C:/WINDOWS/Sistem/sservice.exe__________zamrzava komp

Bootaj sistem u Safe Modu (drzi CTRL za vreme boot-a) i odatle izbrisi sve te run= linije... Najbolje ti je preko Registry Editora, znaci ides Start -> Run -> ukucas "regedit". Zatim kad ti se otvori Registry, idi na HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Tamo ces videti verovatno te entrije, izbrisi ih. Ako ih nema, idi proveri u HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Adds a value at one or more of the following locations in the Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Policies\Explorer\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


The following values have been seen added:

"MSNMESENGER"="%System%\Main.exe"

"DirectX for Microsoft Windows"="%System%\Fservice.exe"

"DirectX for Microsoft Windows"="%System%\Sservice.exe"

"StubPath"="C:\Windows\system\Sservice.exe"


Modifies the value data of:

Shell

in the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

from:

"explorer.exe"

to:

"explorer.exe %System%\Fservice.exe"

so that the backdoor runs when you start Windows NT/2000/XP.