Was using the firewall inside the Trend Internet Security suite and since I can not get to open I have no idea if the firewall is active or not.
Looked at the windows\temp folder and there are now 4 .exe files. They are
winexveer.exe
winhbbxid.exe
winirjk.exe
winjrtt.exe
would be strange if they now showed up in a scan as being in place of the "c:\\Windows\\temp\\winveus.exe and winlrgjh.exe shown in your last post
Did as you requested except stopped when clicked on open hosts file manager and the only listed file was 127.0.0.1 localhost.
Strange thing is that the text just above the file listing states "c:\Windows\system32\drivers\etc\hosts(2 lines,A) as the location for the file.
Lets try something.
Shutdown the pc and disconnect / unplug your internet connection.
Reboot and see if you can delete those temp files and also see if you get any message that X is trying to connect to the internet.
Looked at it in notepad and found the same as before. The only thing I found funny was that it was telling me 2 lines when only one was showing. Any more instructions tonight. Am going to have to stop in a few mins and get ready for a 3 am rise.
Disconnected the internet connection.
Rebooted computer
Went right to the temp folder and there were no .exe files there.
Monitored for over 5 mins and no appearance of generated files. No message to indicate that there was attempt by any program to access internet.
Checked prefetch folder and all of the previous .exe file names were referenced there as pf files.
Reconnected internet and monitored temp folder. No .exe files appeared in aprox 5 mins.
Shut computer down and it did not shut down without displaying a dialog box stating that dwwin.exe failed to initialize. Then the sprtcmd.exe ending program box appeared.
Rebooted computer and went to temp folder.
There were 2 .dat, 2 .txt and 1 .settings file.
After about 30 sec one of the .dat files dissappeared. I aprox 30 more seconds the computer accessed the internet as indicated by the pattern of lights on the modem and two .exe files appeared in the temp folder.
Include some info in last post just as your were posting. It was that when the computer shut down in the previous steps, a dialog box appeared stating that dwwin.exe failed to initalize, then sprtcmd.exe ending program dialog box appeared.
Downloaded and ran ATF Cleaner
Rebooted computer and monitored prefetch folder and the temp folder. There were only couple of files in the prefetch one having to do with atf cleaner. There were 2 .dat,2.txt and one .settings in the temp folder.Then the machine accessed the internet and two additional prefetch files appearedin the prefetch folder. I went to the temp folder and two .exe files appeared the names in both folders were the same except for the extensions.
