"Michael D. Alligood" wrote in message
...

Now I am sure all of you have heard about spyware removal tools such as
SpyBot, Ad-Aware, Pest Patrol, and spyware blocking programs like SpyWare
Blaster. I ran all four programs on my PC and have had zero instances of
spyware in over a year.

I got hit by Webhancer and Roings recently and none of the removal programs
would remove them even after updating. After three days of trying they still
kept coming back after a reboot. In the end I worked out that these programs
were leaving some suspect processes in startup that were repairing others
and even creating files and folders on my HD!.

I finally got rid of the bloody things after nearly 100 hours work (Mostly
speant teaching myself what was going on)....

This is what I did...

1) killed a bunch of suspicious processes using task manager (see below)
2) Removed a bunch of processes from startup using msconfig (see below)
3) Ran Adaware which found the files and folders (and might have repaired
the damage that Webhancer did to my network stack etc)
4) rebooted.

Note: Step 3 on it's own did not work, nor did running SpyBot, Ad-Aware,
Pest Patrol on their own or in combinations.

Here is the full list of processes that I removed from my startup using
msconfig...

All are around 36Kbytes in size and all were created in C:\WINDOWS by the
pests.

aekjhhpnc.exe
anikvz.exe
aqnnjo.exe
arjzyv.exe
bjcozmfwg.exe
cggrzown.exe
cphe.exe
dgrzked.exe
emzxt.exe
eudi.exe
eujbo.exe
fbkdql.exe
fbmxii.exe
fleffz.exe
fwpckdg.exe
geerp.exe
govfkazlx.exe
hfqoenf.exe
hnztvtuaf.exe
hrafu.exe
hwpxnd.exe
ihyxgsm.exe
limj.exe
lioxyusb.exe
lmudhpr.exe
mdjsqjy.exe
mjcedbh.exe
nanvorwgh.exe
nrrdhh.exe
oambkk.exe
odqdprgsu.exe
odrynrc.exe
oolrc.exe
orlnbihw.exe
ouvchaefo.exe
oxdliflxz.exe
pmiabsxs.exe
pndspm.exe
rhuvhj.exe
rjgkn.exe
rnkggsi.exe
rsbmtkntd.exe
rznk.exe
sfyxh.exe
skoeetux.exe
ssqvjt.exe
sung.exe
sypd.exe
tmato.exe
tsphdyx.exe
ubczlau.exe
upvzv.exe
uyxhizb.exe
uzpzdwke.exe
vatlvmlo.exe
vnvjiyd.exe
vstfgd.exe
xfeg.exe
xkwl.exe
xrhkczx.exe
xznfc.exe
ygrww.exe
ygsuc.exe

WhAgent
WhSurvey