Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    mikä mättää??

    Logfile of HijackThis v1.98.2
    Scan saved at 18:18:20, on 30.9.2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\ewupdater.exe
    C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
    C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\program files\altnet\points manager\points manager.exe
    C:\WINDOWS\System32\golumm\services.exe
    C:\Program Files\Windows SyncroAd\SyncroAd.exe
    C:\WINDOWS\System32\cwxeiu.exe
    C:\Program Files\Windows SyncroAd\WinSync.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Markus Louhela\Application Data\r???.exe
    C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
    C:\Program Files\Common Files\GMT\GMT.exe
    C:\Program Files\Common Files\CMEII\CMESys.exe
    C:\Documents and Settings\Markus Louhela\xexx.exe
    C:\Program Files\Internet Optimizer\optimize.exe
    C:\Program Files\Internet Optimizer\actalert.exe
    C:\Program Files\BullsEye Network\bin\bargains.exe
    C:\Documents and Settings\Markus Louhela\gam.exe
    C:\PROGRA~1\INTERN~1\iexplore.exe
    C:\temp\msbb.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\ISTsvc\istsvc.exe
    C:\Program Files\Web_Rebates\WebRebates1.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Web_Rebates\WebRebates0.exe
    C:\Program Files\hijack\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
    O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll
    O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\multimpp.dll
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\spy\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\Windows\2_0_1browserhelper2.dll
    O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem302.dll
    O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
    O2 - BHO: (no name) - {B0B32105-E13C-478F-ABED-17A01E289D7E} - C:\WINDOWS\System32\nnjde.dll
    O2 - BHO: BHO Class - {C77E900A-FF55-400E-9BAA-E042C8212898} - C:\Program Files\SimpelInternet\Easybar\ToolbarStarter.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
    O3 - Toolbar: Easybar - {9AD55269-A21C-4260-BA7F-866FD09E8A8E} - C:\Program Files\SimpelInternet\Easybar\EasyBarShell.dll
    O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [KAZAA] C:\Program Files\kazaa\kazaa.exe /SYSTRAY
    O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
    O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
    O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
    O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\twink64.exe internat.dll,LoadKeyboardProfile
    O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
    O4 - HKLM\..\Run: [xvyeipq] C:\WINDOWS\System32\cwxeiu.exe
    O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
    O4 - HKLM\..\Run: [iryb] C:\WINDOWS\iryb.exe
    O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
    O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
    O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
    O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
    O4 - HKLM\..\Run: [msbb] c:\temp\msbb.exe
    O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\RunOnce: [djtopr1150.exe] "C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\djtopr1150.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\Markus Louhela\Application Data\r???.exe
    O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
    O4 - HKCU\..\RunOnce: [DeleteSlotchBar] rundll32.exe advpack.dll,DelNodeRunDLL32 "C:\Program Files\ISTbar\istbar.dll"
    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
    O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: *.searchmiracle.com
    O15 - Trusted Zone: *.skoobidoo.com
    O15 - Trusted Zone: *.windupdates.com
    O16 - DPF: v2cab - http://11257.searchmiracle.com/cab/v2cab.cab
    O16 - DPF: {0224CCF2-1F48-6DCE-DFDF-46983D3CA245} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {07D9DEFB-69BF-442E-0861-31B11467C630} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=30579607f432361f4c24553de3a9fe7e27f55e8c7382e8f812488538178c09374cd3d1696277ab341d588a056fa84851d5e1f9fecd5da6e7490e:d3e35fce064ccfbb2d7510b28ebf1261
    O16 - DPF: {17D1634A-3C38-0F96-49B5-79E5168E0755} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
    O16 - DPF: {3CD15CBE-B871-6E7D-B909-729B2D96B492} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {3F2705D0-C9D8-4020-A15C-E495A0050EC6} (Easywebinstaller Control) - http://s7.blingblingcontent.com/toolbarcash/activex/easywebinstaller.ocx
    O16 - DPF: {536A0561-1E40-7D00-D37F-1FDB5FDB5B55} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2503e068cbfed368e005/netzip/RdxIE601.cab
    O16 - DPF: {5854BDBE-AF30-1FD3-8026-095B325536F2} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {68086D9F-B4ED-7242-994F-65760562E597} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
    O18 - Filter: text/html - {F7302311-3078-436D-96E8-D02C2A2F7EF4} - C:\WINDOWS\System32\nnjde.dll
    O18 - Filter: text/plain - {F7302311-3078-436D-96E8-D02C2A2F7EF4} - C:\WINDOWS\System32\nnjde.dlln

