I don't know if they are ad-ware, viruses or what, but they
make the PC virtually ununusable.

I have tried Spy-bot, Ad-Aware, and Norton Anti-virus, but
none of them fix the problem. Everytime I reboot, these
processs, and a few othes with gibberish for names
come back. But usually it is keydoc.exe or runfont.exe
taking up the most mmemory.

thanks.
Jg

---

Request for Question Clarification by hummer-ga on 20 Oct 2004 17:41 PDT

Hi pcfued,

It is important to clean your system in a methodical manner. Try
following one of the following tutorials, step-by-step (step 1:
TrendMicro's HouseCall).

Run HouseCall, a very thorough online virus scan:
http://housecall.trendmicro.com/

How to: Spyware, Trojan And Virus Removal
http://forums.majorgeeks.com/showthread.php?t=35407

KRC Anti-Spyware Tutorial
http://www.greyknight17.com/spyware.htm

Please let us know how that goes.
hummer

---

Clarification of Question by pcfued-ga on 21 Oct 2004 14:45 PDT

Hi.

Thanks for the comments. I will try Housecall. 

Deadonshot, as I said in my original posting, I have already 
tried Ad-Aware, and while it find problems, it didn't
fix it. Next time I boot up, there is more strange stuff 
running. And sorry, I meant to put it in my original posting
but I forgot, but I have already tried MSconfig, and set it
to not use the startup items, but again, I still get strange
stuff running, and popups, even when not on the net.

I will post again after trying housecall, etc.


thanks much.

---

Clarification of Question by pcfued-ga on 21 Oct 2004 14:48 PDT

Hi.

Thanks for the comments. I will try Housecall. 

Deadonshot, as I said in my original posting, I have already 
tried Ad-Aware AND Spybot, and while they find problems, they
do no fix it. Next time I boot up, there is more strange stuff 
running. And sorry, I meant to put it in my original posting
but I forgot, but I have already tried MSconfig, and set it
to not use the startup items, but again, I still get strange
stuff running, and popups, even when not on the net.

I will post again after trying housecall, etc.


thanks much.

Hi Jg,

Hopefully I can be of some help to you. Let me give you a few
suggestions to try. I personally do not like Norton Anti-Virus. I
would use AVG FREE http://free.grisoft.com/freeweb.php/doc/2/, it?s
free and in my opinion the best anti-virus software out there at this
time. If you don?t feel like installing something use Housecall
http://housecall.trendmicro.com/, which is the BEST online virus
scanner.

 If that is unsuccessful, download Hijackthis
http://www.spychecker.com/program/hijackthis.html, don?t put it on the
desktop or you could have possibly hundreds of backup files on your
desktop. Talk about clutter! Delete anything that looks suspicious.

You could also try searching your registry for these files and
deleting them, go to start type regedit, and then press Ctrl+F and
type in keydoc.exe ECT. then press F3 to jump to the next instance of
the file. After that Boot into safe mode and delete these files. To
boot into safe mode on most pc's repeatedly press F8 when the computer
is booting and select Safe Mode from the list.

Try running ad-aware www.lavasoftusa.com and spybot search and destroy.

Also try going to start->Run-> type MSCONFIG, then click on the
start-up tab and see if any of those are present. If so un-check them
and restart your computer, you should be prompted about starting in
selective start up mode, check the check box that says don't show on
startup. Press Crtl+Alt+Del and see if they are running.

These kiddie programs are almost alway loaded under the Run key.

To remove them from memory immediately goto Start > Run > Regedit
Locate...HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run.
 Delete the various .exe's you mention above.

You probably have the virtuomonde infection.  A guide to remove it can
be found here:

http://www.bleepingcomputer.com/forums/topict3494.html

Boot your PC from Safe mode (Pressing F8). Once you are get into it,
delete the files you specified.

If you have a FAT-Partition:

Get a KNOPPIX-ISO-Image (http://www.knopper.net/knoppix/index-en.html
or distributed with some computer magazine).

Boot your computer from that CD. KNOPPIX is a linux-on-cd that
completely boots into RAM. This way no windows process will be started
and you can delete those suspicious files.

I have found that these tend to gobble up CPU cycles and cannot be
killed. Lord knows what they are up to. You cannot directly delete the
file, since it is still running. Since it takes most of the CPU time
and seems to restart with explorer open, it is best to use the command
prompt.

The files are generally marked hidden and system. Use the command
prompt to go to the file location. Remove the hidden and system
attributes (e.g., attrib -h -s runfont.exe). Rename the file once it
is unhidden. Use HiJackThis or regedit to remove the startup reference
in the registry. Now restart the computer. You can then delete the
renamed file to clean up after yourself.