Hey, had hijack fix it, and it's still doing it. When I connect once and open my browser then close my browser and disconnect, I can't connect again. When I check in control panel under my internet connection, there is two of them one says sympatico(default) and the other sympatico(old) under my default one my username is correct but my password has been changed and I can't change it to what it should be, it keeps reverting back to the incorrect one. In the old one it says for a user name connints20 and looks to be the same number of letters in the password box as the one in my default. So what I have to do to get back online is delete both of these and make a new connection with my username and password and I can connect once but once I disconnect it does the same thing to the new connection I just made. Thanks for the help!!!

0

have hijack fix this O17 - HKLM\System\CCS\Services\Tcpip\..\{F145778E-5661-43F3-9140-249ED7D6814D}: NameServer = 209.226.175.223 198.235.216.111

0

Hey, I ran hijacker and had it fix that line, and it still did the same thing. After I deleted the other two connections that it made and created my new one again to get back online again, I ran hijack again and the line was back again. Thanks

0

Have the same problem and can 't fix it. My username also everytime changes into connints20... Has anyone got a nice solution (i'm not really an computer expert) Thanks

0

i have the same problem ( connints and everything)... please help me ... this is really annoying and i have tried all of the above ^ and nothing works. thanks you so much for your help mike just a guy from canada.. who needs help

0

Download and run trojan hunter. http://www.misec.net/trojanhunter

0

download and run trojan hunter.

0

yeaaaaaaaahh!! Trojan Hunter worked. Thanks so much for the help this site rocks. That thing was so annoying! just a guy from canada.. who needs help

0

hey rustymike. Did you use the trial version or actually buy it and what did you actually find?

0

hey , thought someone would ask a follow up Q so im back. I used the 1 day trial version of Trojan hunter and did a full scan . It came up with 2 trojans on my computer .I deleted them with the program and now everything works great! Im not the best with computers , but i did know enough to write down where they were located.. so heres where they were #1 C:\systemvolumeinformation\_restore}7a17o5d ......and so on with a bunch of numbers #2 C:\Documents and settings\Mike\jpi_cache\jar\1.0\archive.jar-487b52a0-3f7114a3.zip.rundll32.exe I hope this helps .. i will continue to check this forum .. keep me posted and good luck ! Mike p.s.Once again ... this is a great site, good job! just a guy from canada.. who needs help

0

I've got this ConnInts20 thing too., I've downloaded http://www.misec.net/trojanhunter but it doesn't work. I downloaded the 30-day evaluation version. Mike, is this the same as yours? Any tips from anyone else? Thanks, Rob

0

I have the same problem too - have installed trojan hunter as well as the update and still it finds no trojans, nor does it fix the problem! The user name and dial up number it changes my connection to it.... ConnInts20 09096423874 Any help would be greatly appreciated! Thanks

0

hi there, what worked for me was to delete svchost.exe it's a bit tricky but it gets rid of any ConnInts20 "attacs".

0

Hey all i have this ConnInts20 problem too and just find it bloody annoying !!! :( Ive tryed evrything that u guys suggest but nothing seems to work.... except for Judith04's thoery i think that might be the thing !!! but what i dont no is which svchost.exe to delete becoz a few off them pop up and like if anyone could please offer sum help about Judith04's thoery or possibly some other way off gettin rid of this lame ass ConnInts20 hassle..... your help would be most greatly appreciated :D !!! Thanx All BYE BYE !!

0

Thanks for the Internet! Rename the file C:\Windows\svchost.exe to something else. Kill the start key in regedit at HLM\Software\Microsoft\Windows\CurrentVersion\Run called "SVCHOST" = "C:\\Windows\\svchost.exe" Reboot Delete the renamed file above

0

Remove Microsoft java virtual machine and install sun's per link. http://www.winnetmag.com/Article/ArticleID/38206/38206.html Post results please.

0

Hey linketo, Well yeh i will try ur method but wat i aint sure bout is this svchost.exe app, becoz like isnt it suppose to be apart of WinXP and like sumtimes i even have like 4 svchost.exe running in my processes??? PS. Thanks 4 ya help tho, most greatly appreciated !! BYE BYE !!

0

YEAHHHHHHHHHHH BABY !!!!! linkto i thank u heaps mate ur method really works :D !!! did everything u said and no ConnInts20 crap appearing or another internet connection replicatin my real one.... i thank u heaps man ... oh and evrybody else u havin probs wid dis matter do what linkto said.. koz it the only method i reckon that actually stops this ConnInts20 hassle and for good too :D Here it is, just as "linkto" said it :P Rename the file C:\Windows\svchost.exe to something else. Kill the start key in regedit at HLM\Software\Microsoft\Windows\CurrentVersion\Run called "SVCHOST" = "C:\\Windows\\svchost.exe" Reboot Delete the renamed file above :D this post really rocks thanks all and i will be bak to see how things go 4 all u others out there !!! BYE !!

0

hey whatever work s to get rid of this friggin thing .. do it . It was so annoying .. thanks for all the help! turnstile B, did you do a full scan or a quick one.. the full scan with trojan hunter found 2 for me .. it took a really long time to do the full scan though . Hey , the location of the trojans on my computer help anyone.. just curious? Mike just a guy from canada.. who needs help

0

For Win9x: 1.Kill process – “svchost.exe” 2.Run Regedit.exe in windows directory Remove from register [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] next string: "SVCHOST"="C:\\WINDOWS\\svchost.exe" Exit from Regedit 3.Delete file “svchost.exe” in windows directory 4.Reboot 5.Correct connection properties Don’t worry, be happy P.S. It is easy if you use “Starter” software from http://codestuff.netfirms.com/

0

"Kill the start key in regedit at HLM\Software\Microsoft\Windows\CurrentVersion\Run called "SVCHOST" = "C:\\Windows\\svchost.exe" Sorry, but what exactly does "Kill the start key" mean in the above? I too have this problem and would dearly love to dump it. Quite frankly I don't mind if it means "walk barefoot over white-hot barbed wire" . . . .

0

For Win9x: 1.Kill process – “svchost.exe” 2.Run Regedit.exe in windows directory Remove from register [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] next string: "SVCHOST"="C:\\WINDOWS\\svchost.exe" Exit from Regedit 3.Delete files “svchost.exe, connint20.exe, dating762.exe” in windows directory 4.Reboot 5.Correct connection properties Don’t worry, be happy P.S. It is easy if you use “Starter” software from http://codestuff.netfirms.com/

0

sorry, I meant what does "kill the start key" mean in the explanation for XP? Does it just mean delete that string? Thanks

0

Watch out for the ConnInts 20 thing. I think it's dials out through its own number, and may rack up handsome charges. Something similar to the number in response 18. Check it with your connection provider, and find a way around this until you can get rid of it. Cunning shysters.

0

Response 28 worked for me and I have XP Professional. Neither McAfee or TrojanHunter was able to detect or fix this problem. Thanks, CAB

0

In response 28, I do not have a svchost.exe in C:/windows but do in C:/windows/system32, is there supposed to be one there? Also when I go to regedit and follow the instructions when I get to .........currentversion/run there is no line that says SVCHOST=C://windows//svchost.exe I just did a quick reformat recently, I want to make sure this thing is gone, Thanks everyone.

0

Hey herc0629, Yes the svchost.exe in C:\WINDOWS\system32 is suppose to be there because thats the one that comes with your actual windows. If you did infact have the other svchost.exe, the infected one that is suppose to be in C:\WINDOWS you would have found it using response 28's method. So you are clear mate. Oh but if you want to have a look thru your C:\WINDOWS just to make sure, go in it and look 4 a application with a big black "W" on it, if found doesnt matter wat it is named, just rename it, reboot, then go bak in C:\WINDOWS and delete it for good !!! Well im no comp brainiac, but i hope ive helped. :) Cheers, Vas !!

0

i have had same problem with ConnInts, and that 090 number! i got the tojanhunter, it found 1 trojan that ad-aware software didnt pick up, heres the results of the 'clean' Terminated trojan process 2072 (C:\windows\system32\msiexec16.exe) Renamed file C:\windows\system32\msiexec16.exe to C:\windows\system32\msiexec16.exe.tcf not yet sure if its cured the problem but im printing this site off incase i cant reconnect again...hopefully be back soon

0

i managed to connect, but i realised that the connection i was usin was connected to that 090 number so im just praying that i dont get a hefty bill for it!! i went to the windows directory and found an actual file called 'ConnInts' so i just deleted it immediately! it seems to have done the trick and i dont get my connection/password changed anymore.. although i did have to change the dialling number because it was still dialling 090... BEWARE: anyone who thinks theyve fixed the problem just make sure your not dialling 09096423874 incase you get charged for it! when changing the number myself i just left the box blank and my connection dials automatically now, just like it did before!

0

As for the svchost.exe, i have no idea what it is, but an ad-aware (ad-aware 6.0) program brought it to my attention so i got rid of it! However i remember that the svchost.exe had been there long before any of these ConnInts problems started.

0

although my connection seems to be back to normal, i found that big black W (svchost) file in windows directory! whats should i do with it? delete it??

0

Hey adysupreme, Yes delete it !!!! Thats the infected svchost.exe file, as for the one thats in C:\WINDOWS\system32, leave that one alone because thats the one that comes with your windows !! Here are the instructions on how to remove: 1. Rename the file to something else. 2. Restart comp. 3. Delete the renamed file for good. Hope ive helped :) Vas !!

0

Well Gang I fixed mine 1.Delete or Kill the process – “svchost.exe” Run a search on "svchost" delete svchost.exe. pf 2.Run Regedit.exe in windows directory Remove from register [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] next string: "SVCHOST"="C:\\WINDOWS\\svchost.exe" Exit from Regedit 3. Empty trash bin 4.Reboot 5.Correct connection properties

0

Hello, You should not delete the svchost.exe which is in c:\windows\system32\. It's a system file. See the link for more details. http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/ You should remove the c:\windows\svchost.exe from your registry, but when you check in c:\windows\ you will not find a file called svchost.exe. But I found a dialer exe called "Connints20.exe" in c:\windows. I think this is the file that should be removed. Hope this info is helpfull :-) NeuroFobia

0

Thanks for the above, it solved the problem on my machine. However, my up to date Norton Antivirus was totally unable to detect a problem and I only found this forum by searching for ConnInnts. Is it caused by a virus and, if so, what is it called? thanx agn

0

I've got the same problem, I've solved it temporarily by deleting both my connections and made a new one with correct information - but the virus keeps changing it and making a new standard connection. (Username: Connints, password unknown) I'm connected to it right now, but if I disconnect I have to delete both and make a new one again to get online, because the virus'll change it within a few minutes after logging on. Here's the information I got when scanning with HiJackThis: Logfile of HijackThis v1.97.7 Scan saved at 15:23:35, on 11.04.2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Programfiler\Norton AntiVirus\navapsvc.exe C:\Programfiler\Norton AntiVirus\AdvTools\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.exe C:\Programfiler\ahead\InCD\InCD.exe C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.exe C:\Programfiler\Creative\ShareDLL\CtNotify.exe C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe C:\Programfiler\WildTangent\Apps\GameChannel.exe C:\windows\system32\sncntr.exe C:\WINDOWS\wt\updater\wcmdmgr.exe C:\WINDOWS\svchost.exe C:\Programfiler\Creative\ShareDLL\MediaDet.exe C:\Programfiler\MSN Messenger\MsnMsgr.exe C:\Programfiler\Fellesfiler\Microsoft Shared\Works Shared\wkcalrem.exe C:\Programfiler\Internet Explorer\IEXPLORE.exe C:\Documents and Settings\Eirik Herland Berge\Skrivebord\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programfiler\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\E2G\IeBHOs.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programfiler\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programfiler\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Programfiler\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Programfiler\ahead\InCD\InCD.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.exe O4 - HKLM\..\Run: [NewsUpd] C:\Programfiler\Creative\News\NewsUpd.exe /q O4 - HKLM\..\Run: [Disc Detector] C:\Programfiler\Creative\ShareDLL\CtNotify.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Programfiler\REGSHAVE\REGSHAVE.exe /AUTORUN O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Programfiler\Fellesfiler\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.exe O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch O4 - HKLM\..\Run: [WT GameChannel] C:\Programfiler\WildTangent\Apps\GameChannel.exe O4 - HKLM\..\Run: [sncntr] c:\windows\system32\sncntr.exe /nocomm O4 - HKLM\..\Run: [SVCHOST] C:\WINDOWS\svchost.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.exe" /background O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programfiler\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: Pĺminnelser for Microsoft Works Kalender.lnk = ? O4 - Global Startup: Webpro Digital Calendar.lnk = C:\Programfiler\WebPro AS\webpro.exe O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {11111111-1111-1111-1111-111111111111} - file://c:\info6_s.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/Cult.cab O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - http://www.easports.com/downloads/games/common/ieell.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1536.g.akamai.net/7/1540/52/20020909/qtinstall.info.apple.com/sikes/no/win/QuickTimeInstaller.exe O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {A1DC3241-B122-195F-B21A-000000000000} - http://pluginaccess.com/hollycelebs/Browser_Plugin.cab O16 - DPF: {A7798D6C-C6B5-4F26-9363-F7CDBBFFA607} (download Class) - http://www.gigex.com/ActiveX/vxpspeeddelivery.dll O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - http://activex.microsoft.com/activex/controls/WindowsMedia/downloadcontrol.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553515000} - http://active.macromedia.com/flash/cabs/swflash.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {DA9A0B1E-9B7B-11D3-B8A4-00C04F79641C} (NSUpdateLiteCtrl Class) - http://204.177.92.201/quickdl/proclaim/NSupd9x.cab O16 - DPF: {E9041F85-3C18-4A7E-A29D-E24F84B79BF1} - http://e2give.com/downloads/UGO20.exe O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6AD75D10-2605-4353-9114-DFF1D89C68E3}: NameServer = 130.67.15.198 130.67.60.68 I'd be delighted if someone could help me solve this problem, and to warn you, I'm not much of a computer expert, so I'll need someone to go through the process step by step! :-) My regards, Eirik from Norway. PS: Please don't remove this post, I hope that the same person can help me aswell - it seems that he is quite an expert.

0

I have the Connints20 problem as well. I tried to delete the file, svchost.exe, but a window appears that says the file is being used by windows. I also tried renaming it, but the same thing happened. I know this is the affected file. Is there a program I can use to delete this file? Thanks much!

0

Hello, I will give you the step by step instructions to get rid of the connints20 problem. It seems that this is some kind of dialer thing that tries to get you connected to a porn server. Here is what i did to get rid of it: 1. goto start and click run. Type "regedit". 2. goto hkey_local_machine/software/microsoft/windows/ currentversion/run There you will see something like this : "SVCHOST"="C:\\WINDOWS\\svchost.exe" Delete this value from the registry by clicking it once and push the delete button. Click yes to delete it. Close regedit. 3. Delete the following files, if present, in the c:\windows\ directory “svchost.exe, connint20.exe, dating762.exe”. 4. Reboot 5. Correct your connection and enjoy the internet... :-) NeuroFobia

0

Thanks, I fixed it earlier today. I downloaded the program "Process Manager" (easily found by searching Google) and killed c:/windows/svchost.exe directly from there. Didn't find any other files, so after deleting the old connections and rebooting, the new connection worked fine! This Process Manager-program probably removed it from the registry and deleted it in one process, I guess? So basically we've done the same thing? Thanks for your help anyway, just luck that I managed to fix it myself! =) My regards, Eirik Herland Berge, Norway

0

The problem is the false svchost.exe in the c:/windows directory. I have verified it this way. After ridding my computer of the problem using the most common method that was been suggested by Name: linketo Date: April 05, 2004 at 14:37:04 Pacific. I was a little stubborn, and instead of deleting the renamed file, i pasted it onto may desktop. Its icon changed to a W like icon. I then opened the program (that false svchost program)in resource hacker. I then opened the dialog folder in Resource Hacker's left side tree.(Sorry for the language)And a window with the following words came up. /////////////////////////////////////////// f---UpYourConnection v 1.0 INFORMATION: This prog totally f---s up your modem connection, be sure to make a new connection after running this program, otherwise it may be expensive.... /////////////////////////////////////////// As you can now see we are sure who the criminal program is. To totally exhaust this problem, look through the c:/windows folder. If there is a suspicious file copy it(do not cut). The paste is to another location. If it has the W icon, delete it from wherever u pasted it and also go back to the c:/windows directory and rename it and delete it the next time u reboot your computer. If you cannot rename it, then go to the registry start > run> regedit (HLM\Software\Microsoft\Windows\CurrentVersion\Run ) and remove the key that links to it so that it does not start up the next time you reboot. The will be able rename and delete it, or even delete it straight away. Hope this was helpful to those who had a more complicated problem than the rest. lillwikki The first bird may catch the worm but the second mouse gets the cheese

0

i got the connint20 problem too. i dont know where/when i got this thing. coz i m not an expert, i chose to reinstall the wins. but i wanna know how being charged. when i found that connint20 things, i checked out i hadnt dialed any long-distance call. so what the problem will be?

0

...and the last question is how to avoid those things. thx

0

You little beauty!!! That connInts3 I had was driving me nuts. I did as 26 & 28 said and everything is sweet. Cheers guys. I has some trouble deleting the svchost.exe file at first, but I realised after a while that I had to change it's name and reboot my computer BEFORE I was able to remove it. Thanks again everyone.

0

Hi guys, Great help on this site! Keep up the good posting. Answer 21 helped a lot!! Appearantly svchost.exe must only exist in your windows/system32 directory. I had the problem since 14-4 and the svchost.exe file in my windows directory was put on my pc at that date.

0

Especially answer 44 helped me a lot. I solved the problem. However, I think this thing (ConnInt) behaves differently. In my case it was "Connint2". I couldn't find any relevant entry in my regedit. I could easily renamed the file c:\windows\svchost.exe. Rebooted by PC and delated the renamed svchost.exe and the other two files present in the same directory: connint20.exe, dating762.exe. Thanks a lot!

0

Had the same problem. Best way to kill this thing is boot into safe mode(not nescessary, but always a good idea when getting rid of stuff), Delete the svchost.exe in the \windows directory... also any other file that that has a big black W for an icon. run regedit and go to HKEYLOCALMACHINE\Software\Microsoft\Windows\CurrentVersion\Run and delete C:\\WINDOWS\\svchost.exe and maybe a few other programs that you have to close after each time you boot up like MS messenger :) finally, reboot as normal and there you go, a clean machine! have fun and enjoy! by the way, my version had Connint3 AAARRRrrrrrggggggg...... and did I mention, AAARRRrrrrrggggggg......

0