    ongelma ei poistu millää..
    171153
    Äänestä

    Muut lukivat myös

    Vastaukset 17

    Vanhimmat

    No täälä on aika riskisti roskaa,mutta tossa kaappariversiossa on usein piilotiedosto mukana,joka ei näy tässä logissa,katotaan se ensin.


    Lataa tosta FINDnFIX

    http://downloads.subratam.org/FINDnFIX.exe


    Tuplaklikkaa sitä FINDnFIX.exe:tä,niin se asentaa koneelle kansion nimeltä FINDnFIX.
    Avaa se FINDnFIX kansio ja tuplaklikkaa !LOG!.bat kohtaa ja anna sen rauhassa etsiä.
    Kun se on valmis niin tulee LOG.txt esiin,liitä se logi tänne.

    Äänestä

    • ei onnistu..
      järjestelmätiedostoa ei voi käyttää dos.ja windows-sovellusten suorittamiseen.. "sulje"

      Äänestä

    • mikko__ kirjoitti:

      ei onnistu..
      järjestelmätiedostoa ei voi käyttää dos.ja windows-sovellusten suorittamiseen.. "sulje"

      No tuo ei kuullosta yhtään kivalle.
      Klikkasikko varmasti oikeaa kohtaa

      Äänestä

    • Juu kirjoitti:

      No tuo ei kuullosta yhtään kivalle.
      Klikkasikko varmasti oikeaa kohtaa

      Kannattaisiko koittaa ensiksi online scannereita, on muutamia troijalais-epäilyjä tuos logis.

      Äänestä

    • Juu kirjoitti:

      No tuo ei kuullosta yhtään kivalle.
      Klikkasikko varmasti oikeaa kohtaa

      joo painoin, mut ei suostu suorittamaan sitä ohjelmaa..

      Äänestä

    • mikko__ kirjoitti:

      joo painoin, mut ei suostu suorittamaan sitä ohjelmaa..

      Koitas ensin putsata se kone tolla online scannerilla.

      http://housecall.trendmicro.com/


      Koita sitte jos se FINDnFIX ohjelma toimii.
      Kyllä sen piilotiedoston löytää muillakin konsteilla,mutta se poisto on pikkasen monimutkasempi homma.

      Äänestä

    • juggis kirjoitti:

      Kannattaisiko koittaa ensiksi online scannereita, on muutamia troijalais-epäilyjä tuos logis.

      Joo täytyy kokeilla.
      Jos siellä on se piilotiedosto,niin se ois niin helpo poistaa tolla FINDnFIX:llä.

      Äänestä

    • Juu kirjoitti:

      Koitas ensin putsata se kone tolla online scannerilla.

      http://housecall.trendmicro.com/


      Koita sitte jos se FINDnFIX ohjelma toimii.
      Kyllä sen piilotiedoston löytää muillakin konsteilla,mutta se poisto on pikkasen monimutkasempi homma.

      http://housecall.trendmicro.com/ poisti kaikki muut paitsi TROJ_AGENT.FN JA TROJ_STRTPAGE.IX

      findnfix ei vieläkään toimi..

