From: <betty889125@hotrmailnospam.org>

| (see image link below as I can't attach a *.txt file to this group).
|
| http://i13.tinypic.com/40l2t81.jpg
|
| When I found my IE 6 browser refusing to open several browsers at a time,
| I did a ctrl-alt-delete and found two SERVICES processes. I also saw that
| my IEXPLORE.exe file would still be open as a memory hog (130 mg) even
| after closing all open browser screens. After using Crapcleaner to clean
| the temp files and cache, I ran a services.msc command and noticed this
| Key*** service, which I knew I never had before. The attached image link
| shows half of the places I found where it appeared in my registry.
| Obviously, Crap Cleaner deleted the exe file in the temp directory.
| When I was in services, I disabled it (it was set to "manual").
|
| I've searched all over Google and can't find any references to it.
|
| Hijackthis picked it up as an 023 item - Unknown owner - \LOCALS~1\Temp
| \exe (file missing)
|
| Before I delete all the registry references to it, would anyone here know
| of any site that discusses it?
|



Please submit a sample of "keygodsx.exe" to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email URL...
mailto:scan@virustotal.com?subject=SCAN

When you get the report, please post back the exact results.

It uses RootKit techniques so I suggest using Gmer.
http://www.gmer.net/



--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm