egafd.com

somehow got this thing - a piece of malware through firefox I think, could be on IE also.



Used autoruns


to disable startup rubbish - good prog anyway to check startup crap

Threat name Win32.Trojan.Cimuz.CL
Filename [System32Root]\mstsdsc.exe
Filesize Unknown
Status Known to RemoveIT Pro as dangerous.


Try sdfix if you cant get rid of it, it can be a bitch.


<Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
? Restart your computer
? After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
? Instead of Windows loading as normal, the Advanced Options Menu should appear;
? Select the first option, to run Windows in Safe Mode, then press Enter.
? Choose your usual account.
? Open the extracted SDFix folder and double click RunThis.bat to start the script.
? Type Y to begin the cleanup process.
? It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
? Press any Key and it will restart the PC.
? When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.

Okay - I tried some of the instructions from





didn't read all the instructions and had to do a system restore, luckily from the previous day

I should have backedup the registry and printed all the instructions.