      Äänestä

    • mikko__ kirjoitti:

      http://housecall.trendmicro.com/ poisti kaikki muut paitsi TROJ_AGENT.FN JA TROJ_STRTPAGE.IX

      findnfix ei vieläkään toimi..

      Katotaan onko siellä sitä piilotiedostoo.

      Ota tosta DllCompare.exe

      http://download.broadbandmedic.com/DllCompare.exe

      Aukase se ja klikkaa Run Locate.com kohtaa
      Sitte klikkaa Compare kohtaa ja ootat että se tutkii valmiiks.
      Sitte klikkaa Make Log of what was found.

      Sitte kopioi alla oleva teksti notepadiin


      Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
      ren windows1.hiv windows.txt


      Säästä se työpöydälle nimellä Appinit.bat
      Alapuolelta valitse sitte kaikki fiilut

      Sitte klikkaat sitä Appinit.bat:ia työpöydällä
      ja ulos tulee windows.txt logi

      Kopioi ja pistä tänne sitte ne molemmat logit

      DllCompare.exe:n logi ja se windows.txt logi.

      Ilmota myös kumpi systeemi sulla on

      FAT 32 vai NTFS

      Äänestä

    • Juu kirjoitti:

      Katotaan onko siellä sitä piilotiedostoo.

      Ota tosta DllCompare.exe

      http://download.broadbandmedic.com/DllCompare.exe

      Aukase se ja klikkaa Run Locate.com kohtaa
      Sitte klikkaa Compare kohtaa ja ootat että se tutkii valmiiks.
      Sitte klikkaa Make Log of what was found.

      Sitte kopioi alla oleva teksti notepadiin


      Reg save "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows" windows1.hiv
      ren windows1.hiv windows.txt


      Säästä se työpöydälle nimellä Appinit.bat
      Alapuolelta valitse sitte kaikki fiilut

      Sitte klikkaat sitä Appinit.bat:ia työpöydällä
      ja ulos tulee windows.txt logi

      Kopioi ja pistä tänne sitte ne molemmat logit

      DllCompare.exe:n logi ja se windows.txt logi.

      Ilmota myös kumpi systeemi sulla on

      FAT 32 vai NTFS

      kävi samalla tavalla kuin findnfixin kanssa, ei toimi.

      Äänestä

    • mikko__ kirjoitti:

      kävi samalla tavalla kuin findnfixin kanssa, ei toimi.

      No pistä uus Hijack logi tänne,niin koitetaan putsata sitä.

      Äänestä

    • Juu kirjoitti:

      No pistä uus Hijack logi tänne,niin koitetaan putsata sitä.

      Logfile of HijackThis v1.98.2
      Scan saved at 22:53:12, on 30.9.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Windows SyncroAd\SyncroAd.exe
      C:\WINDOWS\System32\golumm\services.exe
      C:\WINDOWS\ewupdater.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Windows SyncroAd\WinSync.exe
      C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Web_Rebates\WebRebates1.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Markus Louhela\xexx.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\hijack\hijackthis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      O2 - BHO: (no name) - {864BACC1-3228-473A-BBAE-04BCC81B0CB0} - C:\WINDOWS\System32\hgnnmb.dll
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
      O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
      O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
      O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
      O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise/products/housecall_pre.php (file missing)
      O16 - DPF: {00A10419-BBE8-0179-FB86-52013D7B7947} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0190C0D2-900B-495D-3F2F-319D586095CC} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {077E4F1A-1A59-1387-3C31-20592FA93D38} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0C49B222-84A4-33EB-5E6E-52EF2115668D} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {18096220-B2AC-782B-0614-69CE12592DAF} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {1BE6D802-8986-19B8-6B0E-1A3A49563D98} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {33FB2C9F-6638-5A86-ABC9-11A76D21B62E} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {50A009B9-2F8F-683C-AF6D-52DD79D2AE0D} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
      O18 - Filter: text/html - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll
      O18 - Filter: text/plain - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll

      Äänestä

    • mikko__ kirjoitti:

      Logfile of HijackThis v1.98.2
      Scan saved at 22:53:12, on 30.9.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Windows SyncroAd\SyncroAd.exe
      C:\WINDOWS\System32\golumm\services.exe
      C:\WINDOWS\ewupdater.exe
      C:\WINDOWS\system32\slserv.exe
      C:\Program Files\Windows SyncroAd\WinSync.exe
      C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Web_Rebates\WebRebates1.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Documents and Settings\Markus Louhela\xexx.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\hijack\hijackthis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      O2 - BHO: (no name) - {864BACC1-3228-473A-BBAE-04BCC81B0CB0} - C:\WINDOWS\System32\hgnnmb.dll
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
      O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
      O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
      O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
      O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
      O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise/products/housecall_pre.php (file missing)
      O16 - DPF: {00A10419-BBE8-0179-FB86-52013D7B7947} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0190C0D2-900B-495D-3F2F-319D586095CC} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {077E4F1A-1A59-1387-3C31-20592FA93D38} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0C49B222-84A4-33EB-5E6E-52EF2115668D} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {18096220-B2AC-782B-0614-69CE12592DAF} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {1BE6D802-8986-19B8-6B0E-1A3A49563D98} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {33FB2C9F-6638-5A86-ABC9-11A76D21B62E} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {50A009B9-2F8F-683C-AF6D-52DD79D2AE0D} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
      O18 - Filter: text/html - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll
      O18 - Filter: text/plain - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll

      Poista nämä Lisää/Poista paneelista jos ne siellä näkyy

      Windows SyncroAd
      WebRebates0
      P2P Networking
      Kazaa

      Jos on pakko käyttää Kazaa,niin asenna sitte Kazaa Lite ku kone on putsattu


      Hae tuolta APM

      http://www.diamondcs.com.au/index.php?page=apm


      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      O2 - BHO: (no name) - {864BACC1-3228-473A-BBAE-04BCC81B0CB0} - C:\WINDOWS\System32\hgnnmb.dll
      O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
      O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
      O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
      O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
      O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
      O16 - DPF: {00A10419-BBE8-0179-FB86-52013D7B7947} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0190C0D2-900B-495D-3F2F-319D586095CC} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {077E4F1A-1A59-1387-3C31-20592FA93D38} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0C49B222-84A4-33EB-5E6E-52EF2115668D} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {18096220-B2AC-782B-0614-69CE12592DAF} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {1BE6D802-8986-19B8-6B0E-1A3A49563D98} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {33FB2C9F-6638-5A86-ABC9-11A76D21B62E} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {50A009B9-2F8F-683C-AF6D-52DD79D2AE0D} - http://69.50.188.54/1/gdnFI208.exe
      O18 - Filter: text/html - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll
      O18 - Filter: text/plain - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll


      Sitte avaa se APM ja yläikkunasta valitse
      C:/Windows/explorer.exe

      Alaikkunasta klikkaa tota jos se näkyy siellä ja valikosta Unload dll. ja ok

      C:\WINDOWS\System32\hgnnmb.dll
      Sulje se sitte


      Käynnistä sitte vikasietotilassa etsi ja poista jos löytyy

      hgnnmb.dll
      ewupdater.exe
      P2P Networking.exe

      C:\Program Files\Windows SyncroAd\SyncroAd.exe
      - tuolta pois Windows SyncroAd kansio

      C:\WINDOWS\System32\golumm\services.exe
      - tuolta pois golumm kansio

      C:\Program Files\Web_Rebates\WebRebates0.exe"
      - tuolta pois Web_Rebates kansio


      Käynnistä sitte normaalisti ja putsaa kone Cwshredderillä ja sen jälkeen uus Hijack logi tänne

      http://koti.mbnet.fi/pattaya1/cwshredder.htm

      Äänestä

    • Juu kirjoitti:

