Kako izbrisati siszyd32.exe iz racunara?

Kako izbrisati siszyd32.exe iz racunara?

offline
  • Pridružio: 13 Dec 2009
  • Poruke: 99
  • Gde živiš: RS

-Siszyd32.exe je program koji mi stoji u startup-u i ne mogu da ga iskljucim.Kompijuter mi radi normalno i kad se konektijem na internet odmah mi se zakuje RAM memorija na 100 %!

-Problem mi se pojavio kad su mi neka mala djeca bila na kompu i isla traziti online igrice da se igraju.

-Od zastite korsitim NOD 324 i Anti Malwarebyts i oni mi nista nisu nasli sto je vezano za ovaj siszyd32.

-Pokusamo sam rijesiti tako sto sam otisao u run/msconfig i iskljuciti ga iz startup-a i to nije uspjeli.POsle sam otisao na lokaciju koju mi je pookazalo da se nalazi da ga izbiresm ,ali i ga tamo nije bilo.

-Internet koji korsitim je Wireles i brzina je 768/192

-Kompijuter mi je sporiji,a i brzina interneta mi je slabija.

DDS files...


DDS (Ver_09-12-01.01) - NTFSx86
Run by Sinisa at 0:22:54,76 on pon 14.12.2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.255.70 [GMT 1:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\DllHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sinisa\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = [Link mogu videti samo ulogovani korisnici]
uSearch Bar = [Link mogu videti samo ulogovani korisnici]
mSearchAssistant = [Link mogu videti samo ulogovani korisnici]
BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 9\SnagitBHO.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: UrlHelper Class: {474597c5-ab09-49d6-a4d5-2e8d7341384e} - c:\program files\imesh applications\imesh\iMeshIEHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 9\SnagitIEAddin.dll
TB: StylerToolBar: {d2f8f919-690b-4ea2-9fa7-a203d1e04f75} -
TB: MediaBar: {abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f} - c:\program files\imeshmediabartb\iMeshMediaBarDx.dll
TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto
StartupFolder: c:\documents and settings\sinisa\start menu\programs\startup\siszyd32.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [Link mogu videti samo ulogovani korisnici]
TCP: {95A8FC72-0DE2-4BF0-B084-2E5DF9DDE3AE} = 87.250.98.250 208.67.222.222
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2009-12-12 17:25:36 0 ----a-w- c:\windows\system32\drivers\gjshthp.sys
2009-12-12 17:25:09 118 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2009-12-12 17:23:47 4 ----a-w- c:\docume~1\sinisa\applic~1\avdrn.dat
2009-12-09 19:44:21 0 d-----w- c:\program files\PowerISO
2009-12-02 19:17:49 0 d--h--w- c:\windows\PIF
2009-11-30 20:31:23 0 d-----w- c:\program files\Lavalys
2009-11-30 16:18:08 0 d-----w- c:\documents and settings\sinisa\.tuxguitar-1.2
2009-11-30 16:16:27 0 d-----w- c:\program files\TuxGuitar
2009-11-29 16:46:45 0 d-----w- c:\windows\system32\_upd
2009-11-29 16:46:40 0 d-----w- c:\program files\Web Navigator
2009-11-19 14:09:41 0 d-----w- c:\program files\AP Tuner

==================== Find3M ====================

2009-12-13 15:22:12 8 ----a-w- c:\docume~1\alluse~1\applic~1\VGANGMJYMWPP.SYS
2009-12-06 21:01:01 137464 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-12-06 21:00:32 214520 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-11-09 03:21:18 59388 ----a-w- c:\windows\system32\drivers\scdemu.sys
2009-11-08 12:15:49 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-10-14 18:00:48 8 ----a-w- c:\docume~1\alluse~1\applic~1\VGALCAJYWPP.SYS
2009-10-10 21:07:50 604488 ----a-w- c:\windows\system32\TUProgSt.exe
2009-10-10 21:07:45 361288 ----a-w- c:\windows\system32\TuneUpDefragService.exe

============= FINISH: 0:25:05,93 ===============



[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]

[Link mogu videti samo ulogovani korisnici]


[Link mogu videti samo ulogovani korisnici]


Nadam se da sam sve uradio kako je propisano!!
Unaprijed zahvaljujem!!



offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Pozdrav...


Reklo bi se da ovde ima i većih problema od tog pomenutog file-a.



Pre bilo čega, aktiviraj System Restore za C: disk.

Control Panel > System > System Restore.



Pažljivo isprati sledeće uputstvo.


Arrow Preuzmi The Avenger na Desktop.
Raspakuj arhivu u neki folder

Dvoklikom pokreni avenger.exe

Iskopiraj tekst koji se nalazi unutar Kod polja u (beli) prozor programa:


Files to delete:
c:\documents and settings\sinisa\start menu\programs\startup\siszyd32.exe
c:\windows\system32\drivers\gjshthp.sys
c:\windows\system32\fjhdyfhsn.bat
c:\docume~1\sinisa\applic~1\avdrn.dat
c:\docume~1\alluse~1\applic~1\VGANGMJYMWPP.SYS
c:\docume~1\alluse~1\applic~1\VGALCAJYWPP.SYS

Drivers to delete:
gjshthp



Klikni Execute, a zatim Yes u sledeća dva prozora koji će se otvoriti

Kompjuter će se restartovati dva puta i započeti će proces čišćenja/skeniranja

Kada proces bude završen, logfile C:\avenger.txt će se otvoriti u Notepad-u

Iskopiraj sadržaj dobijenog loga u temu na forumu.




Arrow Upload-uj file> C:\avenger\backup.zip

preko ovog linka: [Link mogu videti samo ulogovani korisnici]



offline
  • Pridružio: 13 Dec 2009
  • Poruke: 99
  • Gde živiš: RS

Logfile of The Avenger Version 2.0, (c) by Swandog46
[Link mogu videti samo ulogovani korisnici]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\documents and settings\sinisa\start menu\programs\startup\siszyd32.exe" deleted successfully.
File "c:\windows\system32\drivers\gjshthp.sys" deleted successfully.
File "c:\windows\system32\fjhdyfhsn.bat" deleted successfully.
File "c:\docume~1\sinisa\applic~1\avdrn.dat" deleted successfully.
File "c:\docume~1\alluse~1\applic~1\VGANGMJYMWPP.SYS" deleted successfully.
File "c:\docume~1\alluse~1\applic~1\VGALCAJYWPP.SYS" deleted successfully.
Driver "gjshthp" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Evo rezultata,a ovaj backup file sam uplodovao!

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Kakvo je sada stanje?

offline
  • Pridružio: 13 Dec 2009
  • Poruke: 99
  • Gde živiš: RS

Sad je dobro, ovaj siszyd32 je ikljucen iz startup-a ,a i RAM memorija mi se nomralizovala....

Sad me interesuje koje su posljedice od tog siszyd32 file-a i jeli samo on bio problem ili je jos nesto smetalo??

P.S. Hvala jos jednom na pomoci.

offline
  • dr_Bora  Male
  • Anti Malware Fighter
    Rank 2
  • Pridružio: 24 Jul 2007
  • Poruke: 12280
  • Gde živiš: Höganäs, SE

Postojao je i jedan rootkit.

Ne bi trebalo biti nekih posledica.

Obriši avenger folder koji se nalazi na C disku, sve korišćene programe, isključi i zatim ponovo uključi System Restore:

[Link mogu videti samo ulogovani korisnici]


To bi bilo sve...

Ko je trenutno na forumu
 

Ukupno su 2351 korisnika na forumu :: 71 registrovanih, 6 sakrivenih i 2274 gosta   ::   [ Administrator ] [ Supermoderator ] [ Moderator ] :: Detaljnije

Najviše korisnika na forumu ikad bilo je 5623 - dana 13 Dec 2025 19:56

Korisnici koji su trenutno na forumu:
Korisnici trenutno na forumu: 100ka, Aleksej, amadeus, Arsenije, awathorn, bolimejoli, boro975, brundo65, BSD, Bubili, cikadeda, Coficab, Deki Duga Devetka, desmeki, Despot1, Dogma21, dok80, dolinalima, DovlaODR, dradex, dulleo, Dzoni2412, Frunze, halkin gol, Hans Gajger, Igritelj, ILGromovnik, Ivan Gajic, jalos, Jaxupa, Joint Chief, Jovan.D, koom0001, kuntakinte, leptirleptir, mane123, Mexaleroo, Mi lao shu, Mickey12345, Mzee, Neutral-M, nuki1234, panonski mornar, Panter, partyzan, Pegggio, Profesor_018, Remarqe, rikirubio, Rok A Bit, rovac, sabros, sajorg, Samo gledam, savaskytec, Sonic, spektorsky, srpskasparta, TRZH92, vaci, VaRvArI 85, vasa.93, vaso1, Vatreni Zmaj, vdeki, VJ, vrag81, Wepp, wizzardone, Zavulon, zax22r