleteFile('C:\WINDOWS\system32\msfjfi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfjgxoi.exe');
     DeleteFile('C:\WINDOWS\system32\msfjgxoi.exe');
     DeleteFile('C:\WINDOWS\system32\msfjvcb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfjvcb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfjz.exe');
     DeleteFile('C:\WINDOWS\system32\msfjz.exe');
     DeleteFile('C:\WINDOWS\system32\msfky.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfky.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfnsa.exe');
     DeleteFile('C:\WINDOWS\system32\msfnsa.exe');
     DeleteFile('C:\WINDOWS\system32\msfodd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfodd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfpw.exe');
     DeleteFile('C:\WINDOWS\system32\msfpw.exe');
     DeleteFile('C:\WINDOWS\system32\msfpym.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfpym.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfqris.exe');
     DeleteFile('C:\WINDOWS\system32\msfqris.exe');
     DeleteFile('C:\WINDOWS\system32\msfrwiq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfrwiq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfsmpfw.exe');
     DeleteFile('C:\WINDOWS\system32\msfsmpfw.exe');
     DeleteFile('C:\WINDOWS\system32\msfubvsr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfubvsr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfwc.exe');
     DeleteFile('C:\WINDOWS\system32\msfwc.exe');
     DeleteFile('C:\WINDOWS\system32\msfxbr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfxbr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfxku.exe');
     DeleteFile('C:\WINDOWS\system32\msfxku.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfxnedl.exe');
     DeleteFile('C:\WINDOWS\system32\msfxnedl.exe');
     DeleteFile('C:\WINDOWS\system32\msfycd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfycd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfyjiu.exe');
     DeleteFile('C:\WINDOWS\system32\msfyjiu.exe');
     DeleteFile('C:\WINDOWS\system32\msfyqrz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfyqrz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msfyy.exe');
     DeleteFile('C:\WINDOWS\system32\msfyy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgae.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgay.exe');
     DeleteFile('C:\WINDOWS\system32\msgay.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgbyu.exe');
     DeleteFile('C:\WINDOWS\system32\msgbyu.exe');
     DeleteFile('C:\WINDOWS\system32\msgcg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgcg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgdhelz.exe');
     DeleteFile('C:\WINDOWS\system32\msgdhelz.exe');
     DeleteFile('C:\WINDOWS\system32\msgdid.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgdid.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgeduf.exe');
     DeleteFile('C:\WINDOWS\system32\msgeduf.exe');
     DeleteFile('C:\WINDOWS\system32\msgfzrzh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgfzrzh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msggpu.exe');
     DeleteFile('C:\WINDOWS\system32\msggpu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msggtkda.exe');
     DeleteFile('C:\WINDOWS\system32\msggtkda.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msghklf.exe');
     DeleteFile('C:\WINDOWS\system32\msghklf.exe');
     DeleteFile('C:\WINDOWS\system32\msghnh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msghnh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msghu.exe');
     DeleteFile('C:\WINDOWS\system32\msghu.exe');
     DeleteFile('C:\WINDOWS\system32\msglnhk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msglnhk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msglo.exe');
     DeleteFile('C:\WINDOWS\system32\msglo.exe');
     DeleteFile('C:\WINDOWS\system32\msgmgbdj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgmgbdj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgmgsp.exe');
     DeleteFile('C:\WINDOWS\system32\msgmgsp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgpqi.exe');
     DeleteFile('C:\WINDOWS\system32\msgpqi.exe');
     DeleteFile('C:\WINDOWS\system32\msgqng.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgqng.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgqp.exe');
     DeleteFile('C:\WINDOWS\system32\msgqp.exe');
     DeleteFile('C:\WINDOWS\system32\msgsbjju.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgsbjju.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgsjmgj.exe');
     DeleteFile('C:\WINDOWS\system32\msgsjmgj.exe');
     DeleteFile('C:\WINDOWS\system32\msgsync.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgsync.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgtxy.exe');
     DeleteFile('C:\WINDOWS\system32\msgtxy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msguohn.exe');
     DeleteFile('C:\WINDOWS\system32\msguohn.exe');
     DeleteFile('C:\WINDOWS\system32\msgutu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgutu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgux.exe');
     DeleteFile('C:\WINDOWS\system32\msgux.exe');
     DeleteFile('C:\WINDOWS\system32\msgvnh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgvnh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgvnwj.exe');
     DeleteFile('C:\WINDOWS\system32\msgvnwj.exe');
     DeleteFile('C:\WINDOWS\system32\msgwj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgwj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgxbe.exe');
     DeleteFile('C:\WINDOWS\system32\msgxbe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgxcppg.exe');
     DeleteFile('C:\WINDOWS\system32\msgxcppg.exe');
     DeleteFile('C:\WINDOWS\system32\msgxsc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgxsc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msgyt.exe');
     DeleteFile('C:\WINDOWS\system32\msgyt.exe');
     DeleteFile('C:\WINDOWS\system32\mshabf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshabf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshawu.exe');
     DeleteFile('C:\WINDOWS\system32\mshawu.exe');
     DeleteFile('C:\WINDOWS\system32\mshbsmp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshbsmp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshchbmb.exe');
     DeleteFile('C:\WINDOWS\system32\mshchbmb.exe');
     DeleteFile('C:\WINDOWS\system32\mshcw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshcw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshcwfoe.exe');
     DeleteFile('C:\WINDOWS\system32\mshcwfoe.exe');
     DeleteFile('C:\WINDOWS\system32\mshddgu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshddgu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshdfhnc.exe');
     DeleteFile('C:\WINDOWS\system32\mshdfhnc.exe');
     DeleteFile('C:\WINDOWS\system32\msheauo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msheauo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshewf.exe');
     DeleteFile('C:\WINDOWS\system32\mshewf.exe');
     DeleteFile('C:\WINDOWS\system32\mshfffp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshfffp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshfqz.exe');
     DeleteFile('C:\WINDOWS\system32\mshfqz.exe');
     DeleteFile('C:\WINDOWS\system32\mshgjdeo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshgjdeo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshgjr.exe');
     DeleteFile('C:\WINDOWS\system32\mshgjr.exe');
     DeleteFile('C:\WINDOWS\system32\mshilm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshilm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshjtyup.exe');
     DeleteFile('C:\WINDOWS\system32\mshjtyup.exe');
     DeleteFile('C:\WINDOWS\system32\mshkib.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshkib.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshlljb.exe');
     DeleteFile('C:\WINDOWS\system32\mshlljb.exe');
     DeleteFile('C:\WINDOWS\system32\mshmkpfz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshmkpfz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshpn.exe');
     DeleteFile('C:\WINDOWS\system32\mshpn.exe');
     DeleteFile('C:\WINDOWS\system32\mshrrv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshrrv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshrxmx.exe');
     DeleteFile('C:\WINDOWS\system32\mshrxmx.exe');
     DeleteFile('C:\WINDOWS\system32\mshrz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshrz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshsfxv.exe');
     DeleteFile('C:\WINDOWS\system32\mshsfxv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshtvxsi.exe');
     DeleteFile('C:\WINDOWS\system32\mshtvxsi.exe');
     DeleteFile('C:\WINDOWS\system32\mshuf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshuf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshul.exe');
     DeleteFile('C:\WINDOWS\system32\mshul.exe');
     DeleteFile('C:\WINDOWS\system32\mshumvu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshumvu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshxjxsc.exe');
     DeleteFile('C:\WINDOWS\system32\mshxjxsc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshyajk.exe');
     DeleteFile('C:\WINDOWS\system32\mshyajk.exe');
     DeleteFile('C:\WINDOWS\system32\mshyjf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshyjf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshyjkl.exe');
     DeleteFile('C:\WINDOWS\system32\mshyjkl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mshzpup.exe');
     DeleteFile('C:\WINDOWS\system32\mshzpup.exe');
     DeleteFile('C:\WINDOWS\system32\msiaplf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msiaplf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msias.exe');
     DeleteFile('C:\WINDOWS\system32\msias.exe');
     DeleteFile('C:\WINDOWS\system32\msidtlpt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msidtlpt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msiegppg.exe');
     DeleteFile('C:\WINDOWS\system32\msiegppg.exe');
     DeleteFile('C:\WINDOWS\system32\msielaec.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msielaec.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msietuwr.exe');
     DeleteFile('C:\WINDOWS\system32\msietuwr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msift.exe');
     DeleteFile('C:\WINDOWS\system32\msift.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msigne.exe');
     DeleteFile('C:\WINDOWS\system32\msigne.exe');
     DeleteFile('C:\WINDOWS\system32\msigsap.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msigsap.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msihajn.exe');
     DeleteFile('C:\WINDOWS\system32\msihajn.exe');
     DeleteFile('C:\WINDOWS\system32\msinj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msinj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msinlxr.exe');
     DeleteFile('C:\WINDOWS\system32\msinlxr.exe');
     DeleteFile('C:\WINDOWS\system32\msinw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msinw.exe');
     DeleteFile('C:\WINDOWS\system32\msipn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msipn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msipycwb.exe');
     DeleteFile('C:\WINDOWS\system32\msipycwb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msiqwqit.exe');
     DeleteFile('C:\WINDOWS\system32\msiqwqit.exe');
     DeleteFile('C:\WINDOWS\system32\msisesk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msisesk.exe');
     DeleteFile('C:\WINDOWS\system32\msism.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msism.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msisngc.exe');
     DeleteFile('C:\WINDOWS\system32\msisngc.exe');
     DeleteFile('C:\WINDOWS\system32\msitcb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msitcb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msiue.exe');
     DeleteFile('C:\WINDOWS\system32\msiue.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msiwnjh.exe');
     DeleteFile('C:\WINDOWS\system32\msiwnjh.exe');
     DeleteFile('C:\WINDOWS\system32\msizhrwr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msizhrwr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msizmg.exe');
     DeleteFile('C:\WINDOWS\system32\msizmg.exe');
     DeleteFile('C:\WINDOWS\system32\msizttm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msizttm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msizwde.exe');
     DeleteFile('C:\WINDOWS\system32\msizwde.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msizx.exe');
     DeleteFile('C:\WINDOWS\system32\msizx.exe');
     DeleteFile('C:\WINDOWS\system32\msjaw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjaw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjckyys.exe');
     DeleteFile('C:\WINDOWS\system32\msjckyys.exe');
     DeleteFile('C:\WINDOWS\system32\msjctcd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjctcd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjdiw.exe');
     DeleteFile('C:\WINDOWS\system32\msjdiw.exe');
     DeleteFile('C:\WINDOWS\system32\msjdkbsd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjdkbsd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjdtvr.exe');
     DeleteFile('C:\WINDOWS\system32\msjdtvr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjedxo.exe');
     DeleteFile('C:\WINDOWS\system32\msjedxo.exe');
     DeleteFile('C:\WINDOWS\system32\msjfuk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjfuk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjjxln.exe');
     DeleteFile('C:\WINDOWS\system32\msjjxln.exe');
     DeleteFile('C:\WINDOWS\system32\msjjy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjjy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjkxj.exe');
     DeleteFile('C:\WINDOWS\system32\msjkxj.exe');
     DeleteFile('C:\WINDOWS\system32\msjkyapp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjkyapp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjmg.exe');
     DeleteFile('C:\WINDOWS\system32\msjmg.exe');
     DeleteFile('C:\WINDOWS\system32\msjmmr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjmmr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjphn.exe');
