Omöjligt spyware

26 februari, 2007

Tjenare,

Jag har fått någon slags spyware på datorn. Nod32, Norton, AdAware, Spybot, Windows Defender och Webroot hittar ingenting men min brandvägg loggar dessa transaktioner

[log]2007-02-26 19:44:09 Allowed 10 Outgoing TCP www.4w4.ru [81.222.134.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1182 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP www.4w4.ru [81.222.134.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1181 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP www.that-new.info [84.252.148.70] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1178 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP www.that-new.info [84.252.148.70] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1176 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP content3.porkolt.com [85.17.36.46] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1196 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP content3.porkolt.com [85.17.36.46] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1194 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP js.redtram.com [213.186.114.173] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1167 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP n4p.ru.redtram.com [213.186.114.184] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1190 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP n4p.ru.redtram.com [213.186.114.184] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1169 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1218 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1216 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1214 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1202 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1198 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1192 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1188 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1186 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1173apps

2007-02-26 19:44:09 Allowed 10 Outgoing TCP img2.ru.redtram.com [213.186.114.189] 00-0F-CB-B5-F7-4E 80 192.168.1.2 00-11-11-38-C0-99 1171 C:\Program\Delade filer\Symantec Shared\CCPROXY.EXE

[/log]

Detta är bara ett axplock och jag är säker på att jag fått in någon skit i datorn. Jag kör svenskt Windows men hade nyss ochså en skapad katalog i startmenyn som hette Accessories med en Internet explorer ikon innuti. Denna fanns ej för 5 min sedan.

Min TeaTimer har även varnat för att något program vill göra dessa ändringar, ca 10 gånger i minuten:

2007-02-26 19:23:02 Denied value "{44692597-B1B1-4B30-AB2A-67CA528666D3}" (new data: "") added in Browser Helper Object!

2007-02-26 19:23:03 Denied value "qomkhhg" (new data: "") added in Winlogon Notifiers!

2007-02-26 19:23:03 Denied value "vturr" (new data: "") added in Winlogon Notifiers!

Snälla hjälp....

[inlägget ändrat 2007-02-26 20:03:19 av jhn]

[inlägget ändrat 2007-02-27 09:40:33 av Anders N]

26 februari, 2007

Ser ut som Vundo enligt TeaTimer

Ladda ner HijackThis.exe och scanna datorn med det.

Skicka hit loggen sen så tar vi en titt hur den ser ut.

http://www.thespykiller.co.uk/files/HJTsetup.exe

Före du scannar med HijackThis.exe så byt namn på den till rensare.exe Sen scanna och skicka loggen.

26 februari, 2007

Tusen tack för hjälpen, jag bytte namn på filen och körde en scan samt loggade resultatet, det följer nedan:

En helt OT fråga är: Har jag alldeles för mycket processer igång, tycker datorn börjar gå segt :-)

[log]Logfile of HijackThis v1.99.1

Scan saved at 20:12:13, on 2007-02-26

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe

C:\Program\Delade filer\Symantec Shared\ccApp.exe

C:\Program\Windows Defender\MSASCui.exe

C:\Program\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

C:\Program\Eset\nod32kui.exe

C:\Program\Skype\Phone\Skype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Delade filer\Ahead\lib\NMBgMonitor.exe

C:\Program\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe

C:\Program\Spybot - Search & Destroy\TeaTimer.exe

C:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program\Delade filer\Symantec Shared\ccProxy.exe

C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program\Personal\bin\Personal.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program\ewido\security suite\ewidoctrl.exe

C:\WINDOWS\system32\hpb2ksrv.exe

C:\WINDOWS\system32\hpbhksrv.exe

C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Program\Eset\nod32krn.exe

C:\Program\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe

C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe

C:\Program\Analog Devices\SoundMAX\spkrmon.exe

C:\Program\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe

C:\Program\Delade filer\Symantec Shared\Security Center\SymWSC.exe

C:\Program\Norton Internet Security\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Sygate\SPF\smc.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe

C:\Program\Messenger\msmsgs.exe

C:\Program\Rensare\rensare.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {95C1C594-F35B-4970-BE57-6C66D45E4D0A} - C:\WINDOWS\system32\vturr.dll

O2 - BHO: Mouse Gestures - {A6A49249-57AE-4295-8D4D-18A9502C7D8E} - C:\Program\Internet Explorer\Plugins\Drowse\MouseGestures.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {C47A9554-195A-4769-9B13-04F15B450A39} - C:\WINDOWS\system32\qomkhhg.dll

O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [ATIPTA] "C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [CTSysVol] "C:\Program\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe"

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [MICROSFT ANTIVIRUS UPDATE SUPPORT] MSGUPDATED.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [urlLSTCK.exe] "C:\Program\Norton Internet Security\UrlLstCk.exe"

O4 - HKLM\..\Run: [symantec NetDriver Monitor] "C:\Program\SYMNET~1\SNDMon.exe" /Consumer

O4 - HKLM\..\Run: [smcService] "C:\Program\Sygate\SPF\smc.exe" -startgui

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Windows Defender] "C:\Program\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [AsioReg] "REGSVR32.EXE" /S CTASIO.DLL

O4 - HKLM\..\Run: [Adobe Version Cue CS2] C:\Program\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe

O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\RunServices: [MICROSFT ANTIVIRUS UPDATE SUPPORT] MSGUPDATED.EXE

O4 - HKCU\..\Run: [skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] "C:\Program\Spybot - Search & Destroy\TeaTimer.exe"

O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program\Internet Explorer\Plugins\Drowse\MouseGestures.dll

O9 - Extra 'Tools' menuitem: Mouse Gestures... - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program\Internet Explorer\Plugins\Drowse\MouseGestures.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://t2fleming.tele2.se/iNotes6W.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20060104/qtinstall.info.apple.com/snape/us/win/QuickTimeInstaller.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131660066171

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131660464578

O20 - Winlogon Notify: Controls Folder - C:\WINDOWSO20 - Winlogon Notify: qomkhhg - C:\WINDOWS\SYSTEM32\qomkhhg.dll

O20 - Winlogon Notify: vturr - C:\WINDOWS\system32\vturr.dll

O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program\Acesoft\Tracks Eraser Pro\autocomp.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: ewido security suite control - ewido networks - C:\Program\ewido\security suite\ewidoctrl.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: HP Status - Hewlett-Packard Company - C:\WINDOWS\system32\hpb2ksrv.exe

O23 - Service: HP Status Print - Hewlett-Packard Company - C:\WINDOWS\system32\hpbhksrv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Norton AntiVirus Auto Protect-tjänst (navapsvc) - Symantec Corporation - C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program\DELADE~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program\Sygate\SPF\smc.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe

O23 - Service: spkrmon - Unknown owner - C:\Program\Analog Devices\SoundMAX\spkrmon.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\Security Center\SymWSC.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program\Webroot\Spy Sweeper\SpySweeper.exe

[/log]

[inlägget ändrat 2007-02-26 20:14:40 av jhn]

26 februari, 2007

Har du 2 antivirus igång Nod32 och Norton

Isåfall stäng av en av dom.

Surfa hit och följ anvisningar på sidan

http://www.atribune.org/content/view/24/2/

skicka sen C:\vundofix.txt

Note: It is possible that VundoFix encountered a file it could not remove.

In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the

Scan for Vundo button." when VundoFix appears at reboot.

26 februari, 2007

Im on to it! Editerar in loggen så fort programmet körts!

Edit: Så lång tid scannern tar :-(

[inlägget ändrat 2007-02-26 21:12:19 av jhn]

26 februari, 2007

Sådär, här är loggen från Vundofix.txt:

[log]VundoFix V6.3.9

Checking Java version...

Sun Java not detected

Scan started at 20:22:46 2007-02-26

Listing files found while scanning....

C:\WINDOWS\system32\rrutv.bak1

C:\WINDOWS\system32\rrutv.ini

C:\WINDOWS\system32\vturr.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\rrutv.bak1

C:\WINDOWS\system32\rrutv.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\rrutv.ini

C:\WINDOWS\system32\rrutv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\vturr.dll

C:\WINDOWS\system32\vturr.dll Could not be deleted.

Performing Repairs to the registry.

Done!