      Poista nämä Lisää/Poista paneelista jos ne siellä näkyy

      Windows SyncroAd
      WebRebates0
      P2P Networking
      Kazaa

      Jos on pakko käyttää Kazaa,niin asenna sitte Kazaa Lite ku kone on putsattu


      Hae tuolta APM

      http://www.diamondcs.com.au/index.php?page=apm


      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\sp.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
      O2 - BHO: (no name) - {864BACC1-3228-473A-BBAE-04BCC81B0CB0} - C:\WINDOWS\System32\hgnnmb.dll
      O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
      O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
      O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
      O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
      O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
      O16 - DPF: {00A10419-BBE8-0179-FB86-52013D7B7947} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0190C0D2-900B-495D-3F2F-319D586095CC} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {077E4F1A-1A59-1387-3C31-20592FA93D38} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {0C49B222-84A4-33EB-5E6E-52EF2115668D} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {18096220-B2AC-782B-0614-69CE12592DAF} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {1BE6D802-8986-19B8-6B0E-1A3A49563D98} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {33FB2C9F-6638-5A86-ABC9-11A76D21B62E} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {50A009B9-2F8F-683C-AF6D-52DD79D2AE0D} - http://69.50.188.54/1/gdnFI208.exe
      O18 - Filter: text/html - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll
      O18 - Filter: text/plain - {574224E6-A899-429B-8F28-37F4F39537B3} - C:\WINDOWS\System32\hgnnmb.dll


      Sitte avaa se APM ja yläikkunasta valitse
      C:/Windows/explorer.exe

      Alaikkunasta klikkaa tota jos se näkyy siellä ja valikosta Unload dll. ja ok

      C:\WINDOWS\System32\hgnnmb.dll
      Sulje se sitte


      Käynnistä sitte vikasietotilassa etsi ja poista jos löytyy

      hgnnmb.dll
      ewupdater.exe
      P2P Networking.exe

      C:\Program Files\Windows SyncroAd\SyncroAd.exe
      - tuolta pois Windows SyncroAd kansio

      C:\WINDOWS\System32\golumm\services.exe
      - tuolta pois golumm kansio

      C:\Program Files\Web_Rebates\WebRebates0.exe"
      - tuolta pois Web_Rebates kansio


      Käynnistä sitte normaalisti ja putsaa kone Cwshredderillä ja sen jälkeen uus Hijack logi tänne

      http://koti.mbnet.fi/pattaya1/cwshredder.htm

      Logfile of HijackThis v1.98.2
      Scan saved at 0:44:37, on 1.10.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\ewupdater.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
      C:\Program Files\hijack\hijackthis\HijackThis.exe
      C:\Program Files\Internet Explorer\iexplore.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise/products/housecall_pre.php (file missing)
      O16 - DPF: {51C1564B-457A-3997-0C69-34936C0C166F} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {72DF91F2-22C6-6861-3A38-4793420E7A5A} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {783454BA-3B79-7D36-E9AE-31685003016C} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {79B058E1-7C9C-5BCB-F9B8-7AD639941E85} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab

      Äänestä

    • mikko__ kirjoitti:

      Logfile of HijackThis v1.98.2
      Scan saved at 0:44:37, on 1.10.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\ewupdater.exe
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
      C:\Program Files\hijack\hijackthis\HijackThis.exe
      C:\Program Files\Internet Explorer\iexplore.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise/products/housecall_pre.php (file missing)
      O16 - DPF: {51C1564B-457A-3997-0C69-34936C0C166F} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {72DF91F2-22C6-6861-3A38-4793420E7A5A} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {783454BA-3B79-7D36-E9AE-31685003016C} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {79B058E1-7C9C-5BCB-F9B8-7AD639941E85} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab

      Näköjään sitä piilotiedostoo ei ollu mukana,hyvä niin.