     DeleteFile('C:\WINDOWS\system32\msjphn.exe');
     DeleteFile('C:\WINDOWS\system32\msjqgxn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjqgxn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjrrxw.exe');
     DeleteFile('C:\WINDOWS\system32\msjrrxw.exe');
     DeleteFile('C:\WINDOWS\system32\msjtqksa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjtqksa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjuruo.exe');
     DeleteFile('C:\WINDOWS\system32\msjuruo.exe');
     DeleteFile('C:\WINDOWS\system32\msjvjss.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjvjss.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjxx.exe');
     DeleteFile('C:\WINDOWS\system32\msjxx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjyozpt.exe');
     DeleteFile('C:\WINDOWS\system32\msjyozpt.exe');
     DeleteFile('C:\WINDOWS\system32\msjzfj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msjzfj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskalns.exe');
     DeleteFile('C:\WINDOWS\system32\mskalns.exe');
     DeleteFile('C:\WINDOWS\system32\mskbfd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskbfd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskbg.exe');
     DeleteFile('C:\WINDOWS\system32\mskbg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskbjc.exe');
     DeleteFile('C:\WINDOWS\system32\mskbjc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskcjfr.exe');
     DeleteFile('C:\WINDOWS\system32\mskcjfr.exe');
     DeleteFile('C:\WINDOWS\system32\mskcoeaq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskcoeaq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskegn.exe');
     DeleteFile('C:\WINDOWS\system32\mskegn.exe');
     DeleteFile('C:\WINDOWS\system32\mskemgkh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskemgkh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskfsev.exe');
     DeleteFile('C:\WINDOWS\system32\mskfsev.exe');
     DeleteFile('C:\WINDOWS\system32\mskfufr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskfufr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskgezcm.exe');
     DeleteFile('C:\WINDOWS\system32\mskgezcm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskgmez.exe');
     DeleteFile('C:\WINDOWS\system32\mskgmez.exe');
     DeleteFile('C:\WINDOWS\system32\mskgypg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskgypg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskhzz.exe');
     DeleteFile('C:\WINDOWS\system32\mskhzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskior.exe');
     DeleteFile('C:\WINDOWS\system32\mskior.exe');
     DeleteFile('C:\WINDOWS\system32\mskixrr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskixrr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskjss.exe');
     DeleteFile('C:\WINDOWS\system32\mskjss.exe');
     DeleteFile('C:\WINDOWS\system32\mskkebqb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskkebqb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskkl.exe');
     DeleteFile('C:\WINDOWS\system32\mskkl.exe');
     DeleteFile('C:\WINDOWS\system32\msklabup.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msklabup.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msklesnn.exe');
     DeleteFile('C:\WINDOWS\system32\msklesnn.exe');
     DeleteFile('C:\WINDOWS\system32\mskmnx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskmnx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskmug.exe');
     DeleteFile('C:\WINDOWS\system32\mskmug.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskom.exe');
     DeleteFile('C:\WINDOWS\system32\mskom.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskoo.exe');
     DeleteFile('C:\WINDOWS\system32\mskoo.exe');
     DeleteFile('C:\WINDOWS\system32\mskoscd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskoscd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskoy.exe');
     DeleteFile('C:\WINDOWS\system32\mskoy.exe');
     DeleteFile('C:\WINDOWS\system32\mskqwlke.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskrh.exe');
     DeleteFile('C:\WINDOWS\system32\mskrh.exe');
     DeleteFile('C:\WINDOWS\system32\mskrugow.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskrugow.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msktdbmh.exe');
     DeleteFile('C:\WINDOWS\system32\msktdbmh.exe');
     DeleteFile('C:\WINDOWS\system32\mskujyew.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskujyew.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskvbk.exe');
     DeleteFile('C:\WINDOWS\system32\mskvbk.exe');
     DeleteFile('C:\WINDOWS\system32\mskvtki.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskvtki.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskvvw.exe');
     DeleteFile('C:\WINDOWS\system32\mskvvw.exe');
     DeleteFile('C:\WINDOWS\system32\mskwf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskwf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mskwp.exe');
     DeleteFile('C:\WINDOWS\system32\mskwp.exe');
     DeleteFile('C:\WINDOWS\system32\mslcb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslcb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msldc.exe');
     DeleteFile('C:\WINDOWS\system32\msldc.exe');
     DeleteFile('C:\WINDOWS\system32\mslenpz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslenpz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslgal.exe');
     DeleteFile('C:\WINDOWS\system32\mslgal.exe');
     DeleteFile('C:\WINDOWS\system32\mslgtr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslgtr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msliagg.exe');
     DeleteFile('C:\WINDOWS\system32\msliagg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msljmb.exe');
     DeleteFile('C:\WINDOWS\system32\msljmb.exe');
     DeleteFile('C:\WINDOWS\system32\msljt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msljt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslkba.exe');
     DeleteFile('C:\WINDOWS\system32\mslkba.exe');
     DeleteFile('C:\WINDOWS\system32\mslkbisg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslkbisg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msllb.exe');
     DeleteFile('C:\WINDOWS\system32\msllb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msllt.exe');
     DeleteFile('C:\WINDOWS\system32\msllt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msllthzz.exe');
     DeleteFile('C:\WINDOWS\system32\msllthzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslmsr.exe');
     DeleteFile('C:\WINDOWS\system32\mslmsr.exe');
     DeleteFile('C:\WINDOWS\system32\mslmvu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslmvu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslnck.exe');
     DeleteFile('C:\WINDOWS\system32\mslnck.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslogd.exe');
     DeleteFile('C:\WINDOWS\system32\mslogd.exe');
     DeleteFile('C:\WINDOWS\system32\mslpzv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslpzv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslrnfhw.exe');
     DeleteFile('C:\WINDOWS\system32\mslrnfhw.exe');
     DeleteFile('C:\WINDOWS\system32\mslsfpy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslsfpy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msltrolw.exe');
     DeleteFile('C:\WINDOWS\system32\msltrolw.exe');
     DeleteFile('C:\WINDOWS\system32\msltzv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msltzv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msludtud.exe');
     DeleteFile('C:\WINDOWS\system32\msludtud.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msluwq.exe');
     DeleteFile('C:\WINDOWS\system32\msluwq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslvqk.exe');
     DeleteFile('C:\WINDOWS\system32\mslvqk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslwcwku.exe');
     DeleteFile('C:\WINDOWS\system32\mslwcwku.exe');
     DeleteFile('C:\WINDOWS\system32\mslwi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslwi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslxzuvi.exe');
     DeleteFile('C:\WINDOWS\system32\mslxzuvi.exe');
     DeleteFile('C:\WINDOWS\system32\mslyzts.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslyzts.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mslyzx.exe');
     DeleteFile('C:\WINDOWS\system32\mslyzx.exe');
     DeleteFile('C:\WINDOWS\system32\msmadmho.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmadmho.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmajtrh.exe');
     DeleteFile('C:\WINDOWS\system32\msmajtrh.exe');
     DeleteFile('C:\WINDOWS\system32\msmbqjl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmbqjl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmck.exe');
     DeleteFile('C:\WINDOWS\system32\msmck.exe');
     DeleteFile('C:\WINDOWS\system32\msmcndqc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmcndqc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmczo.exe');
     DeleteFile('C:\WINDOWS\system32\msmczo.exe');
     DeleteFile('C:\WINDOWS\system32\msmdlym.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmdlym.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmdq.exe');
     DeleteFile('C:\WINDOWS\system32\msmdq.exe');
     DeleteFile('C:\WINDOWS\system32\msmdy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmdy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmecdw.exe');
     DeleteFile('C:\WINDOWS\system32\msmecdw.exe');
     DeleteFile('C:\WINDOWS\system32\msmfa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmfa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmfmlsd.exe');
     DeleteFile('C:\WINDOWS\system32\msmfmlsd.exe');
     DeleteFile('C:\WINDOWS\system32\msmhgfx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmhgfx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmif.exe');
     DeleteFile('C:\WINDOWS\system32\msmif.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmjc.exe');
     DeleteFile('C:\WINDOWS\system32\msmjc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmjv.exe');
     DeleteFile('C:\WINDOWS\system32\msmjv.exe');
     DeleteFile('C:\WINDOWS\system32\msmjzelf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmjzelf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmkw.exe');
     DeleteFile('C:\WINDOWS\system32\msmkw.exe');
     DeleteFile('C:\WINDOWS\system32\msmkzv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmkzv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmlpc.exe');
     DeleteFile('C:\WINDOWS\system32\msmlpc.exe');
     DeleteFile('C:\WINDOWS\system32\msmnb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmnb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmnjeja.exe');
     DeleteFile('C:\WINDOWS\system32\msmnjeja.exe');
     DeleteFile('C:\WINDOWS\system32\msmnr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmnr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmnziwj.exe');
     DeleteFile('C:\WINDOWS\system32\msmnziwj.exe');
     DeleteFile('C:\WINDOWS\system32\msmpte.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmpte.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmqj.exe');
     DeleteFile('C:\WINDOWS\system32\msmqj.exe');
     DeleteFile('C:\WINDOWS\system32\msmrgckv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmrgckv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmrqd.exe');
     DeleteFile('C:\WINDOWS\system32\msmrqd.exe');
     DeleteFile('C:\WINDOWS\system32\msmviozg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmviozg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmvzatp.exe');
     DeleteFile('C:\WINDOWS\system32\msmvzatp.exe');
     DeleteFile('C:\WINDOWS\system32\msmvzc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmvzc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmwffz.exe');
     DeleteFile('C:\WINDOWS\system32\msmwffz.exe');
     DeleteFile('C:\WINDOWS\system32\msmwsd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmwsd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msmzwdzi.exe');
     DeleteFile('C:\WINDOWS\system32\msmzwdzi.exe');
     DeleteFile('C:\WINDOWS\system32\msnac.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnac.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnbnyk.exe');
     DeleteFile('C:\WINDOWS\system32\msnbnyk.exe');
     DeleteFile('C:\WINDOWS\system32\msnbps.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnbps.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnexj.exe');
     DeleteFile('C:\WINDOWS\system32\msnexj.exe');
     DeleteFile('C:\WINDOWS\system32\msnfqwv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnfqwv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnfsijx.exe');
     DeleteFile('C:\WINDOWS\system32\msnfsijx.exe');
     DeleteFile('C:\WINDOWS\system32\msnhnp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnhnp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnib.exe');
     DeleteFile('C:\WINDOWS\system32\msnib.exe');
     DeleteFile('C:\WINDOWS\system32\msnilxb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnilxb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msniunvp.exe');
     DeleteFile('C:\WINDOWS\system32\msniunvp.exe');
     DeleteFile('C:\WINDOWS\system32\msniyvy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msniyvy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnizgvg.exe');
     DeleteFile('C:\WINDOWS\system32\msnizgvg.exe');
     DeleteFile('C:\WINDOWS\system32\msnkim.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnkim.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnkkpz.exe');
     DeleteFile('C:\WINDOWS\system32\msnkkpz.exe');
     DeleteFile('C:\WINDOWS\system32\msnkqxei.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnkqxei.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnld.exe');
     DeleteFile('C:\WINDOWS\system32\msnld.exe');
     DeleteFile('C:\WINDOWS\system32\msnlhn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnlhn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnmusb.exe');
     DeleteFile('C:\WINDOWS\system32\msnmusb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnmzy.exe');
     DeleteFile('C:\WINDOWS\system32\msnmzy.exe');
     DeleteFile('C:\WINDOWS\system32\msnnuubl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnnuubl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnobrqo.exe');
     DeleteFile('C:\WINDOWS\system32\msnobrqo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnou.exe');
     DeleteFile('C:\WINDOWS\system32\msnou.exe');
     DeleteFile('C:\WINDOWS\system32\msnqpxlu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnqpxlu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnti.exe');
     DeleteFile('C:\WINDOWS\system32\msnti.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnwtb.exe');
     DeleteFile('C:\WINDOWS\system32\msnwtb.exe');
     DeleteFile('C:\WINDOWS\system32\msnxboo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnxboo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnzt.exe');
     DeleteFile('C:\WINDOWS\system32\msnzt.exe');
     DeleteFile('C:\WINDOWS\system32\msnzuplh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msnzuplh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msoarc.exe');
     DeleteFile('C:\WINDOWS\system32\msoarc.exe');
     DeleteFile('C:\WINDOWS\system32\msocrjfm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msocrjfm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msocx.exe');
     DeleteFile('C:\WINDOWS\system32\msocx.exe');
     DeleteFile('C:\WINDOWS\system32\msodv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msodv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msodypi.exe');
     DeleteFile('C:\WINDOWS\system32\msodypi.exe');
     DeleteFile('C:\WINDOWS\system32\msoeluyb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msoeluyb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msoewwmx.exe');
     DeleteFile('C:\WINDOWS\system32\msoewwmx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msofxdtv.exe');
     DeleteFile('C:\WINDOWS\system32\msofxdtv.exe');
     DeleteFile('C:\WINDOWS\system32\msohwq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msohwq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msoif.exe');
     DeleteFile('C:\WINDOWS\system32\msoif.exe');
     DeleteFile('C:\WINDOWS\system32\msojdc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msojdc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msokqy.exe');
     DeleteFile('C:\WINDOWS\system32\msokqy.exe');
     DeleteFile('C:\WINDOWS\system32\msolv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msolv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msomv.exe');
     DeleteFile('C:\WINDOWS\system32\msomv.exe');
     DeleteFile('C:\WINDOWS\system32\msonjjxe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msonjjxe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msosc.exe');
     DeleteFile('C:\WINDOWS\system32\msosc.exe');
     DeleteFile('C:\WINDOWS\system32\msosrua.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msosrua.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msouliac.exe');
     DeleteFile('C:\WINDOWS\system32\msouliac.exe');
     DeleteFile('C:\WINDOWS\system32\msowch.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msowch.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msoyg.exe');
     DeleteFile('C:\WINDOWS\system32\msoyg.exe');
     DeleteFile('C:\WINDOWS\system32\msozzqhq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msozzqhq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspamh.exe');
     DeleteFile('C:\WINDOWS\system32\mspamh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspbwr.exe');
     DeleteFile('C:\WINDOWS\system32\mspbwr.exe');
     DeleteFile('C:\WINDOWS\system32\mspbx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspbx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspce.exe');
     DeleteFile('C:\WINDOWS\system32\mspce.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspci.exe');
     DeleteFile('C:\WINDOWS\system32\mspci.exe');
     DeleteFile('C:\WINDOWS\system32\mspcuts.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspcuts.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspdvk.exe');
     DeleteFile('C:\WINDOWS\system32\mspdvk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspewm.exe');
     DeleteFile('C:\WINDOWS\system32\mspewm.exe');
     DeleteFile('C:\WINDOWS\system32\mspfwkm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspfwkm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspgrps.exe');
     DeleteFile('C:\WINDOWS\system32\mspgrps.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspiwxeq.exe');
     DeleteFile('C:\WINDOWS\system32\mspiwxeq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspjvyaw.exe');
     DeleteFile('C:\WINDOWS\system32\mspjvyaw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msplbsoe.exe');
     DeleteFile('C:\WINDOWS\system32\msplbsoe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msplp.exe');
     DeleteFile('C:\WINDOWS\system32\msplp.exe');
     DeleteFile('C:\WINDOWS\system32\msplqng.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msplqng.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspnbixd.exe');
     DeleteFile('C:\WINDOWS\system32\mspnbixd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspoxdxq.exe');
     DeleteFile('C:\WINDOWS\system32\mspoxdxq.exe');
     DeleteFile('C:\WINDOWS\system32\msppn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msppn.exe');
     DeleteFile('C:\WINDOWS\system32\msprkq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msprkq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msprleev.exe');
     DeleteFile('C:\WINDOWS\system32\msprleev.exe');
     DeleteFile('C:\WINDOWS\system32\mspswndq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspswndq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msptfiak.exe');
     DeleteFile('C:\WINDOWS\system32\msptfiak.exe');
     DeleteFile('C:\WINDOWS\system32\msptimuh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msptimuh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspuu.exe');
     DeleteFile('C:\WINDOWS\system32\mspuu.exe');
     DeleteFile('C:\WINDOWS\system32\mspuujoe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspuujoe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspuyc.exe');
     DeleteFile('C:\WINDOWS\system32\mspuyc.exe');
     DeleteFile('C:\WINDOWS\system32\mspvaat.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspvaat.exe');
     DeleteFile('C:\WINDOWS\system32\mspverk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspverk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspwd.exe');
     DeleteFile('C:\WINDOWS\system32\mspwd.exe');
     DeleteFile('C:\WINDOWS\system32\mspwelz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspwelz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspwivh.exe');
     DeleteFile('C:\WINDOWS\system32\mspwivh.exe');
     DeleteFile('C:\WINDOWS\system32\mspwn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspwn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspwu.exe');
     DeleteFile('C:\WINDOWS\system32\mspwu.exe');
     DeleteFile('C:\WINDOWS\system32\mspxd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspxd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspynnjo.exe');
     DeleteFile('C:\WINDOWS\system32\mspynnjo.exe');
     DeleteFile('C:\WINDOWS\system32\mspzfj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mspzfj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqagmf.exe');
     DeleteFile('C:\WINDOWS\system32\msqagmf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqbpn.exe');
     DeleteFile('C:\WINDOWS\system32\msqbpn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqbzyoa.exe');
     DeleteFile('C:\WINDOWS\system32\msqbzyoa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqdbd.exe');
     DeleteFile('C:\WINDOWS\system32\msqdbd.exe');
     DeleteFile('C:\WINDOWS\system32\msqdqtnd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqdqtnd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqecgqa.exe');
     DeleteFile('C:\WINDOWS\system32\msqecgqa.exe');
     DeleteFile('C:\WINDOWS\system32\msqfsren.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqfsren.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqgto.exe');
     DeleteFile('C:\WINDOWS\system32\msqgto.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqho.exe');
     DeleteFile('C:\WINDOWS\system32\msqho.exe');
     DeleteFile('C:\WINDOWS\system32\msqifa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqifa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqiip.exe');
     DeleteFile('C:\WINDOWS\system32\msqiip.exe');
     DeleteFile('C:\WINDOWS\system32\msqixb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqixb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqjfd.exe');
     DeleteFile('C:\WINDOWS\system32\msqjfd.exe');
     DeleteFile('C:\WINDOWS\system32\msqkxbew.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqkxbew.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqmygz.exe');
     DeleteFile('C:\WINDOWS\system32\msqmygz.exe');
     DeleteFile('C:\WINDOWS\system32\msqnznn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqnznn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqpdz.exe');
     DeleteFile('C:\WINDOWS\system32\msqpdz.exe');
     DeleteFile('C:\WINDOWS\system32\msqphix.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqphix.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqps.exe');
     DeleteFile('C:\WINDOWS\system32\msqps.exe');
     DeleteFile('C:\WINDOWS\system32\msqqe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqqe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqqjxi.exe');
     DeleteFile('C:\WINDOWS\system32\msqqjxi.exe');
     DeleteFile('C:\WINDOWS\system32\msqrij.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqrij.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqrv.exe');
     DeleteFile('C:\WINDOWS\system32\msqrv.exe');
     DeleteFile('C:\WINDOWS\system32\msqsqs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqsqs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqsrv.exe');
     DeleteFile('C:\WINDOWS\system32\msqsrv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqtqly.exe');
     DeleteFile('C:\WINDOWS\system32\msqtqly.exe');
     DeleteFile('C:\WINDOWS\system32\msqwtugz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqwtugz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqxjy.exe');
     DeleteFile('C:\WINDOWS\system32\msqxjy.exe');
     DeleteFile('C:\WINDOWS\system32\msqzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msqzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrbjsu.exe');
     DeleteFile('C:\WINDOWS\system32\msrbjsu.exe');
     DeleteFile('C:\WINDOWS\system32\msrbooq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrbooq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrbx.exe');
     DeleteFile('C:\WINDOWS\system32\msrbx.exe');
     DeleteFile('C:\WINDOWS\system32\msrcunxe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrcunxe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrddv.exe');
     DeleteFile('C:\WINDOWS\system32\msrddv.exe');
     DeleteFile('C:\WINDOWS\system32\msrdkop.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrdkop.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msreone.exe');
     DeleteFile('C:\WINDOWS\system32\msreone.exe');
     DeleteFile('C:\WINDOWS\system32\msrfismu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrfismu.exe');
     DeleteFile('C:\WINDOWS\system32\msrfjdwm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrfjdwm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrfjf.exe');
     DeleteFile('C:\WINDOWS\system32\msrfjf.exe');
     DeleteFile('C:\WINDOWS\system32\msrfjkr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrfjkr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrgqnb.exe');
     DeleteFile('C:\WINDOWS\system32\msrgqnb.exe');
     DeleteFile('C:\WINDOWS\system32\msrhwkxf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrhwkxf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrii.exe');
     DeleteFile('C:\WINDOWS\system32\msrii.exe');
     DeleteFile('C:\WINDOWS\system32\msrjktjs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrjktjs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrjmva.exe');
     DeleteFile('C:\WINDOWS\system32\msrjmva.exe');
     DeleteFile('C:\WINDOWS\system32\msrkkd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrkkd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrlvis.exe');
     DeleteFile('C:\WINDOWS\system32\msrlvis.exe');
     DeleteFile('C:\WINDOWS\system32\msrmnvnx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrmnvnx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrmtss.exe');
     DeleteFile('C:\WINDOWS\system32\msrmtss.exe');
     DeleteFile('C:\WINDOWS\system32\msrozd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrozd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrptx.exe');
     DeleteFile('C:\WINDOWS\system32\msrptx.exe');
     DeleteFile('C:\WINDOWS\system32\msrqmr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrqmr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrqwjd.exe');
     DeleteFile('C:\WINDOWS\system32\msrqwjd.exe');
     DeleteFile('C:\WINDOWS\system32\msrrfsta.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrrfsta.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrrhop.exe');
     DeleteFile('C:\WINDOWS\system32\msrrhop.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrrlql.exe');
     DeleteFile('C:\WINDOWS\system32\msrrlql.exe');
     DeleteFile('C:\WINDOWS\system32\msrsf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrsf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrsy.exe');
     DeleteFile('C:\WINDOWS\system32\msrsy.exe');
     DeleteFile('C:\WINDOWS\system32\msruensn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msruensn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrweqot.exe');
     DeleteFile('C:\WINDOWS\system32\msrweqot.exe');
     DeleteFile('C:\WINDOWS\system32\msrwxw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrwxw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrxb.exe');
     DeleteFile('C:\WINDOWS\system32\msrxb.exe');
     DeleteFile('C:\WINDOWS\system32\msrxch.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrxch.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msrxwwrd.exe');
     DeleteFile('C:\WINDOWS\system32\msrxwwrd.exe');
     DeleteFile('C:\WINDOWS\system32\msryzwha.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msryzwha.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssahmto.exe');
     DeleteFile('C:\WINDOWS\system32\mssahmto.exe');
     DeleteFile('C:\WINDOWS\system32\mssbgo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssbgo.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssewcx.exe');
     DeleteFile('C:\WINDOWS\system32\mssewcx.exe');
     DeleteFile('C:\WINDOWS\system32\mssfxr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssfxr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssfyp.exe');
     DeleteFile('C:\WINDOWS\system32\mssfyp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssglgr.exe');
     DeleteFile('C:\WINDOWS\system32\mssglgr.exe');
     DeleteFile('C:\WINDOWS\system32\mssgnrhl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssgnrhl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssgrxf.exe');
     DeleteFile('C:\WINDOWS\system32\mssgrxf.exe');
     DeleteFile('C:\WINDOWS\system32\msshukf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msshukf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssib.exe');
     DeleteFile('C:\WINDOWS\system32\mssib.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssien.exe');
     DeleteFile('C:\WINDOWS\system32\mssien.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssjpq.exe');
     DeleteFile('C:\WINDOWS\system32\mssjpq.exe');
     DeleteFile('C:\WINDOWS\system32\mssjso.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssjso.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msskuha.exe');
     DeleteFile('C:\WINDOWS\system32\msskuha.exe');
     DeleteFile('C:\WINDOWS\system32\msslambc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msslambc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msslogh.exe');
     DeleteFile('C:\WINDOWS\system32\msslogh.exe');
     DeleteFile('C:\WINDOWS\system32\mssneqa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssneqa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssnfdb.exe');
     DeleteFile('C:\WINDOWS\system32\mssnfdb.exe');
     DeleteFile('C:\WINDOWS\system32\mssph.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssph.exe');
     DeleteFile('C:\WINDOWS\system32\msspm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msspm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msspnxtx.exe');
     DeleteFile('C:\WINDOWS\system32\msspnxtx.exe');
     DeleteFile('C:\WINDOWS\system32\mssqbcjz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssqbcjz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssqczpg.exe');
     DeleteFile('C:\WINDOWS\system32\mssqczpg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssqi.exe');
     DeleteFile('C:\WINDOWS\system32\mssqi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssqpuot.exe');
     DeleteFile('C:\WINDOWS\system32\mssqpuot.exe');
     DeleteFile('C:\WINDOWS\system32\mssrcu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssrcu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssshcph.exe');
     DeleteFile('C:\WINDOWS\system32\mssshcph.exe');
     DeleteFile('C:\WINDOWS\system32\mssszu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssszu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msstb.exe');
     DeleteFile('C:\WINDOWS\system32\msstb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msstc.exe');
     DeleteFile('C:\WINDOWS\system32\msstc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msstfr.exe');
     DeleteFile('C:\WINDOWS\system32\msstfr.exe');
     DeleteFile('C:\WINDOWS\system32\mssthox.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssthox.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msstp.exe');
     DeleteFile('C:\WINDOWS\system32\msstp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssty.exe');
     DeleteFile('C:\WINDOWS\system32\mssty.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssugol.exe');
     DeleteFile('C:\WINDOWS\system32\mssugol.exe');
     DeleteFile('C:\WINDOWS\system32\mssvdem.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssvdem.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssvkvzk.exe');
     DeleteFile('C:\WINDOWS\system32\mssvkvzk.exe');
     DeleteFile('C:\WINDOWS\system32\mssvpjl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssvpjl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssxj.exe');
     DeleteFile('C:\WINDOWS\system32\mssxj.exe');
     DeleteFile('C:\WINDOWS\system32\mssxnxdq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssxnxdq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mssxzs.exe');
     DeleteFile('C:\WINDOWS\system32\mssxzs.exe');
     DeleteFile('C:\WINDOWS\system32\msszkzr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msszkzr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msszqe.exe');
     DeleteFile('C:\WINDOWS\system32\msszqe.exe');
     DeleteFile('C:\WINDOWS\system32\msszrj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msszrj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msszvfn.exe');
     DeleteFile('C:\WINDOWS\system32\msszvfn.exe');
     DeleteFile('C:\WINDOWS\system32\mstal.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstal.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstatl.exe');
     DeleteFile('C:\WINDOWS\system32\mstatl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstecbs.exe');
     DeleteFile('C:\WINDOWS\system32\mstecbs.exe');
     DeleteFile('C:\WINDOWS\system32\mstemvz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstemvz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstfdi.exe');
     DeleteFile('C:\WINDOWS\system32\mstfdi.exe');
     DeleteFile('C:\WINDOWS\system32\mstgdjb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstgdjb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstggn.exe');
     DeleteFile('C:\WINDOWS\system32\mstggn.exe');
     DeleteFile('C:\WINDOWS\system32\msthvwb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msthvwb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstiafu.exe');
     DeleteFile('C:\WINDOWS\system32\mstiafu.exe');
     DeleteFile('C:\WINDOWS\system32\mstir.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstir.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstizjxf.exe');
     DeleteFile('C:\WINDOWS\system32\mstizjxf.exe');
     DeleteFile('C:\WINDOWS\system32\mstjw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstjw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstkwz.exe');
     DeleteFile('C:\WINDOWS\system32\mstkwz.exe');
     DeleteFile('C:\WINDOWS\system32\mstkx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstkx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstlfcxd.exe');
     DeleteFile('C:\WINDOWS\system32\mstlfcxd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstma.exe');
     DeleteFile('C:\WINDOWS\system32\mstma.exe');
     DeleteFile('C:\WINDOWS\system32\mstps.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstps.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstrz.exe');
     DeleteFile('C:\WINDOWS\system32\mstrz.exe');
     DeleteFile('C:\WINDOWS\system32\mstumaw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstumaw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstvs.exe');
     DeleteFile('C:\WINDOWS\system32\mstvs.exe');
     DeleteFile('C:\WINDOWS\system32\mstwoey.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstwoey.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mstyhtij.exe');
     DeleteFile('C:\WINDOWS\system32\mstyhtij.exe');
     DeleteFile('C:\WINDOWS\system32\msuao.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuao.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msubdgb.exe');
     DeleteFile('C:\WINDOWS\system32\msubdgb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msucf.exe');
     DeleteFile('C:\WINDOWS\system32\msucf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msucpg.exe');
     DeleteFile('C:\WINDOWS\system32\msucpg.exe');
     DeleteFile('C:\WINDOWS\system32\msudqf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msudqf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msudzwgw.exe');
     DeleteFile('C:\WINDOWS\system32\msudzwgw.exe');
     DeleteFile('C:\WINDOWS\system32\msuge.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuge.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msugvq.exe');
     DeleteFile('C:\WINDOWS\system32\msugvq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuhtgw.exe');
     DeleteFile('C:\WINDOWS\system32\msuhtgw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuihnnq.exe');
     DeleteFile('C:\WINDOWS\system32\msuihnnq.exe');
     DeleteFile('C:\WINDOWS\system32\msuilg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuilg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuipqi.exe');
     DeleteFile('C:\WINDOWS\system32\msuipqi.exe');
     DeleteFile('C:\WINDOWS\system32\msuivj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuivj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msukuxat.exe');
     DeleteFile('C:\WINDOWS\system32\msukuxat.exe');
     DeleteFile('C:\WINDOWS\system32\msulsk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msulsk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msunjlj.exe');
     DeleteFile('C:\WINDOWS\system32\msunjlj.exe');
     DeleteFile('C:\WINDOWS\system32\msunode.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msunode.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msunz.exe');
     DeleteFile('C:\WINDOWS\system32\msunz.exe');
     DeleteFile('C:\WINDOWS\system32\msuoe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuoe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuoziq.exe');
     DeleteFile('C:\WINDOWS\system32\msuoziq.exe');
     DeleteFile('C:\WINDOWS\system32\msupxqy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msupxqy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuqt.exe');
     DeleteFile('C:\WINDOWS\system32\msuqt.exe');
     DeleteFile('C:\WINDOWS\system32\msusdc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msusdc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msusojg.exe');
     DeleteFile('C:\WINDOWS\system32\msusojg.exe');
     DeleteFile('C:\WINDOWS\system32\msuuqx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuuqx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuwe.exe');
     DeleteFile('C:\WINDOWS\system32\msuwe.exe');
     DeleteFile('C:\WINDOWS\system32\msuwiql.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuwiql.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuwpkfh.exe');
     DeleteFile('C:\WINDOWS\system32\msuwpkfh.exe');
     DeleteFile('C:\WINDOWS\system32\msuxcjqp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuxcjqp.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuxwcj.exe');
     DeleteFile('C:\WINDOWS\system32\msuxwcj.exe');
     DeleteFile('C:\WINDOWS\system32\msuzox.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuzox.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msuzthg.exe');
     DeleteFile('C:\WINDOWS\system32\msuzthg.exe');
     DeleteFile('C:\WINDOWS\system32\msvaayjm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvaayjm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvat.exe');
     DeleteFile('C:\WINDOWS\system32\msvat.exe');
     DeleteFile('C:\WINDOWS\system32\msvcm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvcn.exe');
     DeleteFile('C:\WINDOWS\system32\msvcn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvexchj.exe');
     DeleteFile('C:\WINDOWS\system32\msvexchj.exe');
     DeleteFile('C:\WINDOWS\system32\msvezwe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvezwe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvfqnn.exe');
     DeleteFile('C:\WINDOWS\system32\msvfqnn.exe');
     DeleteFile('C:\WINDOWS\system32\msvibyd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvibyd.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvjc.exe');
     DeleteFile('C:\WINDOWS\system32\msvjc.exe');
     DeleteFile('C:\WINDOWS\system32\msvjxiti.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvjxiti.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvksenn.exe');
     DeleteFile('C:\WINDOWS\system32\msvksenn.exe');
     DeleteFile('C:\WINDOWS\system32\msvldvc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvldvc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvnbxn.exe');
     DeleteFile('C:\WINDOWS\system32\msvnbxn.exe');
     DeleteFile('C:\WINDOWS\system32\msvncdut.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvncdut.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvqgy.exe');
     DeleteFile('C:\WINDOWS\system32\msvqgy.exe');
     DeleteFile('C:\WINDOWS\system32\msvqok.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvqok.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvrgub.exe');
     DeleteFile('C:\WINDOWS\system32\msvrgub.exe');
     DeleteFile('C:\WINDOWS\system32\msvrz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvrz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvtgdy.exe');
     DeleteFile('C:\WINDOWS\system32\msvtgdy.exe');
     DeleteFile('C:\WINDOWS\system32\msvtrl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvtrl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvue.exe');
     DeleteFile('C:\WINDOWS\system32\msvue.exe');
     DeleteFile('C:\WINDOWS\system32\msvugtqt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvugtqt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvwe.exe');
     DeleteFile('C:\WINDOWS\system32\msvwe.exe');
     DeleteFile('C:\WINDOWS\system32\msvwupge.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvwupge.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvxxv.exe');
     DeleteFile('C:\WINDOWS\system32\msvxxv.exe');
     DeleteFile('C:\WINDOWS\system32\msvyixz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvyixz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvynobx.exe');
     DeleteFile('C:\WINDOWS\system32\msvynobx.exe');
     DeleteFile('C:\WINDOWS\system32\msvzre.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msvzre.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswawmoj.exe');
     DeleteFile('C:\WINDOWS\system32\mswawmoj.exe');
     DeleteFile('C:\WINDOWS\system32\mswbdsrt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswbdsrt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswbi.exe');
     DeleteFile('C:\WINDOWS\system32\mswbi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswcpe.exe');
     DeleteFile('C:\WINDOWS\system32\mswcpe.exe');
     DeleteFile('C:\WINDOWS\system32\mswesil.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswesil.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswfrm.exe');
     DeleteFile('C:\WINDOWS\system32\mswfrm.exe');
     DeleteFile('C:\WINDOWS\system32\mswgq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswgq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswhu.exe');
     DeleteFile('C:\WINDOWS\system32\mswhu.exe');
     DeleteFile('C:\WINDOWS\system32\mswhwsx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswhwsx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswjlik.exe');
     DeleteFile('C:\WINDOWS\system32\mswjlik.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswjqg.exe');
     DeleteFile('C:\WINDOWS\system32\mswjqg.exe');
     DeleteFile('C:\WINDOWS\system32\mswjrxsz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswjrxsz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswkv.exe');
     DeleteFile('C:\WINDOWS\system32\mswkv.exe');
     DeleteFile('C:\WINDOWS\system32\mswll.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswll.exe');
     DeleteFile('C:\WINDOWS\system32\mswlmjkj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswlmjkj.exe');
     DeleteFile('C:\WINDOWS\system32\mswmbu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswmbu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswmslbd.exe');
     DeleteFile('C:\WINDOWS\system32\mswmslbd.exe');
     DeleteFile('C:\WINDOWS\system32\mswmud.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswmud.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswnxcx.exe');
     DeleteFile('C:\WINDOWS\system32\mswnxcx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswqcfei.exe');
     DeleteFile('C:\WINDOWS\system32\mswqcfei.exe');
     DeleteFile('C:\WINDOWS\system32\mswrvqkt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswrvqkt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswsx.exe');
     DeleteFile('C:\WINDOWS\system32\mswsx.exe');
     DeleteFile('C:\WINDOWS\system32\mswuk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswuk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswvr.exe');
     DeleteFile('C:\WINDOWS\system32\mswvr.exe');
     DeleteFile('C:\WINDOWS\system32\mswwqn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswwqn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswwro.exe');
     DeleteFile('C:\WINDOWS\system32\mswwro.exe');
     DeleteFile('C:\WINDOWS\system32\mswxqofc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mswxqofc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxbgyqi.exe');
     DeleteFile('C:\WINDOWS\system32\msxbgyqi.exe');
     DeleteFile('C:\WINDOWS\system32\msxcssc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxcssc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxdo.exe');
     DeleteFile('C:\WINDOWS\system32\msxdo.exe');
     DeleteFile('C:\WINDOWS\system32\msxegv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxegv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxeknxy.exe');
     DeleteFile('C:\WINDOWS\system32\msxeknxy.exe');
     DeleteFile('C:\WINDOWS\system32\msxenmmc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxenmmc.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxfkahb.exe');
     DeleteFile('C:\WINDOWS\system32\msxfkahb.exe');
     DeleteFile('C:\WINDOWS\system32\msxfm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxfm.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxiax.exe');
     DeleteFile('C:\WINDOWS\system32\msxiax.exe');
     DeleteFile('C:\WINDOWS\system32\msxicz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxicz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxineir.exe');
     DeleteFile('C:\WINDOWS\system32\msxineir.exe');
     DeleteFile('C:\WINDOWS\system32\msxisf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxisf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxkb.exe');
     DeleteFile('C:\WINDOWS\system32\msxkb.exe');
     DeleteFile('C:\WINDOWS\system32\msxkwmre.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxkwmre.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxlxhkd.exe');
     DeleteFile('C:\WINDOWS\system32\msxlxhkd.exe');
     DeleteFile('C:\WINDOWS\system32\msxmrpyj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxmrpyj.exe');
     DeleteFile('C:\WINDOWS\system32\msxmstf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxmstf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxngswr.exe');
     DeleteFile('C:\WINDOWS\system32\msxngswr.exe');
     DeleteFile('C:\WINDOWS\system32\msxpbra.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxpbra.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxpzy.exe');
     DeleteFile('C:\WINDOWS\system32\msxpzy.exe');
     DeleteFile('C:\WINDOWS\system32\msxrsmv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxrsmv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxslc.exe');
     DeleteFile('C:\WINDOWS\system32\msxslc.exe');
     DeleteFile('C:\WINDOWS\system32\msxugj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxugj.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxuo.exe');
     DeleteFile('C:\WINDOWS\system32\msxuo.exe');
     DeleteFile('C:\WINDOWS\system32\msxuxw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxuxw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxydhn.exe');
     DeleteFile('C:\WINDOWS\system32\msxydhn.exe');
     DeleteFile('C:\WINDOWS\system32\msxznlai.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxznlai.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msxzql.exe');
     DeleteFile('C:\WINDOWS\system32\msxzql.exe');
     DeleteFile('C:\WINDOWS\system32\msyawpof.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyawpof.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msybr.exe');
     DeleteFile('C:\WINDOWS\system32\msybr.exe');
     DeleteFile('C:\WINDOWS\system32\msybuw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msybuw.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyby.exe');
     DeleteFile('C:\WINDOWS\system32\msyby.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyckb.exe');
     DeleteFile('C:\WINDOWS\system32\msyckb.exe');
     DeleteFile('C:\WINDOWS\system32\msycpvt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msycpvt.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msycsv.exe');
     DeleteFile('C:\WINDOWS\system32\msycsv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msydmgeu.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msydtt.exe');
     DeleteFile('C:\WINDOWS\system32\msydtt.exe');
     DeleteFile('C:\WINDOWS\system32\msyes.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyes.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyexfv.exe');
     DeleteFile('C:\WINDOWS\system32\msyexfv.exe');
     DeleteFile('C:\WINDOWS\system32\msyfqs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyfqs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msygqlb.exe');
     DeleteFile('C:\WINDOWS\system32\msygqlb.exe');
     DeleteFile('C:\WINDOWS\system32\msyibwh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyibwh.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyihn.exe');
     DeleteFile('C:\WINDOWS\system32\msyihn.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyjur.exe');
     DeleteFile('C:\WINDOWS\system32\msyjur.exe');
     DeleteFile('C:\WINDOWS\system32\msyjzxv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyjzxv.exe');
     DeleteFile('C:\WINDOWS\system32\msyli.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyli.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msymgl.exe');
     DeleteFile('C:\WINDOWS\system32\msymgl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msymjt.exe');
     DeleteFile('C:\WINDOWS\system32\msymjt.exe');
     DeleteFile('C:\WINDOWS\system32\msynx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msynx.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msypdxs.exe');
     DeleteFile('C:\WINDOWS\system32\msypdxs.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msypevy.exe');
     DeleteFile('C:\WINDOWS\system32\msypevy.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyqh.exe');
     DeleteFile('C:\WINDOWS\system32\msyqh.exe');
     DeleteFile('C:\WINDOWS\system32\msyrb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyrb.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msysptm.exe');
     DeleteFile('C:\WINDOWS\system32\msysptm.exe');
     DeleteFile('C:\WINDOWS\system32\msytono.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msytono.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msywbxxd.exe');
     DeleteFile('C:\WINDOWS\system32\msywbxxd.exe');
     DeleteFile('C:\WINDOWS\system32\msywe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msywe.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msywmu.exe');
     DeleteFile('C:\WINDOWS\system32\msywmu.exe');
     DeleteFile('C:\WINDOWS\system32\msywtf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msywtf.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyww.exe');
     DeleteFile('C:\WINDOWS\system32\msyww.exe');
     DeleteFile('C:\WINDOWS\system32\msyxgv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyxgv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyyht.exe');
     DeleteFile('C:\WINDOWS\system32\msyyht.exe');
     DeleteFile('C:\WINDOWS\system32\msyyivi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyyivi.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyymco.exe');
     DeleteFile('C:\WINDOWS\system32\msyymco.exe');
     DeleteFile('C:\WINDOWS\system32\msyyzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyyzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msyzehzz.exe');
     DeleteFile('C:\WINDOWS\system32\msyzehzz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszcagl.exe');
     DeleteFile('C:\WINDOWS\system32\mszcagl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszdadr.exe');
     DeleteFile('C:\WINDOWS\system32\mszdadr.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszdx.exe');
     DeleteFile('C:\WINDOWS\system32\mszdx.exe');
     DeleteFile('C:\WINDOWS\system32\mszdzeoq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszdzeoq.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszfazih.exe');
     DeleteFile('C:\WINDOWS\system32\mszfazih.exe');
     DeleteFile('C:\WINDOWS\system32\mszfsuz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszfsuz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszgdvmg.exe');
     DeleteFile('C:\WINDOWS\system32\mszgdvmg.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszhyluv.exe');
     DeleteFile('C:\WINDOWS\system32\mszhyluv.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszjfwo.exe');
     DeleteFile('C:\WINDOWS\system32\mszjfwo.exe');
     DeleteFile('C:\WINDOWS\system32\mszkkl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszkkl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszknqwo.exe');
     DeleteFile('C:\WINDOWS\system32\mszknqwo.exe');
     DeleteFile('C:\WINDOWS\system32\mszpdjfl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszpdjfl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszrjgl.exe');
     DeleteFile('C:\WINDOWS\system32\mszrjgl.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszru.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszslddd.exe');
     DeleteFile('C:\WINDOWS\system32\mszru.exe');
     DeleteFile('C:\WINDOWS\system32\mszslddd.exe');
     DeleteFile('C:\WINDOWS\system32\mszsovuz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszsovuz.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msztlem.exe');
     DeleteFile('C:\WINDOWS\system32\msztlem.exe');
     BC_DeleteFile('C:\WINDOWS\system32\msztq.exe');
     DeleteFile('C:\WINDOWS\system32\msztq.exe');
     DeleteFile('C:\WINDOWS\system32\mszud.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszud.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszuosb.exe');
     DeleteFile('C:\WINDOWS\system32\mszuosb.exe');
     DeleteFile('C:\WINDOWS\system32\mszvva.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszvva.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszxll.exe');
     DeleteFile('C:\WINDOWS\system32\mszxll.exe');
     DeleteFile('C:\WINDOWS\system32\mszxphfa.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszxphfa.exe');
     DeleteFile('C:\WINDOWS\system32\mszyzk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\mszyzk.exe');
     BC_DeleteFile('C:\WINDOWS\system32\svchost.dll');
     DeleteFile('C:\WINDOWS\system32\svchost.dll');
     BC_DeleteFile('C:\WINDOWS\system32\svchost.exe:ext.exe:$DATA');
     DeleteFile('C:\WINDOWS\system32\svchost.exe:ext.exe:$DATA');
     BC_DeleteFile('C:\WINDOWS\system32\winexec.dll');
     DeleteFile('C:\WINDOWS\system32\winexec.dll');
     BC_DeleteFile('C:\WINDOWS\system32\winres.dll');
     DeleteFile('C:\WINDOWS\system32\winres.dll');
     BC_DeleteFile('C:\WINDOWS\services.exe');
     DeleteFile('C:\WINDOWS\services.exe');
     BC_DeleteFile('E:\autorun.inf');
     DeleteFile('E:\autorun.inf');
     BC_DeleteFile('E:\RECYCLER\autorun.exe');
     DeleteFile('E:\RECYCLER\autorun.exe');
    BC_ImportDeletedList;
    ExecuteSysClean;
    BC_Activate;
    RebootWindows(true);
    end.
  • Note: When you run the script, your PC will be restarted
  • Click Run
  • Restart your PC if it doesn't do it automatically.

ON COMPLETION

  • Start AVZ.
  • Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Analysis" check box.
  • Click on the "Execute selected scripts".
  • A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post


Finally reboot to normal mode

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • 0

#5
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Hi,

Thanks for pointing out the USB issue!

Well I was able to run the first two actions which were around AVZ : I ran the script that you pasted in your message and then after re-boot ran the "Advanced System Analysis" and am attaching the log virusinfo_syscheck.zip here.

However when I re-booted in normal mode as advised before downloading ComboFix, I was not able to make progress as I still got that error message saying the system would shut down in 60 seconds (it used to reverse count and tick in the dialog which also had reference to services.exe at System32). So, I could not run this step but from this error message I see that there is still some trace of it left.

Please let me know if I can download ComboFix in "SAFE MODE WITH NETWORKING" and run from there which I think may be possible. Else, please advise next steps.

Thanks!

Attached Files


  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Yes you can - you can also run it in safe mode although it may moan
  • 0

#7
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Hi,

I executed ComboFix in SAFE with NETWORKING mode. In the first attempt I got the following message in a dialog box with just an option to accept OK:

Were you trying to run CFScript?

The name, CFScript appears to be incorrectly spelt.


Second time around I was able to run it successfully and it also installed the Microsoft Recovery Console. Before re-booting it asked me to note the names of some files it had found. The following was that list:

c:\WINDOWS\system32\drivers\SKYNETsklvcxmm.sys
c:\WINDOWS\system32\SKYNETtqlrviam.dll
c:\WINDOWS\system32\SKYNETpyvrftka.dat
c:\WINDOWS\system32\SKYNETpjxgdugy.dll
c:\WINDOWS\system32\SKYNETndrksjw.dat




The system re-booted to a normal start (not in SAFE MODE) and again the message box informing that the system will shutdown in 60 seconds with countdown appeared.

I again re-booted in SAFE mode to get the log in the location you mentioned which was C;/COMBOFIX.txt. However I was not able to find such a file. I then did a search for ComboFix on the hard disk and to my surprise found that it was showing several (maby around a 100 and it is still searching and creating/finding more!) of "C:\ComboFix" which is being shown as a Folder in "Type" column of the search result. It is not possible to have the same file/folder name in the same location with so many instances and so there is something spooky there. Also the icon of the ComboFix is not appearing as a folder in the search result but it looks like an icon for an application with an image of a monitor.


I am also seeing some of the following Applications in C:\ which look very suspicious:

cnuhbbf which is 18KB
lsass which is 18 KB
mktrrepj which is 88 KB
twpq which is 88 KB
wmcqqk which is 1 KB
xlhxx which shows an a zipped file in the icon against its name but is listed as an application and is of 228 KB


Under C:\ I also see a folder called Qoobox which has a modified time stamp of the time when I executed ComboFix ( around the same time approx).

Hence I am not able to locate and upload the log file which you had asked for ComboFix.
  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Qoobox is Combofixes quarantine area. Lets now take out the rootkit files and see how we can go from there - again safe mode is OK

1. Please download The Avenger2 by Swandog46 to your Desktop.
  • Right click on the Avenger.zip folder and select "Extract All..."
  • Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:

Files to delete:
c:\WINDOWS\system32\drivers\SKYNETsklvcxmm.sys
c:\WINDOWS\system32\SKYNETtqlrviam.dll
c:\WINDOWS\system32\SKYNETpyvrftka.dat
c:\WINDOWS\system32\SKYNETpjxgdugy.dll
c:\WINDOWS\system32\SKYNETndrksjw.dat

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply
  • 0

#9
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
The Avenger part went off fine in terms of running the program and getting it to shutdown for re-boot. However, when it re-booted ( and I did not interrupt for a SAFE mode but let it re-boot as it would) the same issue of the shutdown issue happened. The sequence is that I first see a prompt which says in a typical Microsoft error box, among other things (as immediately below in italics) and then I click "Don't Send" and then it disappears and a strange sized (not the usual windows one) pop up appears to inform that the system will shutdown in 60 seconds and is starts a reverse count ( I think it is a reverse count). I am not able to take a screenshot of this since the system itself hangs at this point, but can take a picture with my camera phone of this error message if you suggest since this seems to be some kind of stubborn infection.

Services and Controller app has encountered a problem and needs to close. We are sorry for the inconvenience.

blah blah ...

Please tell Microsoft about this problem:

<three choices with a button each> : DEBUG SEND ERROR REPORT DON"T SEND


With this the system again hung and I have now re-booted in SAFE with NETWORKING mode and am pasting the contents of the C:/avenger.txt file aske for :


Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "c:\WINDOWS\system32\drivers\SKYNETsklvcxmm.sys" not found!
Deletion of file "c:\WINDOWS\system32\drivers\SKYNETsklvcxmm.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\WINDOWS\system32\SKYNETtqlrviam.dll" not found!
Deletion of file "c:\WINDOWS\system32\SKYNETtqlrviam.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\WINDOWS\system32\SKYNETpyvrftka.dat" not found!
Deletion of file "c:\WINDOWS\system32\SKYNETpyvrftka.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\WINDOWS\system32\SKYNETpjxgdugy.dll" not found!
Deletion of file "c:\WINDOWS\system32\SKYNETpjxgdugy.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\WINDOWS\system32\SKYNETndrksjw.dat" not found!
Deletion of file "c:\WINDOWS\system32\SKYNETndrksjw.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.



I would also like to mention that at a casual glance of the files in C:\, I would several suspicious files. I am pasting a screenshot with those files that can be seen. As I mentioned earlier, since I have an unrelated battery issue (battery has failed) the system date on my laptop is currently 17th Dec 2003 and most files you see that are formed around 11:55 AM on this date are related to the action which I just attempted. For records the system date on my laptop right now is 12:31 PM 12/17/2003.

Please advise if I can change the date and should set it to current in case it interferes with the investigation by having an older date. I do not want to change any parameters as part of this effort and so this question.

Thanks!

Attached Thumbnails

  • screenshot3.GIF

  • 0

#10
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK lets see if we can stop the annoyance - reboot to normal mode and immediately do the following



Click Start>Run and type "cmd", without the quotes, and click run then type "shutdown -a" to stop the timer

That should stop the reboot, then run combofix
  • 0

Advertisements


#11
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Sorry, but does not seem to be going ahead still. Here is the update from what I tried:

- I booted in normal mode and used the "shutdown -a" command in command prompt and sure that message disappeared but then the system hung. I tried to go to Windows Explorer to run ComboFix but the system would just not respond. I tried this few times with a re-boot but no luck. Some times I get a blue screen with the starting message:


A problem has been detected and Windows has been shutdown to prevent damage to your computer.

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears blah blah blah ....


I then tried to boot in SAFE WITH NETWORKING mode and run ComboFix again. This time I ran into some new issues than earlier:

First time I clicked YES when asked if I want to update ComboFix with an updated version. That started and I saw a % update on a small blue sreen that opened. However, around 45% it got stuck and went no further and I had to abort.

Next I re-booted and did not choose YES when asked if I want to update ComboFix hoping to skip that step and still run ComboFix. I then got the following error showing my system date:

DATE ERROR

Data Error: 2003-12-18
Check your settings

<OK>



I then tried to change the date by clicking on the date display in the systray but I got this message:

Windows cannot find 'C:\WINDOWS\system32\rundll32.exe. Make sure youy typed the name correctly, and then try again. To search for file, click the Start button, and then click Search.

I tried to change the date in the Normal mode also but got the same message. So, the system would not allow me to change the date and ComboFix does not seem to be executing even in SAFE MODE WITH NETWORKING without the date change.

Thanks
  • 0

#12
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hmm this is different - OK let me use one of my other programmes to see if I can resolve this. This programme works quite happily in safe mode

We will now do a deep search of your processes and files

Download avz4.zip from here
  • Unzip it to your desktop to a folder named avz4
  • Double click on AVZ.exe to run it.
  • Run an update by clicking the Auto Update button on the Right of the Log window: Posted Image
  • Click Start to begin the update
Note: If you recieve an error message, chose a different source, then click Start again


  • Start AVZ.
  • Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Analysis" check box.
  • Click on the “Execute selected scripts”.
  • Automatic scanning, healing and system check will be executed.
  • A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
  • It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
  • All applications will work properly after the system restart.

When restarted

  • Start AVZ.
  • Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Analysis" check box.
  • Click on the "Execute selected scripts".
  • A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach both zip files to your next post

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on Posted Image to insert the attachment into your post

  • 0

#13
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
OK!! Here is some b-r-e-a-k-i-n-g development!

This happened just after I had posted my previous post but had not seen your last reply that you posted a short while back. I was trying to change the date and tried to do it by setting the date in the SETUP mode which I entered as a boot option. It allowed me to change the date and booted back normally. I then tried to run ComboFix again in NORMAL mode. ( hmmmm .. I think it was normal mode .. sorry but with so many re-boots I may be mistaken but I hope it does not make much of a difference).

I was finally able to run ComboFix and get it to run its full process to what it showed as Stage50. Then it said, it will re-boot and I let it re-boot and it come up beautifully in normal mode with none of those nagging shutdown timers etc. However, when I went to look into C:\ for the ComboFix.txt I did not find it. I still found an item in the Windows explorer called ComboFix but it appeared as an application from the icon but was lister as Folder in the description( like last time) and not like a txt file. Apart from that, I also saw some of those suspiciously named files in C:\. I am attaching a screen grab from my Windows Explorer view where I could not find the ComboFix log. Notice the icon for C:\Combofix which is listed there as a folder. Let me know if you want me to double click this "folder" though the icon of the folder is not shown and may be malicious but from the last experience I doubt if it really is a folder.

Hence, I am not going ahead with the steps in your previous post and will wait for your advice if you want me to go that route or in the light of this development, do something different.

Thanks

Attached Files


  • 0

#14
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
OK as we are now in normal mode, run combofix one more time to see if it generates a log - it should just be a text file on the c drive not a folder or anything. Obviously CF has fixed some elements but I would like to see what's left - hold off on the AVZ run for the moment

Pretty soon you will be an expert
  • 0

#15
Michelle1123

Michelle1123

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Ok!! Some progress again:

When I executed ComboFix in NORMAL mode, this time it again asked me if I want to update but I declined. ( It had not asked me last time though and I thought with the correct date, that should go). Then it started as a process and I first saw a fleeting glimpse of a message on the screen which said something about looking for "CScript" and that it was not found or it failed. However soon after that it started to go into the various Completed Stage update on the screen.

It ran till Stage 50. Showed that it deleted some files (3 0or 4 only though) and said it was "Preparing Log Report" and lo behold it through up the log txt file open. This time ComboFix did not re-boot after completing the process.

Here is the log:

-------------------------------------------------------------------------------------------------------------

ComboFix 09-07-31.04 - xxx 08/02/2009 22:26.2.1 - NTFSx86
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\xxx\APPLIC~1\pic08.exe
c:\docume~1\xxx\APPLIC~1\wiaserva.log
c:\docume~1\xxx\APPLIC~1\wiaservg.log
.
---- Previous Run -------
.
C:\-1408294037
C:\cleanup.exe
c:\documents and settings\Administrator\Application Data\wiaserva.log
c:\documents and settings\Administrator\Application Data\wiaservg.log
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\xxx\Start Menu\Programs\StartUp\fmnupd32.exe
c:\documents and settings\xxx\Start Menu\Programs\StartUp\zqosys32.exe
C:\lsass.exe
c:\program files\Manson
c:\program files\Manson\liser.dll
c:\program files\Manson\liser.exe
c:\recycler\S-1-5-21-0243636035-3055115376-381863306-1556
c:\recycler\S-1-5-21-1026209070-6953395547-160821351-9855
c:\recycler\S-1-5-21-1303150885-6908542818-308897050-5236
c:\recycler\S-1-5-21-1634220307-6689002770-855434629-9974
c:\recycler\S-1-5-21-1901954806-7473642972-793036267-9985
c:\recycler\S-1-5-21-1908945973-6178644651-735921260-1191
c:\recycler\S-1-5-21-2340187649-6560454504-358757542-2213
c:\recycler\S-1-5-21-2927839151-1137017483-991512908-1376
c:\recycler\S-1-5-21-3526845162-2869008480-912405435-3600
c:\recycler\S-1-5-21-3546748290-6114838241-465845992-8466
c:\recycler\S-1-5-21-3873383695-1911073570-013778514-2231
c:\recycler\S-1-5-21-4078096108-9595016631-825672147-4798
c:\recycler\S-1-5-21-4151961318-1170760801-192205970-5302
c:\recycler\S-1-5-21-5065814614-8157562413-536377239-7833
c:\recycler\S-1-5-21-5346544343-6466490020-524946242-2020
c:\recycler\S-1-5-21-6149089765-3184450756-014037516-4302
c:\recycler\S-1-5-21-6366482827-3779046001-270197670-4257
c:\recycler\S-1-5-21-6386797559-2511548274-700069637-9279
c:\recycler\S-1-5-21-6724436404-8997016331-174111212-1148
c:\recycler\S-1-5-21-6747302668-5585004797-064543309-3964
c:\recycler\S-1-5-21-7455161812-1819813063-030900033-0614
c:\recycler\S-1-5-21-8420178833-5247546196-558048349-9929
c:\recycler\S-1-5-21-9344026462-5322328766-561739161-5128
c:\windows\dll
c:\windows\dll\RUNDLL32.exe
c:\windows\Installer\27e226.msp
c:\windows\Installer\3caf292.msp
c:\windows\jmnhhgrtja35ujghuykj6r8io9iujg81.exe
c:\windows\KBPK090802.log
c:\windows\system32\3361
c:\windows\system32\3361\mlog
c:\windows\system32\3361\services.exe
c:\windows\system32\6to4v32.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\bndmss.exe
c:\windows\system32\certstore.dat
c:\windows\system32\comsa32.sys
c:\windows\system32\drivers\acpi32.sys
c:\windows\system32\drivers\fips32cup.sys
c:\windows\system32\drivers\glaide32.sys
c:\windows\system32\drivers\i386si.sys
c:\windows\system32\drivers\ksi32sk.sys
c:\windows\system32\drivers\netsik.sys
c:\windows\system32\drivers\nicsk32.sys
c:\windows\system32\drivers\port135sik.sys
c:\windows\system32\drivers\securentm.sys
c:\windows\system32\drivers\SKYNETsklvcxmm.sys
c:\windows\system32\drivers\systemntmi.sys
c:\windows\system32\Iasex.dll
c:\windows\system32\install.log
c:\windows\system32\isadisk.sys
c:\windows\system32\lsass.dll
c:\windows\system32\mscdvdd.exe
c:\windows\system32\mscfngx.exe
c:\windows\system32\mschytph.exe
c:\windows\system32\mscifcl.exe
c:\windows\system32\mscoo.exe
c:\windows\system32\mscrsbj.exe
c:\windows\system32\mscsbfiv.exe
c:\windows\system32\mscslxc.exe
c:\windows\system32\mscunf.exe
c:\windows\system32\mscvqun.exe
c:\windows\system32\msdmord.exe
c:\windows\system32\msdnxz.exe
c:\windows\system32\msdokn.exe
c:\windows\system32\msdpttq.exe
c:\windows\system32\msdrh.exe
c:\windows\system32\msdxjdar.exe
c:\windows\system32\mseldhxe.exe
c:\windows\system32\mselmj.exe
c:\windows\system32\msetmrre.exe
c:\windows\system32\msffija.exe
c:\windows\system32\msfqmuwm.exe
c:\windows\system32\msfvdddc.exe
c:\windows\system32\msgblxb.exe
c:\windows\system32\msgcguo.exe
c:\windows\system32\msgnil.exe
c:\windows\system32\msgoagp.exe
c:\windows\system32\msgpe.exe
c:\windows\system32\msgqeb.exe
c:\windows\system32\msgqpopi.exe
c:\windows\system32\msgrnpso.exe
c:\windows\system32\msgtpodf.exe
c:\windows\system32\msgzo.exe
c:\windows\system32\mshbtl.exe
c:\windows\system32\msheqbja.exe
c:\windows\system32\mshhynw.exe
c:\windows\system32\mshjqka.exe
c:\windows\system32\mshsdug.exe
c:\windows\system32\mshvyg.exe
c:\windows\system32\mshwywnp.exe
c:\windows\system32\msibxfzf.exe
c:\windows\system32\msigaue.exe
c:\windows\system32\msihyxg.exe
c:\windows\system32\msiikjp.exe
c:\windows\system32\msilb.exe
c:\windows\system32\msinqztd.exe
c:\windows\system32\msiollbg.exe
c:\windows\system32\msipzwdw.exe
c:\windows\system32\msizser.exe
c:\windows\system32\msjgw.exe
c:\windows\system32\msjjle.exe
c:\windows\system32\msjsyw.exe
c:\windows\system32\msjtk.exe
c:\windows\system32\msjufms.exe
c:\windows\system32\msjuiscx.exe
c:\windows\system32\msjvjpny.exe
c:\windows\system32\msjxo.exe
c:\windows\system32\msjyga.exe
c:\windows\system32\msjzp.exe
c:\windows\system32\mskdrgp.exe
c:\windows\system32\mskdwxli.exe
c:\windows\system32\mskpkly.exe
c:\windows\system32\mskqc.exe
c:\windows\system32\mslaplaw.exe
c:\windows\system32\msllugiv.exe
c:\windows\system32\mslmx.exe
c:\windows\system32\mslqapme.exe
c:\windows\system32\mslsfvfd.exe
c:\windows\system32\msmaukd.exe
c:\windows\system32\msmmdzgl.exe
c:\windows\system32\msmvguhk.exe
c:\windows\system32\msmxtc.exe
c:\windows\system32\msnbjw.exe
c:\windows\system32\msnch.exe
c:\windows\system32\msnggz.exe
c:\windows\system32\msnikdy.exe
c:\windows\system32\msnor.exe
c:\windows\system32\msnpicwn.exe
c:\windows\system32\msnvazml.exe
c:\windows\system32\msocdvmm.exe
c:\windows\system32\msodow.exe
c:\windows\system32\msoltavw.exe
c:\windows\system32\msoluo.exe
c:\windows\system32\msoxcsce.exe
c:\windows\system32\msplm.exe
c:\windows\system32\mspmm.exe
c:\windows\system32\msppp.exe
c:\windows\system32\msqambpm.exe
c:\windows\system32\msqjm.exe
c:\windows\system32\msqsh.exe
c:\windows\system32\msqslf.exe
c:\windows\system32\msqtjdb.exe
c:\windows\system32\msquyb.exe
c:\windows\system32\msrahjpt.exe
c:\windows\system32\msrau.exe
c:\windows\system32\msref.exe
c:\windows\system32\msrir.exe
c:\windows\system32\msrmukxu.exe
c:\windows\system32\msrqsgfq.exe
c:\windows\system32\mssckuqf.exe
c:\windows\system32\mssjzxsj.exe
c:\windows\system32\mssxhhx.exe
c:\windows\system32\mstfz.exe
c:\windows\system32\mstjvc.exe
c:\windows\system32\mstmgpg.exe
c:\windows\system32\msuaq.exe
c:\windows\system32\msueje.exe
c:\windows\system32\msuivo.exe
c:\windows\system32\msumtjc.exe
c:\windows\system32\msunep.exe
c:\windows\system32\msunj.exe
c:\windows\system32\msuolv.exe
c:\windows\system32\msupzuh.exe
c:\windows\system32\msura.exe
c:\windows\system32\msuuwgkj.exe
c:\windows\system32\msvcpdu.exe
c:\windows\system32\msvfwitd.exe
c:\windows\system32\msvglq.exe
c:\windows\system32\msvtjkw.exe
c:\windows\system32\msvxypbp.exe
c:\windows\system32\msvyu.exe
c:\windows\system32\mswjg.exe
c:\windows\system32\mswpt.exe
c:\windows\system32\mswxjwnf.exe
c:\windows\system32\mswxthxd.exe
c:\windows\system32\msxamv.exe
c:\windows\system32\msxgtau.exe
c:\windows\system32\msxgwzw.exe
c:\windows\system32\msxhnnn.exe
c:\windows\system32\msxhvrjq.exe
c:\windows\system32\msxiexxm.exe
c:\windows\system32\msxxawrl.exe
c:\windows\system32\msybmw.exe
c:\windows\system32\msyjj.exe
c:\windows\system32\msyncqqk.exe
c:\windows\system32\msyzov.exe
c:\windows\system32\mszbbzoy.exe
c:\windows\system32\msziqxt.exe
c:\windows\system32\mszrrco.exe
c:\windows\system32\SKYNETlog.dat
c:\windows\system32\SKYNETpjxgdugy.dll
c:\windows\system32\SKYNETpyvrftka.dat
c:\windows\system32\SKYNETtndrksjw.dat
c:\windows\system32\SKYNETtqlrviam.dll
c:\windows\system32\svchost.dll
c:\windows\system32\vvascahb32.dll
c:\windows\system32\winexec.dll
c:\windows\system32\winres.dll







.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_ACPI32
-------\Legacy_BNDMSS
-------\Legacy_DHCPSRV
-------\Legacy_FIPS32CUP
-------\Legacy_I386SI
-------\Legacy_IAS
-------\Legacy_ICF
-------\Legacy_ISADISK
-------\Legacy_JMNHHGRTJA35UJGHUYKJ6R8IO9IUJG80
-------\Legacy_KSI32SK
-------\Legacy_NETSIK
-------\Legacy_NICSK32
-------\Legacy_PORT135SIK
-------\Legacy_SECURENTM
-------\Legacy_SYSTEMNTMI
-------\Service_6to4
-------\Service_acpi32
-------\Service_BNDMSS
-------\Service_DhcpSrv
-------\Service_fips32cup
-------\Service_glaide32
-------\Service_i386si
-------\Service_Ias
-------\Service_ICF
-------\Service_isadisk
-------\Service_jmnhhgrtja35ujghuykj6r8io9iujg80
-------\Service_ksi32sk
-------\Service_netsik
-------\Service_nicsk32
-------\Service_port135sik
-------\Service_securentm
-------\Service_systemntmi
-------\Service_SKYNEToiqumltq


((((((((((((((((((((((((( Files Created from 2009-07-02 to 2009-08-02 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-02 15:31 . 2004-08-04 12:00 182912 ----a-w- c:\windows\system32\drivers\ndis.sys
2009-06-21 11:05 . 2009-06-21 11:05 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-21 01:38 . 2009-06-21 01:38 0 ----a-w- c:\windows\system32\4.tmp
2009-06-20 19:53 . 2008-04-19 19:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-20 19:53 . 2008-04-19 19:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-20 19:34 . 2009-06-20 19:34 80 ----a-w- c:\windows\system32\3.tmp
2009-06-20 19:22 . 2009-06-20 19:22 27656 ----a-w- c:\windows\system32\drivers\pxsec.sys
2009-06-20 19:22 . 2009-06-20 19:22 22024 ----a-w- c:\windows\system32\drivers\pxscan.sys
2009-06-20 19:22 . 2009-06-20 19:22 -------- d-----w- c:\program files\Prevx
2009-06-20 19:21 . 2009-06-20 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-06-20 12:56 . 2009-06-20 12:56 80 ----a-w- c:\windows\system32\960.tmp
2009-06-20 12:07 . 2009-06-20 12:07 0 ----a-w- c:\windows\system32\2C.tmp
2009-06-17 04:14 . 2003-12-15 05:04 -------- d-----w- c:\program files\Microsoft ActiveSync
2009-06-16 08:36 . 2009-06-16 08:36 80 ----a-w- c:\windows\system32\5D.tmp
2009-06-16 08:31 . 2008-05-03 17:33 -------- d-----w- c:\program files\Free Download Manager
2009-06-16 08:26 . 2008-05-21 16:27 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-06-16 05:03 . 2009-05-09 20:01 -------- d-----w- c:\docume~1\xxx\APPLIC~1\uTorrent
2009-06-16 03:07 . 2008-06-05 15:55 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-16 03:04 . 2009-04-22 18:33 -------- d-----w- c:\program files\SpywareBlaster
2009-06-15 18:06 . 2008-05-03 17:33 -------- d-----w- c:\docume~1\xxx\APPLIC~1\Free Download Manager
2009-06-15 17:53 . 2004-08-04 12:00 14336 ----a-w- c:\windows\system32\svchost.exe
2009-06-15 17:17 . 2009-06-15 17:17 7168 ----a-w- c:\windows\zgtkg3jrsyzdb6wtgw3rh3wahhrjkae81.exe
2009-06-15 17:06 . 2009-06-15 17:06 7168 ----a-w- c:\windows\xdfhs3we5sejahag2hzdehwgasfq81.exe
2009-06-06 16:54 . 2009-05-31 10:59 -------- d-----w- c:\program files\PM FASTrack®
2009-06-06 09:16 . 2009-06-06 09:13 -------- d-----w- c:\program files\FreeRIP3
2009-06-06 09:13 . 2009-06-06 09:13 -------- d-----w- c:\documents and settings\All Users\Application Data\FreeRIP
2009-06-05 14:58 . 2009-06-05 14:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-06-05 14:48 . 2009-06-05 14:44 122840 ----a-w- c:\windows\hpoins14.dat
2009-06-05 14:48 . 2009-06-05 14:48 -------- d-----w- c:\program files\Hewlett-Packard
2009-06-05 14:48 . 2009-06-05 14:48 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-06-05 14:45 . 2009-06-05 14:45 -------- d-----w- c:\program files\HP
2009-05-31 13:57 . 2009-05-31 13:57 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-31 10:59 . 2009-05-31 10:59 4 ----a-w- c:\windows\vx86036.dat
2009-05-07 15:44 . 2004-08-04 12:00 344064 ----a-w- c:\windows\system32\localspl.dll
2008-04-22 05:12 . 2008-04-22 05:12 44360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-04-22 05:12 . 2008-04-22 05:12 107928 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
.

------- Sigcheck -------

[-] 2008-04-14 00:12 14336 1D2C031D7D9B4F6B90B2463B34767023 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\svchost.exe
[-] 2009-06-15 17:53 14336 64796602D3DD86D410B0EF2FE817110D c:\windows\system32\svchost.exe
[-] 2004-08-04 12:00 14336 64796602D3DD86D410B0EF2FE817110D c:\windows\system32\dllcache\svchost.exe

[-] 2007-06-13 10:23 1033216 924D5A28F99426925E49F5D03A08AF69 c:\windows\explorer.exe
[-] 2007-06-13 11:26 1033216 27A9C1E4E3FAD881F00748D8D5DA19D0 c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[-] 2008-04-14 00:12 1033728 847480551CF804F85A3CAAB1BC6DDA8C c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\explorer.exe

[-] 2008-04-14 00:12 15360 4095333588B86A236E268FA236F072C1 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\ctfmon.exe
[-] 2004-08-04 12:00 15360 3B733129FDCA624A9B7A73FF7DF84520 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 DB009A739D585CAA82304C32C8EC4DA7 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2008-04-14 00:12 57856 E179B8969D2380E7EAEFF0984CBBBFCE c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\spoolsv.exe
[-] 2005-06-10 23:53 57856 022660D61D192903D01167851C12169F c:\windows\system32\spoolsv.exe
[-] 2005-06-10 23:53 57856 5015BEBDE1E1755A9B354FF0A5B5B5F0 c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-14 00:12 26112 5B49E23F2044828788758FEE101B0911 c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\userinit.exe
[-] 2004-08-04 12:00 24576 22DA46759E9CAB7FC47C23A894AD580B c:\windows\system32\userinit.exe
[-] 2004-08-04 12:00 24576 22DA46759E9CAB7FC47C23A894AD580B c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"11584"="c:\cnuhbbf.exe" [2003-12-17 18432]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^fmnupd32.exe]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\fmnupd32.exe
backup=c:\windows\pss\fmnupd32.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\TeamViewer\\Version4\\TeamViewer.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 mjm2987;mjm2987;c:\windows\System32\drivers\mjm2987.sys [x]
R1 sps1f51;sps1f51;c:\windows\System32\drivers\sps1f51.sys [x]
R2 iaaadocn;TCP/IP Protocol Helper;c:\windows\System32\svchost.exe [2009-06-15 14336]
R2 xdfhs3we5sejahag2hzdehwgasfq80;xdfhs3we5sejahag2hzdehwgasfq80;c:\windows\xdfhs3we5sejahag2hzdehwgasfq81.exe [2009-06-15 7168]
R2 zgtkg3jrsyzdb6wtgw3rh3wahhrjkae80;zgtkg3jrsyzdb6wtgw3rh3wahhrjkae80;c:\windows\zgtkg3jrsyzdb6wtgw3rh3wahhrjkae81.exe [2009-06-15 7168]
R3 Dual Mode;Dual Mode Video Capture;c:\windows\system32\DRIVERS\CoachVc.sys [2002-10-09 44928]
R3 netcard;netcard;c:\windows\system32\netcard.sys [2004-08-04 2304]
R3 ZSMC0305;ZVC7100 PC CAMERA (VC0305);c:\windows\system32\Drivers\usbVM305.sys [x]
R4 709899b6;709899b6;c:\windows\System32\drivers\709899b6.sys [2003-12-17 106956]
R4 bbf9fa5;bbf9fa5;c:\windows\System32\drivers\bbf9fa5.sys [x]
S0 pxscan;pxscan;c:\windows\System32\drivers\pxscan.sys [2009-06-20 22024]
S0 pxsec;pxsec;c:\windows\System32\drivers\pxsec.sys [2009-06-20 27656]
S2 CSIScanner;CSIScanner;c:\program files\Prevx\prevx.exe [2009-06-20 4368952]
S2 sprtsvc_nxpclient;SupportSoft Sprocket Service (nxpclient);c:\program files\Airtel\NetXpert\bin\sprtsvc.exe [2007-12-06 202800]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
iaaadocn
.
Contents of the 'Scheduled Tasks' folder

2009-06-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1614895754-1060284298-854245398-1003.job
- c:\documents and settings\xxx\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-01 18:59]

2009-08-02 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 16:48]
.
- - - - ORPHANS REMOVED - - - -

BHO-{05367F41-96DA-4EBE-94BC-B9883741BFE8} - (no file)
BHO-{C2141CDF-1EEE-4884-B1B8-227D88617F19} - (no file)
HKLM-Run-Windows Network Data Management System Service - c:\windows\system32\bndmss.exe
HKLM-RunOnce-Cleanup - C:\cleanup.exe
HKU-Default-Run-Windows Network Data Management System Service - c:\windows\system32\bndmss.exe
Notify-dffaaafbbacdae - c:\windows\system32\dffaaafbbacdae.dll
Notify-avgrsstarter - avgrsstx.dll
Notify-ehfctvdm - (no file)


.
------- Supplementary Scan -------
.
mSearch Bar = hxxp://www.google.com/ie
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-02 22:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(844)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2009-08-02 22:33
ComboFix-quarantined-files.txt 2009-08-02 17:03

Pre-Run: 24,444,006,400 bytes free
Post-Run: 24,421,896,192 bytes free

403 --- E O F --- 2009-06-12 16:32
-------------------------------------------------------------------------------------------------------------

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP