Hi Lin, I feel your pain. I did not save
my answer to your post, but I can give
you an example post.
Peper trojan removal
Download and run this file to fix Peper Trojan:
http://home01.wxs.nl/~kleyn080/uninst.exe
double click on 'uninst.exe', let it run and terminate.
To delete all the associated files download the following tool:
http://www.mjc1.com/files/mo/drpeper.html
It will self extract to C:.
Find the file:
C:\drpeper\Find backup and Delete Peper files.vbs file and double click.
On the first prompt copy and paste:
Select one of the filenames in the running processes.
example:C:\WINDOWS\System32\Rcjj.exe
C:\WINDOWS\System32\JvfMa7R.exe
(your files will look like those)
And hit ok.
You will get a confirmation and proceed:
On the second, paste:
Type in the filename where the startup entry points to.
And hit ok
example:O4 - HKLM\..\Run: [4X@95ME57C5BM8] C:\WINDOWS\System32\FmrCj.exe
(The 14 letters and numbers give it away)
It will find all the files, delete them and will make backups in the same folder.
It'll open a text file (Peper.txt) with the list of all files deleted.
Check that .txt file to see if no legitimate files were removed.
Another forum that can help:
http://www.spywareinfo.com/forums/
Good luck
Abnormal
