|
 |
|
What is Sagipsul Spyware and how to remove it?
In this case it looks as though the Sagipsil has come in on the back of a Trojan or Vundo/Virtumode.
1. Turn off System Restore
2. Start Hijackthis again and check (tick) these entries.
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
O2 - BHO: {61f29d66-4b66-302b-d394-74e6d840a838} - {838a048d-6e47-493d-b203-66b466d92f16} - D:\WINDOWS\system32\ydjtmx.dll (trojan)
O4 - HKLM\..\Run: [Jigsaw] D:\DOCUME~1\VAL~1.VAL\LOCALS~1\Temp\3913574.exe (Random file ) Malware
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k (not needed on startup)
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe (Trojan)
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (not needed on startup)
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] D:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') (not needed on startup)
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] D:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') (not needed on startup)
O8 - Extra context menu item: &Search - ?p=ZUfox000 (Malware)
O20 - AppInit_DLLs: zjceqq.dll D:\WINDOWS\system32\guard32.dll D:\WINDOWS\system32\cssdll32.dll ydjtmx.dll (See Below) *
O20 - Winlogon Notify: efcAQIcA - efcAQIcA.dll (file missing)
O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - D:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe (file missing)
O23 - Service: Roxio Upnp Server 9 - Unknown owner - D:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe (file missing)
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - D:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: stllssvr - Unknown owner - D:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
* Now info on the above O20 item, you will notice the file in the middle "guard32.dll" before people jump up and down. The file belongs to Comodo Firewall, the problem is that the files around it belong to Trojans, whether hijacking the firewall or not. So that is why I say to tick it, to fix the registry entry. After the PC is clean, you may or may not have to reinstall the Comodo Firewall.
For the entries to tick above after ticking them Now click "Fix Checked" then your PC may need to be restarted.
3. Now download Malwarebytes and also download SUPERantispyware Free, Install, Update their Definitions, then do Full Scans with both programs.
|
| | |
 |
|
|
Anti Virus - Spyware Removal - Trojan Removal - Registry Repair