Hi Again Its sounds like you have tried alot of things ,
I downloaded Cnsmin and shifted it within 30 mins so was
thinking its not that bad really but from what you are
saying its really dug itself in to yours ,I must of been
lucky with the add/remove screen entry(Chinese Keywords)
as it removed most of the crap,Spysweeper went from
detecting 171 to 14 after using the unistaller.The other
user said the unistaller took them to a chinese website
which was impossible to work out but again i must of been
lucky there.I'll have another crack at removing this
though if you have the time
I take it you have tried the add/remove screen chinese
keywords entry(note you should unplug your internet
connection before running the unistaller or else it takes
you to their site to probably download more crap)
ctfmon.exe is a genuine file and unconnected :
http://support.microsoft.com/?kbid=282599
Download Ccleaner to help clean up if you get this removed
http://download.ccleaner.com/download119bin.asp
copy this to notepad so you can still view it in safemode
Its hard to know which is the right order for this if you
have cns in the drivers folder it needs stopping
Goto start > then c/drive > then Windows > Open the
system32 folder > then the drivers folder > find
cnsminkp.sys
right click and rename it cnsminkp.old and then press
enter remove the start up entry from msconfig then remove
the cnsminkp.old file when you reboot into safe mode
If you wish to delete the cns downloaded program files
folder go for it this way :
First check msconfig
goto start then run and type
msconfig
goto the start up tab and check here for
CnsMin Rundll32.exe C:\WINDOWS\DOWNLO~1
\CNSMIN.DLL.Rundll32
Uncheck that, and Apply, then OK. Then restart your PC.
As your PC restarts, keep tapping F8 when you get the
menu, select safe mode with command prompt to go into DOS.
Now you'll have a C:\ prompt
Type the following;
cd \Windows\Downlo~1\
Now you'll have a C:\Windows\Downlo~1\ prompt
Type "dir" and you'll see any files this thing has dumped
in there,consisting of a number of files starting with
the letters cns, things like cnsmin.dll, cnsio, etc
There's also another directory called 3721.
Now to try delete it if its not still running ;press
control,alt & delete (task manager) and check the
processes tab for cns recheck msconfig and start over if
its still running .
Type the following at the C:\Windows\Downlo~1\ prompt;
del C:\Windows\Downlo~1\ cns*.*
When you hit enter on that command, DOS will respond with
Are you sure (Y/N)?
Enter Yes and reboot & proceed to remove the 3721 folder
and reg entries.
If this is something you have already tried and you wish
to remove the whole contents of the downloaded program
files folder then follow the above (msconfig,unchecking
the start up and booting into safe mode with command
prompt) but copy & paste this instead :
del C:\Windows\Downlo~1\ *.*
*BE VERY CAREFUL TO GET THIS RIGHT OTHERWISE YOU MIGHT
BLOW AWAY THE C:\WINDOWS DIRECTORY AND THAT WOULD BE VERY
VERY BAD
When you hit enter on that command, DOS will respond with
All files in directory will be deleted!
Are you sure (Y/N)?
Enter Y if you are VERY SURE you entered the command
right and you really want to delete the whole contents of
the downloaded program files folder.
To reset the recycle bin if its corrupted follow this .
open a command prompt,goto start,then run & type
cmd
Press enter to open the prompt screen
Copy and paste this line in :
attrib c:\recycler -h -s
Press Enter.Then type
del c:\recycler
Press enter again
Say yes when asked.Close the command prompt.
the recycle bin is recreated automatically by Windows (if
not immediately, then on the next reboot), and any thing
inside deleted.
clear the prefetch folder .Goto start run and type
Prefetch
delete the contents on this folder
Run Ccleaner on all 3 settings (windows,apps & issues)
Now Reboot the pc.
see if it loads again and if not clear the reg entries.,
Check these area's for 3721,cns or Interchina
HKEY_CLASSES_ROOT\CLSID\
{B83FC273-3522-4CC6-92EC-75CC86678DA4}
HKEY_CLASSES_ROOT\CLSID\
{D157330A-9EF3-49F8-9A67-4141AC41ADD4}
HKEY_CLASSES_ROOT\CnsHelper.CH
HKEY_CLASSES_ROOT\CnsHelper.CH.1
HKEY_CLASSES_ROOT\CnsMinHK.CnsHook
HKEY_CLASSES_ROOT\CnsMinHK.CnsHook.1
HKEY_CURRENT_USER\Software\3721
HKEY_LOCAL_MACHINE\Software\3721
HKEY_LOCAL_MACHINE\Software\InterChina
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\AdvancedOptions\!CNS
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Extensions\
{5D73EE86-05F1-49ed-B850-E423120EC338}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Extensions\
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71}
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Extensions\
{FD00D911-7529-4084-9946-A29F1BDF4FE5}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\Run\CnsMin
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersi
on\Uninstall\CnsMin
Another tool that may help for searching is this reg
searcher
This script allows you to search the registry for any
names and displays the results in notepad
http://andymanchesta.com/Downloads/RegSearch.vbs
**Note : VBScript and VBS files
VBScript files are nothing more than plain text files
with a .vbs extension, and they can be edited using any
text editor, such as Notepad. They contain a set of
instructions that are run when a user executes the file.
For example, you can create a .vbs file that reads a list
of names for shared folders on your local network and
maps a network drive to each name. Almost any action that
you can perform while sitting at your computer can be
automated by one of these scripts.
For this reason Most antivirus software will halt this
script and ask you if you want to proceed its mainly
because this script searches the registry and displays
results so its guarding the pc incase the script is being
run without your consent.The script is just a reg search
tool and harmless to your system.
If you still cannot remove this which im sure will be the
case if its running in the drivers folder and
regenerating download Hijack this and post the log to
show whats running on your pc.
Always create a Folder for HiJackThis anywhere but your
Temp/Temporary Internet Folders or Desktop. A good place
to make a folder would be in My Documents, as this is
where it will save the backup files needed if there's a
problem.)
Download Hijack this and save it into the new folder
http://www.spywareinfo.com/~merijn/files/hijackthis.zip
choose to run a scan and save the logfile,when its
finished it will open the results in notepad post that
back if your still having problems and i will try help
more
Regards Andy
