[winter]

Tere
olgugi, et analoogseid teemasid siin juba on, siis ma ikkagi lisan veel ühe, sest probleemid päris samad ikkagi ei ole. Ei ole mul probleemi avalehega, see pysib ikka kenasti, aga mul jama sellise asjaga, et tekib mul desktopile peale igat restarti internet exploreri shortcutid - college education, strip poker, viagra videos ja muu selline sodi.
Kasutusel on olnud kõikvõimalikud spyware eemaldamise programmid. Korraks saan neist lahti, peale restarti kõik tagasi. Ma panen nüüd siia üles kõikvõimalike programmide poolt pakutavad logid. Oleks ääretult kena, kui keegi aitaks. Infoks siis veel nii palju, et olen proovinud neid asju removeda ka safe modes, kasu polnud midagi.
Hijackthis annab sellise info, oskab siit keegi midagi välja lugeda


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.thebestse.com/search.shtml
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.thebestse.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.thebestse.com/search.shtml
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.thebestse.com/search.shtml
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.thebestse.com/search.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.thebestse.com/search.shtml
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.thebestse.com/search.shtml
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.thebestse.com/search.shtml
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.thebestse.com/search.shtml
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] c:\compaq\cpqsetup\cpqset.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [system32.dll] C:\WINDOWS\system\systeminit.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Boingo.lnk = ?
O4 - Global Startup: sytem32.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_EN_XP.cab
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://download.rfwnad.com/cab/download.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{7EBAFE3B-5A61-4C97-909D-832AAFD5F985}: NameServer = 212.27.224.34,212.27.224.66
O19 - User stylesheet: C:\WINDOWS\sstyle.css
O19 - User stylesheet: C:\WINDOWS\sstyle.css (HKLM)

spybot annab sellise tulemuse


--- Search result list ---
Possible hijacker: Global settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Styles\User Stylesheet=

Possible hijacker: Global settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Styles\Use My Stylesheet=W=0

Possible hijacker: User settings (Registry change, nothing done)
HKEY_USERS\S-1-5-21-2409960447-1417818515-3399203189-1006\Software\Microsoft\Internet Explorer\Styles\User Stylesheet=

aga kahjuks ei suuda ta seda korda teha, väidab, et sai korda, aga peale restarti kõik vanaviisi

protsesside nimekiri on siis järgmine

--- Process list ---
Spybot-S&D process list report, 29.03.2004 19:07:06

PID: 0 ( 0) [System]
PID: 4 ( 0) System
PID: 196 (1952) C:\Program Files\OpenOffice\program\soffice.exe
PID: 228 (1952) C:\WINDOWS\System32\atiptaxx.exe
PID: 236 (1952) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
PID: 244 (1952) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
PID: 252 (1952) C:\Program Files\Compaq\EAB\EabServr.exe
PID: 276 (1952) C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
PID: 304 (1952) C:\WINDOWS\System32\MMTray.exe
PID: 312 (1952) C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
PID: 324 (1952) C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
PID: 340 (1952) C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
PID: 352 (1952) C:\Program Files\MSN Messenger\MsnMsgr.Exe
PID: 432 (1952) C:\Program Files\Boingo\Boingo.exe
PID: 624 (1952) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
PID: 740 ( 4) \SystemRoot\System32\smss.exe
PID: 792 ( 740) csrss.exe
PID: 824 ( 740) \??\C:\WINDOWS\system32\winlogon.exe
PID: 868 ( 824) C:\WINDOWS\system32\services.exe
PID: 880 ( 824) C:\WINDOWS\system32\lsass.exe
PID: 1064 ( 868) C:\WINDOWS\system32\svchost.exe
PID: 1212 ( 868) C:\WINDOWS\System32\svchost.exe
PID: 1344 ( 868) svchost.exe
PID: 1376 ( 868) svchost.exe
PID: 1660 ( 868) C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
PID: 1716 ( 868) C:\WINDOWS\System32\svchost.exe
PID: 1796 ( 868) C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PID: 1952 (1932) C:\WINDOWS\Explorer.EXE

olen selle asjaga täiesti hädas, enne kui HV-sse tulin tegelesin selle asjaga ikka mitu päeva juba.

PS. ise leian, et see probleem erineb natuke siin esitatutest, seega võtsin julguseteha uue teema
jutt on küll pikk, aga arvasin, et mõistlik on panna kõik eeldatavalt vajalikud asjad kohe korja

[HacaX]

http://www.able2know.com/forums/about21407.html

[winter]

HV on ikka asendamatu
au ja kiitus sulle HacaX
pärast päevi juramist selle asjaga sain su antud lingilt kohe lahenduse