Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    HotXXX??

    Tollanen ohjelma katkaisee nettiyhteyden ja yrittää yhdistää johonkin. Millä voi poistaa? spysweeper? Apua!
    191402
    Äänestä

    Muut lukivat myös

    Vastaukset 19

    Vanhimmat

    • ..ja monesti. Entä spybot? voiskohan toimia?

      Äänestä

    • juggis kirjoitti:

      Koita ensin cwshredderiä, ja jos se ei auta niin Hijack This:iä. Molemmat ohjeineen löytyy täältä.
      http://koti.mbnet.fi/pattaya1/
      Kävin äskein lukemassa samantyylisestä ongelmasta: http://www.wilderssecurity.com/showthread.php?t=41594

      Lähti Hijack This:in avulla. Täältä ohjelma ohjeet. Lähetä logi tänne niin katsellaan sitä vähän.
      http://koti.mbnet.fi/pattaya1/hijackthis.htm

      tollanen tuli:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Mitäs nyt?

      Äänestä

    • joku kirjoitti:

      tollanen tuli:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Mitäs nyt?

      uudelleen alusta saakka.
      Puuttuu rivejä.

      Äänestä

    • joku kirjoitti:

      tollanen tuli:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Mitäs nyt?

      tai viruksista

      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe

      suosittelen online virustorjuntaohjelmien käyttöä.
      Scannaa muutamilla koneesi.

      Äänestä

    • joku kirjoitti:

      tollanen tuli:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Mitäs nyt?

      Tyhjää ensin temporary internet files ja temp hakemistot, sitten roskakori.
      Sitten tee hijack This:lle oma hakemisto ja siirrä ohjelma sinne. esim. C:\hjt\hijackthis.exe
      Tämä siksi, että backup:it poistetuista riveistä muodostuu/ovat tarvittaessa saatavilla.

      Aja hijack this uudestaan ja ruksaa:

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\search.html
      R1 - HKCU\Software\Microsoft\Internet
      Explorer\Main,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = C:\WINDOWS\search.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = C:\WINDOWS\search.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll

      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe

      Nämä ovat hyödyttömiä, koska "file missing"
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)

      Paina FIX ja käynnistä kone sen jälkeen uudelleen. Etsi seuraavan listan exe-tiedostot jos vielä löytyy ja tuhoa ne. Voi vaatia käynnistyksen vikasietotilaan. Aja hijack this uudestaan ja lähetä logi. Tämä siksi, että kun nuon monta trojalaista/matoa löytyi, niin voi löytyä vielä muutakin.

      C:\WINDOWS\winh.exe
      C:\WINDOWS\System32\MSZTCE.EXE
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      Trojan horse downloader.Agent.BJ - c:\WINDOWS\c_pan.exe

      Äänestä

    Kokeile Spy Sweeperia: http://www.webroot.com/
    Ja vielä lisäksi Window Washer (tuolta kanssa).

    Jos ei mikään tunnu auttavan ja haluat (varmaankin) ongelmasta eroon, niin sitten se on "format c:" Ikävä kyllä.

    Äänestä

    Mitä se tarkottaa? Jos asennan windowsin uudestaan, miten se tapahtuu?

    Äänestä

    • Ei tarvi mitään formaattia.
      Siellä logissa on muutama örkki ja ne saa poistettua,mutta pistä uus logi kokonaisena,siis yläosa puuttuu.

      Äänestä

    • Juu kirjoitti:

      Ei tarvi mitään formaattia.
      Siellä logissa on muutama örkki ja ne saa poistettua,mutta pistä uus logi kokonaisena,siis yläosa puuttuu.

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Äänestä

    • Juu kirjoitti:

      Ei tarvi mitään formaattia.
      Siellä logissa on muutama örkki ja ne saa poistettua,mutta pistä uus logi kokonaisena,siis yläosa puuttuu.

      niin mitä tuosta logista pitäisi poistaa?

      Äänestä

    • joku kirjoitti:

      niin mitä tuosta logista pitäisi poistaa?

      Tee niinku nimimerkki "juggis" kehoittaa ja pistä uus logi sen jälkeen.

      Äänestä

    • Juu kirjoitti:

      Tee niinku nimimerkki "juggis" kehoittaa ja pistä uus logi sen jälkeen.

      kokeilin hijackthisiä, ja tässä uusi logi:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Äänestä

    • joku kirjoitti:

      kokeilin hijackthisiä, ja tässä uusi logi:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Nämä rivit löytyy vielä "running prosesses"
      C:\WINDOWS\shman.exe

      Äänestä

    • juggis kirjoitti:

      Nämä rivit löytyy vielä "running prosesses"
      C:\WINDOWS\shman.exe

      Nämä ovat hyödyttömiä, koska "file missing"
      Eli kannattaa ruksata ja fixata .

      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)

      Äänestä

    • joku kirjoitti:

      kokeilin hijackthisiä, ja tässä uusi logi:
      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      c:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\windows\system\hpsysdrv.exe
      C:\Program Files\USB Storage RW\shwicon.exe
      C:\HP\KBD\KBD.EXE
      C:\Program Files\Common Files\Symantec Shared\ccApp.exe
      C:\Program Files\Winamp3\winampa.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      C:\WINDOWS\shman.exe
      C:\WINDOWS\System32\sxvhost.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      C:\WINDOWS\System32\rundll32.exe
      C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Omistaja\Työpöytä\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://elisa.net/paketti/haku.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
      O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
      O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program Files\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"
      O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
      O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
      O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\Coloreal\coloreal.exe"
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
      O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
      O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
      O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
      O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [RealTray] C:\Real\Player\realplay.exe SYSTEMBOOTHIDEPLAYER
      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
      O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
      O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe
      O8 - Extra context menu item: Shorten URL - http://www.cjb.net/menuext.html
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra button: Tuki - {9F959104-4C00-4592-A428-2703514BE24C} - http://tuki.elisa.net/ (file missing) (HKCU)
      O9 - Extra button: Palvelut - {A6C877A9-2172-405C-BD8A-FB2A40F9CEC6} - http://service.kolumbus.fi/ (file missing) (HKCU)
      O9 - Extra button: SMS-viesti - {F56B1AC7-7413-43DB-ABC3-E4A90CB5C02F} - http://sms.kolumbus.fi/ (file missing) (HKCU)
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
      O17 - HKLM\System\CCS\Services\Tcpip\..\{E59A3DF6-7F12-4E21-9714-C593EDA2A7C3}: NameServer = 212.63.11.250 212.63.10.250

      Pistä ensin se HijackThis.exe omaan kansioon tonne C:/HijackThis/HijackThis.exe

      Merkkaa nuo sulje selain ja paina sitä FIX kohtaa

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchwww.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
      O2 - BHO: (no name) - {DE3BEBDB-AEE7-4277-8B6E-4EEFFA9508AE} - C:\WINDOWS\System32\iiyed.dll

      O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
      O4 - HKLM\..\Run: [MSZTCE] C:\WINDOWS\System32\MSZTCE.EXE
      O4 - HKLM\..\Run: [httpd] C:\WINDOWS\c_pan.exe /i
      O4 - HKLM\..\Run: [MSOfficeCfg] C:\WINDOWS\shman.exe /i
      O4 - HKLM\..\Run: [Microsoft--Updates] sxvhost.exe
      O4 - HKLM\..\RunServices: [Microsoft--Updates] sxvhost.exe
      O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe

      Pistä sitte että piilotiedostot näkyy,ohjeet tuolla

      http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339?Open&src=ent&docid=2002092514302348&nsf=ent-security.nsf&view=docid&dtype=corp&prod=Symantec AntiVirus Corporate Edition&ver=8.x&osv=&osv_lvl=


      Sen jälkeen käynnistä vikasietotilassa etsi ja poista nämä jos löytyy

      iiyed.dll
      winh.exe
      MSZTCE.EXE
      pan.exe
      shman.exe
      sxvhost.exe
      system.exe

      Sitte käynnistä uudestaan ja pistä uus logi tänne.

      Äänestä

    pistä se logi kokonaan kun pistät seuraavan kerran sen Hijackthis login. noista sun logeista puuttuu yläosa mistä näkyy onko käyttöjärjestelmä ja selain päivitetty ja onko sulla uusin versio hijackthis ohjelmasta.

    Äänestä

    • eli ei enää mitään hätää. kiitos vaan.

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    joku kirjoitti:

    Tollanen ohjelma katkaisee nettiyhteyden ja yrittää yhdistää johonkin. Millä voi poistaa? spysweeper? Apua!

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu