I have run MS antispyware and it detected 3721.com everytime and show the
remove option. But after I click remove and restart PC. It comes back again.
Also the folder and files installed by 3721.com at c:\program files\CNNIC
cannot be removed. The regedit also cannot remove any CNNIC or 3721 entries.
I read another user's post. How come his antispyware can remove 3721? I doubt
it.

I hope Microsoft could investigate this 3721.com plug-in and can complete
the removal of 3721 spyware.

Thanks.

Hello L,
Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe
http://computercops.biz/HijackThis.html

Save it to C:\hjt (new folder) then Open it and select Scan and Save Log.
Note where you saved the log then send it to him as an attachment. Put
Hijack in the subject so he'll know it's not spªm.

Alternatively you can post it on the Dell Forum ªt:

http://forums.us.dell.com/supportfor...d.id=si_hijack

(if it wraps you can go tº:

http://tinyurl.com/ckuzq instead.)

Put Ron in the subject so he will see it. You do not need to have a Dell to
post but you will need to register.

Ron Kinner
Microsoft MVP 2004 & 2005
(E-Mail Removed)

Good luck

Engel
--


"L" wrote:

> I have run MS antispyware and it detected 3721.com everytime and show the
> remove option. But after I click remove and restart PC. It comes back again.
> Also the folder and files installed by 3721.com at c:\program files\CNNIC
> cannot be removed. The regedit also cannot remove any CNNIC or 3721 entries.
> I read another user's post. How come his antispyware can remove 3721? I doubt
> it.
>
> I hope Microsoft could investigate this 3721.com plug-in and can complete
> the removal of 3721 spyware.
>
> Thanks.
>

Hi L - Boot to Safe mode of a "Clean Boot" and run MSAS from there. From my
Blog, Defending Your Machine, addy below in my Signature:

#########IMPORTANT#########

Show hidden files and run all of the following removal tools from Safe mode
or a "Clean Boot" when possible, logged on as an Administrator. BEFORE
running these tools, be sure to clear all Temp files and your Temporary
Internet Files (TIF) (including offline content.) Reboot and test if the
malware is fixed after using each tool.

HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT...02092715262339

Clean Boot - General Win2k/XP procedure, but see below for links for other
OS's (This for Win2k w/msconfig - you can obtain msconfig for Win2k here:
http://www.3feetunder.com/files/win2...nfig_setup.exe ):

1. StartRun enter msconfig.

2. On the General tab, click Selective Startup, and then clear the 'Process
System.ini File', 'Process Win.ini File', and 'Load Startup Items' check
boxes. Leave the 'boot.ini' boxes however they are currently set.

3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button. If you use a third party firewall
then re-check (enable) it. For example, if you use Zone Alarm, re-check the
True Vector Internet Monitor service (and you may also want to re-check
(enable) the zlclient on the Startup tab.) Equivalent services exist for
other third party firewalls. An alternative to this for XP users is to
enable at this time the XP native firewall (Internet Connection Firewall -
ICF). Be sure to turn it back off when you re-enable your non-MS services
and Startup tab programs and restore your normal msconfig configuration
after cleaning your machine.

4. Click OK and then reboot.

For additional information about how to clean boot your operating system,
click the following article links to view the articles in the Microsoft
Knowledge Base:

310353 How to Perform a Clean Boot in Windows XP
http://support.microsoft.com/kb/310353
281770 How to Perform Clean-Boot Troubleshooting for Windows 2000
http://support.microsoft.com/kb/281770/EN-US/
267288 How to Perform a Clean Boot in Windows Millennium Edition
http://support.microsoft.com/kb/267288/EN-US/
192926 How to Perform Clean-Boot Troubleshooting for Windows 98
http://support.microsoft.com/kb/192926/EN-US/
243039 How to Perform a Clean Boot in Windows 95
http://support.microsoft.com/kb/243039/EN-US/
#########IMPORTANT#########


? Sometimes the tools below will find files which they are unable to delete
because they are in use.

A program called Copylock, here, http://noeld.com/programs.asp?cat=misc can
aid in the process of "replacing, moving, renaming or deleting one or many
files which are currently in use (e.g. system files like comctl32.dll, or
virus/trojan files.)"

Another is Killbox, here: http://www.downloads.subratam.org/KillBox.zip

A third which is a bit different but often very useful is Delete Invalid
File, here: http://www.purgeie.com/delinv.htm which handles invalid/UNC
file/folder name deleting, rather than the in use problem.

A fourth useful program is Unlocker, here:
..http://ccollomb.free.fr/unlocker/ " Simply right click the folder or file
and select Unlocker. If the folder or file is locked, a window listing of
lockers will appear. Simply select the lockers and click Unlock and you are
done!" Works as advertised and is particularly helpful in identifying
malware components which are 'protecting' each other.





--
Regards, Jim Byrd, MS-MVP/DTS/AH-VSOP
My Blog, Defending Your Machine, here:
http://DefendingYourMachine.blogspot.com/



"L" <(E-Mail Removed)> wrote in message
news:E5F0FA64-A23B-4425-BB07-(E-Mail Removed)
> I have run MS antispyware and it detected 3721.com everytime and show the
> remove option. But after I click remove and restart PC. It comes back
again.
> Also the folder and files installed by 3721.com at c:\program files\CNNIC
> cannot be removed. The regedit also cannot remove any CNNIC or 3721
entries.
> I read another user's post. How come his antispyware can remove 3721? I
doubt
> it.
>
> I hope Microsoft could investigate this 3721.com plug-in and can complete
> the removal of 3721 spyware.
>
> Thanks.