that is because to get rid of all the bits of those you MUST go to one of the help forums and let them help you run some special scans that will clean it fully, these are not scans you can run without guidance from them. Go here to this link start your own new post there and tell them exactly what has happened to you and they will help you every step of the way, it may look overwhelming it but it is not when you do one thing at a time and just ask anytime you have a question.
I am there to so you can let me know if you have any problems. Just be sure once you start you follow only their instructions and keep on till they tell you that you are done. You will need to register to join the forum then post the link in this area.

Analysis and Malware Removal

ok thank you i will do that.

Here's a link to help you get rid of the virus once and for all. FYI ... I used to use AVG but now use Avast (also freeware) Anti-Virus software. It seems to have more protection than AGV, IMO. Good luck!

http://www.ehow.com/how_4406487_remove-jucheckexe.html

Name: jucheck
Filename: jucheck.exe
Command: C:\Windows\System32\dllcache\jucheck.exe

Description:
Added by the W32.Scrimge.O worm. W32.Scrimge.O is a worm that spreads through Microsoft instant messaging clients and opens a back door on the compromised computer.
File Location: C:\Windows\System32\dllcache\jucheck.exe

Startup Type: This startup entry is started automatically from a Run, RunOnce, RunServices, or RunServicesOnce entry in the registry.
HijackThis Category: O4 Entry

Discovered: September 28, 2007

Updated: September 28, 2007 5:22:51 PM

Also Known As: W32/Sdbot-DHX [Sophos], W32/Sdbot-DJL [Sophos]

Type: Worm

Infection Length 76,288 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

Once executed, the worm copies itself as the following file:
%System%\dllcache\jucheck.exe

It then creates the following registry entries so that it starts when Windows runs:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"jucheck" = "%System%\dllcache\jucheck.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\"MSNPRC" = "[PATH TO WORM]"

That's where it comes from the registry run key

It also modifies the following registry entry to lower security settings:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Windir%\system32\dllcache\"jucheck.exe" = "%System%\dllcache\jucheck.exe:*:Enabled:Windows Sharing"

The worm then connects to m.proxyisp.info on TCP port 21888 allowing unauthorized access to perform the following actions:

Update itself
Download additional files
Spread using Microsoft instant messaging clients
Delete itself

The worm checks the the locale settings of the compromised computer and then spreads through Microsoft instant messaging clients by sending a zipped file attachment of itself along with a message composed of some of the following text:

@ZHE SHI WO DE LUOZHAO :O QING BU YAO FA GEI BIEREN !!.
YI ZHANG WO GEN WO PENGYOU ZUI HAO DE ZHAOPIAN :S !!.
JIESHOU WO DE ZHAO PIAN :> !!.
KAN WO DE ZHAOPIAN :D.
NI HE WO !!! .... QING KAN :D.
kAN BA LI XI ER DUN JIN JIANYU HOU SHI DUO ME QIAOCUI :<.> VOC
TEM QUE VER ESTE RETRATO DE MIM

zep 516 -- I agree with your answer if the original poster was using Windows XP; however they stated the PC was running Windows 7! That's why I just sent them the link to "how-to" (simplified version) rather than printing giving less detailed instructions here. I don't believe what you posted will solve their problem.

Although ... I am familiar with a WIN SYS 32 and finally broke down and just bought a new laptop with Windows 7 and now I'm having to learn WIN SYS 64. Still, don't think your answer will work to fix her problem. Please feel free to correct me if I'm wrong :)

this was an old post it was brought back up by a spammer and they have deleted the spammers message now.

My post was for informational reasons only. I should have made that more clear. I didn't give any instructions to remove anything. I only highlighted the registry keys cause the user is asking "why does it keep coming back"

I would think that infection is possible on Windows 7 computer being that it infects Vista, and we certainly see the file jucheck.exe running on a Win 7 Machine.

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

I'm currently enrolled in Malware Removal at Geekstogo. I am forbidden to assist in any Malware removal of files or give any instructions to remove any such files from a computer until graduated.

Good luck with your new Laptop, 64Bit is a Bit more secure then 32Bit. The Malware writers are figuring it out though.

âÂÂjucheck.exeâ is part of the Java Runtime from Sun Corporation and not a trojan, IF it is located where it is supposed to be �" usually something like âÂÂC:\Program Files\Java\jre1.5.0_10\bin\jucheck.exeâÂÂ