Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    Mistä "friend" pois valikoista ja koneesta

    IE6:seen ilmestyi uusi työkalupainike nimeltään Friend, samoihin aikoihin alkoi ilmestyä popuppeja asiaan liittymättömälle sivulle (http://www.connection-internet.com/05.mini-pop/mini2.php->en kokeilsisi). Miten hankkiudun eroon tästä syylästä? Adaware ei sitä tunne eikä Norton.
    5548
    Äänestä

    Muut lukivat myös

    Vastaukset 5

    Vanhimmat

    • Tässä olisi lokitiedosto:
      Logfile of HijackThis v1.98.2
      Scan saved at 22:26:57, on 3.9.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\brsvc01a.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\brss01a.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\usrbridg.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      C:\PROGRA~1\NORTON~1\navapw32.exe
      C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINDOWS\System32\GSICON.EXE
      C:\WINDOWS\System32\dslagent.exe
      C:\WINDOWS\SYSTEM32\Drivers\DadTray.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
      C:\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.helsinginsanomat.fi/tuoreet
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C:\Program Files\Netscape\Netscape\searchplugins\SBWeb_01.src"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: Friend - {AC3AEF75-0A6B-4AB8-82B5-2C9BA8396644} - (no file)
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [DadApp] C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
      O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
      O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      O4 - HKLM\..\Run: [WebCam Monitor] C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Friend - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
      O9 - Extra 'Tools' menuitem: Toolbar Icon - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
      O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/developerzone/download/vet_install_popup.html?1&true
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
      O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
      O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093164691080
      O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} (TSCCInstall Class) - http://www.techsmith.com/codec/tsccinst.cab
      O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
      O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/12119/CTPID.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55
      O17 - HKLM\System\CS1\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55


      Avusta etukäteen kiittäen

      Äänestä

    • xpkotona kirjoitti:

      Tässä olisi lokitiedosto:
      Logfile of HijackThis v1.98.2
      Scan saved at 22:26:57, on 3.9.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\brsvc01a.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\brss01a.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\usrbridg.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      C:\PROGRA~1\NORTON~1\navapw32.exe
      C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINDOWS\System32\GSICON.EXE
      C:\WINDOWS\System32\dslagent.exe
      C:\WINDOWS\SYSTEM32\Drivers\DadTray.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
      C:\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.helsinginsanomat.fi/tuoreet
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C:\Program Files\Netscape\Netscape\searchplugins\SBWeb_01.src"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O3 - Toolbar: Friend - {AC3AEF75-0A6B-4AB8-82B5-2C9BA8396644} - (no file)
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [DadApp] C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
      O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
      O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      O4 - HKLM\..\Run: [WebCam Monitor] C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: Friend - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
      O9 - Extra 'Tools' menuitem: Toolbar Icon - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O10 - Unknown file in Winsock LSP: c:\windows\system32\msvrl.dll
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
      O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/developerzone/download/vet_install_popup.html?1&true
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
      O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
      O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093164691080
      O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} (TSCCInstall Class) - http://www.techsmith.com/codec/tsccinst.cab
      O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
      O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/12119/CTPID.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55
      O17 - HKLM\System\CS1\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55


      Avusta etukäteen kiittäen

      Pistä ensin se HijackThis.exe omaan kansioon

      Ota tosta LSPFix

      http://cexx.org/LSPFix.exe

      Avaa se ja pistä täppi ruutuun I know what I´m doing

      Sitte siirrät sillä nuolinäppäimellä kaikki nuo sinne oikealle puolelle ja paina Finish

      c:\windows\system32\msvrl.dll

      Sulje se sen jälkeen


      Scannaa uudestaan Hijackillä merkkaa nuo,sulje selain ja muut avoimet ikkunat ja paina FIX checked

      O3 - Toolbar: Friend - {AC3AEF75-0A6B-4AB8-82B5-2C9BA8396644} - (no file
      O9 - Extra button: Friend - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
      O9 - Extra 'Tools' menuitem: Toolbar Icon - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)

      Äänestä

    • Juu kirjoitti:

      Pistä ensin se HijackThis.exe omaan kansioon

      Ota tosta LSPFix

      http://cexx.org/LSPFix.exe

      Avaa se ja pistä täppi ruutuun I know what I´m doing

      Sitte siirrät sillä nuolinäppäimellä kaikki nuo sinne oikealle puolelle ja paina Finish

      c:\windows\system32\msvrl.dll

      Sulje se sen jälkeen


      Scannaa uudestaan Hijackillä merkkaa nuo,sulje selain ja muut avoimet ikkunat ja paina FIX checked

      O3 - Toolbar: Friend - {AC3AEF75-0A6B-4AB8-82B5-2C9BA8396644} - (no file
      O9 - Extra button: Friend - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
      O9 - Extra 'Tools' menuitem: Toolbar Icon - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)

      Logfile of HijackThis v1.98.2
      Scan saved at 7:42:54, on 4.9.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\brsvc01a.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\brss01a.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\usrbridg.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      C:\PROGRA~1\NORTON~1\navapw32.exe
      C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINDOWS\System32\GSICON.EXE
      C:\WINDOWS\System32\dslagent.exe
      C:\WINDOWS\SYSTEM32\Drivers\DadTray.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Uusi kansio\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.helsinginsanomat.fi/tuoreet
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C:\Program Files\Netscape\Netscape\searchplugins\SBWeb_01.src"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [DadApp] C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
      O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
      O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      O4 - HKLM\..\Run: [WebCam Monitor] C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
      O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/developerzone/download/vet_install_popup.html?1&true
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
      O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
      O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093164691080
      O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} (TSCCInstall Class) - http://www.techsmith.com/codec/tsccinst.cab
      O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
      O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/12119/CTPID.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55
      O17 - HKLM\System\CS1\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55

      En tiedä mitä tein, mutta kone ei mennyt ainakaan huonommaksi. Kiitokset Juulle avusta.

      Äänestä

    • xpkotona kirjoitti:

      Logfile of HijackThis v1.98.2
      Scan saved at 7:42:54, on 4.9.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\brsvc01a.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\System32\brss01a.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
      C:\Program Files\Norton AntiVirus\navapsvc.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\usrbridg.exe
      C:\WINDOWS\System32\MsPMSPSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      C:\PROGRA~1\NORTON~1\navapw32.exe
      C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINDOWS\System32\GSICON.EXE
      C:\WINDOWS\System32\dslagent.exe
      C:\WINDOWS\SYSTEM32\Drivers\DadTray.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
      C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\system32\NOTEPAD.EXE
      C:\Uusi kansio\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.helsinginsanomat.fi/tuoreet
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C:\Program Files\Netscape\Netscape\searchplugins\SBWeb_01.src"); (C:\Documents and Settings\kayttaja\Application Data\Mozilla\Profiles\default\y6p6y9i7.slt\prefs.js)
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
      O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [DadApp] C:\WINDOWS\SYSTEM32\Drivers\dadapp.exe
      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
      O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
      O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
      O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
      O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
      O4 - HKLM\..\Run: [WebCam Monitor] C:\Program Files\Creative\WebCam Monitor\TrayMon.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = ?
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
      O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
      O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
      O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/developerzone/download/vet_install_popup.html?1&true
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
      O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
      O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v43/yacscom.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093164691080
      O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} (TSCCInstall Class) - http://www.techsmith.com/codec/tsccinst.cab
      O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB
      O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/12119/CTPID.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55
      O17 - HKLM\System\CS1\Services\Tcpip\..\{2A8703E5-CFED-42D9-ADD6-51AA1C4EA7C9}: NameServer = 195.74.0.47 195.74.0.55

      En tiedä mitä tein, mutta kone ei mennyt ainakaan huonommaksi. Kiitokset Juulle avusta.

      Logi on kunnossa

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    xpkotona kirjoitti:

    IE6:seen ilmestyi uusi työkalupainike nimeltään Friend, samoihin aikoihin alkoi ilmestyä popuppeja asiaan liittymättömälle sivulle (http://www.connection-internet.com/05.mini-pop/mini2.php->en kokeilsisi). Miten hankkiudun eroon tästä syylästä? Adaware ei sitä tunne eikä Norton.

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu