[dee13]

Infected files detected
C:\WINDOWS\system32\ccapp.exe
C:\WINDOWS\system32\navshext.dll
C:\WINDOWS\system32\navshext1.dll
C:\WINDOWS\system32\ustart.exe

Infected registry keys/values detected
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB}
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB}
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB}\InProcServer32 C:\WINDOWS\system32\navshext1.dll
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB}\InProcServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\CLSID\{C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} System Process

keeps comin back microsoft antispyware keeps picking these things up how do i get rid of these

[Advertisements]

I know what it is and I wrote a script to remove them.

Would you like to try?

Download and unzip BFUzip from http://computercops..../Merijn/bfu.zip
Run the program and click the Web button as shown here:


Use this URL to copy into the address bar of the Download script window:
http://home01.wxs.nl/~kleyn080/AdwareSystemProcess.bfu

Execute the script by clicking the Execute button.

If you have any questions about the use of BFU please read here:
http://metallica.gee...structions.html

You can find a description of this Adware here:
http://us.mcafee.com...&virus_k=135579

My script should remove all those entries.

Let me know,

[Metallica]

I know what it is and I wrote a script to remove them.

Would you like to try?

Download and unzip BFUzip from http://computercops..../Merijn/bfu.zip
Run the program and click the Web button as shown here:


Use this URL to copy into the address bar of the Download script window:
http://home01.wxs.nl/~kleyn080/AdwareSystemProcess.bfu

Execute the script by clicking the Execute button.

If you have any questions about the use of BFU please read here:
http://metallica.gee...structions.html

You can find a description of this Adware here:
http://us.mcafee.com...&virus_k=135579

My script should remove all those entries.

Let me know,