Archief - spyware en svchost te veel

Na 2 nachten zoeken en schelden eindelijk cashsearch eraf.

- remove file %windir%\system32\system32.dll (boot safe mode with command prompt in WXP Pro)

- empty all regkeys with system32.dll (ik had er ca. 8)

- empty all regkeys with cashsearch.biz (ik had er ca. 6)


Mijn pc loopt weer als vanouds......

Gr

yeep ik he het zelfde probleem

hier mijn log

--===**'FIND-ALL' VERSION 2, 5/04**===--


Sat Jul 17 20:37:41 2004 -- Results:
*System Info:

Microsoft Windows XP [Version 5.1.2600]
C: "" (A4A1:693E) - FS:NTFS clusters:4k
Total: 119 990 349 824 [112G] - Free: 34 914 021 376 [33G]


Locked or 'Suspect' file(s) found...
\\?\C:\WINDOWS\System32\D3D.DLL +++ File read error
\\?\C:\WINDOWS\System32\D3D.DLL +++ File read error


REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
@=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]
@="NAV Helper"

REGEDIT4

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter]

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/octet-stream]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/x-complus]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/x-msdownload]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler]
@="AP Class Install Handler filter"
"CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate]
@="AP Deflate Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip]
@="AP GZIP Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml]
@="AP lzdhtml encoding/decoding Filter"
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/html]
"CLSID"="{B42E65D1-4DA9-459C-8937-2EB35825F936}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/plain]
"CLSID"="{B42E65D1-4DA9-459C-8937-2EB35825F936}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml]
@="WebView MIME Filter"
"CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}"

application/octet-stream
{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\System32\mscoree.dll

application/x-complus
{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\System32\mscoree.dll

application/x-msdownload
{1E66F26B-79EE-11D2-8710-00C04F79ED0D}
C:\WINDOWS\System32\mscoree.dll

Class Install Handler
{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}
C:\WINDOWS\system32\urlmon.dll

deflate
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

gzip
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

lzdhtml
{8f6b0360-b80d-11d0-a9b3-006097942311}
C:\WINDOWS\system32\urlmon.dll

text/html
{B42E65D1-4DA9-459C-8937-2EB35825F936}
C:\WINDOWS\System32\iembmpa.dll

text/plain
{B42E65D1-4DA9-459C-8937-2EB35825F936}
C:\WINDOWS\System32\iembmpa.dll

text/webviewhtml
{733AC4CB-F1A4-11d0-B951-00A0C90312E1}
%SystemRoot%\system32\SHELL32.dll

{B42E65D1-4DA9-459C-8937-2EB35825F936} C:\WINDOWS\System32\iembmpa.dll
{B42E65D1-4DA9-459C-8937-2EB35825F936} C:\WINDOWS\System32\iembmpa.dll

_______________________________

{BDF3E430-B101-42AD-A544-FADC6B084872}
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll


kan iemand mij helpen ?

greetz

hathi

Probeer eens dit programma ; SpHjfix verwijdert de vorige variant van CWSearch.
Download ook CWShredder(zie sticky).

Start op in veilige modus; gebruik eerst SpHjfix, en dan CWshredder.
Het is wel vreemd dat die variant nog opduikt; als het bovenstaande niet werkt, maak dan een hijackthis-log(sticky).

het heeft gewerkt

merci j.

greetz

hathi