      Sammuta tuo prosessi

      C:\WINDOWS\ewupdater.exe


      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise/products/housecall_pre.php (file missing)
      O16 - DPF: {51C1564B-457A-3997-0C69-34936C0C166F} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {72DF91F2-22C6-6861-3A38-4793420E7A5A} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {783454BA-3B79-7D36-E9AE-31685003016C} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {79B058E1-7C9C-5BCB-F9B8-7AD639941E85} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab


      Käynnistä sitte vikasietotilassa etsi ja poista jos löytyy

      ewupdater.exe



      Käynnistä sitte normaalisti ja pistä varalta vielä uus Hijack logi tänne.

      Missä antivirusohjelma ja palomuuri?

      Äänestä

    • Juu kirjoitti:

      Näköjään sitä piilotiedostoo ei ollu mukana,hyvä niin.

      Sammuta tuo prosessi

      C:\WINDOWS\ewupdater.exe


      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
      O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://uk.trendmicro-europe.com/enterprise/products/housecall_pre.php (file missing)
      O16 - DPF: {51C1564B-457A-3997-0C69-34936C0C166F} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {72DF91F2-22C6-6861-3A38-4793420E7A5A} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {783454BA-3B79-7D36-E9AE-31685003016C} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {79B058E1-7C9C-5BCB-F9B8-7AD639941E85} - http://69.50.188.54/1/gdnFI208.exe
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab


      Käynnistä sitte vikasietotilassa etsi ja poista jos löytyy

      ewupdater.exe



      Käynnistä sitte normaalisti ja pistä varalta vielä uus Hijack logi tänne.

      Missä antivirusohjelma ja palomuuri?

      Logfile of HijackThis v1.98.2
      Scan saved at 15:57:40, on 1.10.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\hijack\hijackthis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB



      miltäs nyt näyttää?? oisko ideoita virus ja palomuuriin??

      Äänestä

    • mikko__ kirjoitti:

      Logfile of HijackThis v1.98.2
      Scan saved at 15:57:40, on 1.10.2004
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\slserv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\hijack\hijackthis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
      O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
      O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\fi\msntb.dll
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file_downloads/common/housecall/HouseCallButton.CAB



      miltäs nyt näyttää?? oisko ideoita virus ja palomuuriin??

      Logi on kunnossa.

      >oisko ideoita virus ja palomuuriin?? <

      Kattele vaikka tuolta


      http://koti.mbnet.fi/pattaya1/muut_ilmaisohjelmat.htm

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    mikko__ kirjoitti:

    Logfile of HijackThis v1.98.2
    Scan saved at 18:18:20, on 30.9.2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\ewupdater.exe
    C:\WINDOWS\System32\P2P Networking\P2P Networking.exe
    C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\program files\altnet\points manager\points manager.exe
    C:\WINDOWS\System32\golumm\services.exe
    C:\Program Files\Windows SyncroAd\SyncroAd.exe
    C:\WINDOWS\System32\cwxeiu.exe
    C:\Program Files\Windows SyncroAd\WinSync.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Markus Louhela\Application Data\r???.exe
    C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
    C:\Program Files\Common Files\GMT\GMT.exe
    C:\Program Files\Common Files\CMEII\CMESys.exe
    C:\Documents and Settings\Markus Louhela\xexx.exe
    C:\Program Files\Internet Optimizer\optimize.exe
    C:\Program Files\Internet Optimizer\actalert.exe
    C:\Program Files\BullsEye Network\bin\bargains.exe
    C:\Documents and Settings\Markus Louhela\gam.exe
    C:\PROGRA~1\INTERN~1\iexplore.exe
    C:\temp\msbb.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\ISTsvc\istsvc.exe
    C:\Program Files\Web_Rebates\WebRebates1.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Web_Rebates\WebRebates0.exe
    C:\Program Files\hijack\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.easywebsearch.nl
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
    O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll
    O2 - BHO: MultimppObj Class - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\multimpp.dll
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
    O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\spy\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\Windows\2_0_1browserhelper2.dll
    O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem302.dll
    O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
    O2 - BHO: (no name) - {B0B32105-E13C-478F-ABED-17A01E289D7E} - C:\WINDOWS\System32\nnjde.dll
    O2 - BHO: BHO Class - {C77E900A-FF55-400E-9BAA-E042C8212898} - C:\Program Files\SimpelInternet\Easybar\ToolbarStarter.dll
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
    O3 - Toolbar: Easybar - {9AD55269-A21C-4260-BA7F-866FD09E8A8E} - C:\Program Files\SimpelInternet\Easybar\EasyBarShell.dll
    O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ewupdater] C:\WINDOWS\ewupdater.exe
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [KAZAA] C:\Program Files\kazaa\kazaa.exe /SYSTRAY
    O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
    O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
    O4 - HKLM\..\Run: [golumm] C:\WINDOWS\System32\golumm\services.exe
    O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\twink64.exe internat.dll,LoadKeyboardProfile
    O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
    O4 - HKLM\..\Run: [xvyeipq] C:\WINDOWS\System32\cwxeiu.exe
    O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
    O4 - HKLM\..\Run: [iryb] C:\WINDOWS\iryb.exe
    O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
    O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
    O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
    O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
    O4 - HKLM\..\Run: [msbb] c:\temp\msbb.exe
    O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
    O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
    O4 - HKLM\..\RunOnce: [djtopr1150.exe] "C:\DOCUME~1\MARKUS~1\LOCALS~1\Temp\djtopr1150.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Asoc] C:\Documents and Settings\Markus Louhela\Application Data\r???.exe
    O4 - HKCU\..\Run: [sysinit] C:\WINDOWS\System32\golumm\services.exe
    O4 - HKCU\..\RunOnce: [DeleteSlotchBar] rundll32.exe advpack.dll,DelNodeRunDLL32 "C:\Program Files\ISTbar\istbar.dll"
    O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
    O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
    O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: *.searchmiracle.com
    O15 - Trusted Zone: *.skoobidoo.com
    O15 - Trusted Zone: *.windupdates.com
    O16 - DPF: v2cab - http://11257.searchmiracle.com/cab/v2cab.cab
    O16 - DPF: {0224CCF2-1F48-6DCE-DFDF-46983D3CA245} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {07D9DEFB-69BF-442E-0861-31B11467C630} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=30579607f432361f4c24553de3a9fe7e27f55e8c7382e8f812488538178c09374cd3d1696277ab341d588a056fa84851d5e1f9fecd5da6e7490e:d3e35fce064ccfbb2d7510b28ebf1261
    O16 - DPF: {17D1634A-3C38-0F96-49B5-79E5168E0755} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
    O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares/v4.0/0006_regular.cab
    O16 - DPF: {3CD15CBE-B871-6E7D-B909-729B2D96B492} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {3F2705D0-C9D8-4020-A15C-E495A0050EC6} (Easywebinstaller Control) - http://s7.blingblingcontent.com/toolbarcash/activex/easywebinstaller.ocx
    O16 - DPF: {536A0561-1E40-7D00-D37F-1FDB5FDB5B55} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/2503e068cbfed368e005/netzip/RdxIE601.cab
    O16 - DPF: {5854BDBE-AF30-1FD3-8026-095B325536F2} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {68086D9F-B4ED-7242-994F-65760562E597} - http://69.50.188.54/1/gdnFI208.exe
    O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
    O18 - Filter: text/html - {F7302311-3078-436D-96E8-D02C2A2F7EF4} - C:\WINDOWS\System32\nnjde.dll
    O18 - Filter: text/plain - {F7302311-3078-436D-96E8-D02C2A2F7EF4} - C:\WINDOWS\System32\nnjde.dlln

    ongelma ei poistu millää..

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu