Arkadaşlar, IE başlangıc sayfamı kafasına gore değiştiren bir şeyle (viruz mu, yoksa spy mı bilmiyorum) uğraşıyorum iki gundur. Denemedeiğim şey kalmadı. Bir turlu kurtulamıyorum.
Spybot, spy sweeper, ms antispyware, spyware nuker, kaspersky, norton vs. hepsini denedim, kurtulamadım.
Guvenli kipte silme, guvensiz kipte silme, hic biri kar etmiyor. Daha once bu tip şeyleri guvenli kipte hijaackthis ile temizleyip kurtuluyordum. Ama şimdi olmuyor. Task Manager goruntusu aşağıdaki linkte. Sorunu cıkaran dosyalar TASKMGRU.exe ve MSIMN32.EXE bunları siliyorum ama yeniden system32 klasorune geliyor. Bir de windows dizininde bhoass.dll var o da bunlarla beraber calışıyor ve surekli kendini yeniden yaratıyor. Başka bir (veya birden fazla) dosya da olmalı bunları yeniden yaratan, ama bulamıyorum. Yardım ederseniz sevinirim.

Task Manager:

http://www.3dniz.com/images/taskmngr.gif

Logfile of HijackThis v1.99.1
Scan saved at 17:49:59, on 14.04.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
D:\WINDOWS\System32\rundll32.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe
D:\WINDOWS\System32\tcpsvcs.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\System32\inetsrv\inetinfo.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\System32\wtmgl.exe
D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\WINDOWS\System32\TASKMGRU.EXE
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\WINDOWS\System32\MSIMN32.EXE
D:\Program Files\Macromedia\Dreamweaver MX 2004\Dreamweaver.exe
D:\DOCUME~1\bar\LOCALS~1\Temp\~e5d141.tmp
D:\DOCUME~1\bar\LOCALS~1\Temp\~e5d141.tmp
D:\Documents and Settings\bar\My Documents\hijaak\HijackThis.exe

O2 - BHO: BHDP Class - - D:\WINDOWS\bhoass.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [AVPCC] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [SpySweeper] "D:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSIMN32] D:\WINDOWS\System32\MSIMN32.EXE
O4 - HKCU\..\Run: [TASKMGRU] D:\WINDOWS\System32\TASKMGRU.EXE
O8 - Extra context menu item: FlashGet'i kullanarak indir - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Microsoft Excel'e Go&nder - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Tumunu FlashGet'i kullanarak indir - D:\Program Files\FlashGet\jc_all.htm
O16 - DPF: (Cult3D ActiveX Player) - http://host.cycore.net/plugins/wind...E_5.3.0.228.cab
O16 - DPF: (Live365Player Class) - http://www.live365.com/players/play365.cab
O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /service (file missing)
O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
__________________