Virus - malware and grayware file removal

You can use a product like Killbox if they still won't delete.
http://www.scanwith.com/download/Pocket_KillBox.htm

It would've been great if you let us look at your hijackthis log.
If these files are part of an infection, they will come back.
If they are not part of an infection, then both of sirbounty's adviced will work.

Killbox can kill all the files in one go if you prefer it.
Download Pocket Killbox.
http://www.atribune.org/downloads/KillBox.exe
*Select the "Delete on Reboot" option.
*Select "All Files"
*Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\system32\cfgdei.dll
C:\WINDOWS\system32\cfgijt.dll
C:\WINDOWS\system32\diagdei.dll
C:\WINDOWS\system32\statdei.dll
C:\WINDOWS\system32\statijt.dll
C:\WINDOWS\system32\diagijt.dll
C:\WINDOWS\system32\brwmgr32.dll
C:\WINDOWS\system32\brwstat.dll
C:\WINDOWS\system32\confbrw.dll
C:\WINDOWS\system32\alrsbatt.dll
C:\WINDOWS\system32\e1.dll
C:\WINDOWS\system32\strmwin8.dll
C:\WINDOWS\system32\zlcocard.dll
C:\WINDOWS\system32\zlcocard.exe
C:\WINDOWS\alerter.exe

*Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
*If the computer doesn't restart, just restart manually.

You may need to unregister the DLLs to remove them..

Click Start->Run->CMD <Enter>
to get to a command prompt...

Now for each file listed above, type

regsvr32 /u C:\WINDOWS\system32\cfgdei.dll
regsvr32 /u C:\WINDOWS\system32\cfgijt.dll
regsvr32 /u C:\WINDOWS\system32\diagdei.dll
regsvr32 /u C:\WINDOWS\system32\statdei.dll
regsvr32 /u C:\WINDOWS\system32\statijt.dll
regsvr32 /u C:\WINDOWS\system32\diagijt.dll
regsvr32 /u C:\WINDOWS\system32\brwmgr32.dll
regsvr32 /u C:\WINDOWS\system32\brwstat.dll
regsvr32 /u C:\WINDOWS\system32\confbrw.dll
regsvr32 /u C:\WINDOWS\system32\alrsbatt.dll
regsvr32 /u C:\WINDOWS\system32\e1.dll
regsvr32 /u C:\WINDOWS\system32\strmwin8.dll
regsvr32 /u C:\WINDOWS\system32\zlcocard.dll

I'm never keen on unregistering bad dlls because it can be a booby trap and can explode, :)

Never heard that one before...?

I've register and unregister valid dlls all the time,
But I was taught not to unregister a malware dll because it can have bad consequences(if the virus writer include a code in that dll to do something)

This is what I've  learn from a malware expert and a long time programmer(Bobbi Flekman)
Unregistering a dll through the commandline (regsvr32 /u dll-file) calls the function UnRegisterServer() in the dll file, which is simply a code. In normal programming, the programmer would remove all the modifications (s)he would have made to the Registry. But you can do anything there, as long as it can be programmed. So, just imagin things... The malware programmer could create an Internet connection and dowload more malware to your system. Or he could format your harddisc. Or.... Etc. As you can read unregistering a dll the "official" way can get you into bigger trouble.

According to him also,
Windows is based on something called the Component Object Model.
This way you can get a word processor to treat texts as different languages to be checked, or use a program in several other programs (just think about Windows Media Player or Adobe Acrobat in Internet Explorer). To let the system know that the file is there, and can do that, you have to register the dll in the Registry. You do that through RegSvr32. A normal program (like the aforementioned Adobe Acrobat) will just make modifications to the Registry, and next time you start Internet Explorer and click on a .pdf file it will be opened within Internet Explorer. To get rid of it you'd call RegSvr32 again, and Adobe will clean out the modifications it made to the Registry.
This shows you that for normal programs it is okay to call RegSvr32

Makes sense I suppose.  Thanx for the feedback. :^)

No problem, :)

I will leave the following recommendation for this question in the Cleanup topic area:
   Split: sirbounty {http:#18147849} & rpggamergirl {http:#18150447}

Any objections should be posted here in the next 4 days. After that time, the question will be closed.

Tolomir
EE Cleanup Volunteer

@rpggamergirl: you should post that comment to the weekly EE-newsletter, really good advice!

Tolomir

>> you should post that comment to the weekly EE-newsletter, really good advice!<<
Hi Tolomir,
Thanks, I never thought of posting it at EE newsletter thanks for the idea.
But if you like to do it, please go ahead, :)

~rpg

Nope your merits...

I already had a hard time to write something usefull for my misc security zone on new-ee

Tolomir