Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    miltä näyttää??

    miltäs vaikuttaa? epäilen, että poistettavaa löytyy ja paljon..

    Logfile of HijackThis v1.97.7
    Scan saved at 14:50:35, on 12.12.2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
    C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
    C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
    C:\COMPAQ\CPQINET\CPQInet.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Compaq\EAKDRV\EAUSBKBD.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\Program Files\Messenger Plus! 3\MsgPlus.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pbtfmeypaismbkmu.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpOAn32f9OkOz6g2WxmBkIS4.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Java Virtual Machine] javaw.exe
    O4 - HKLM\..\Run: [Win32 Wmls Driver] winitr32.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [THIRDABOUTHEARTCLOSE] C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
    O4 - HKLM\..\RunServices: [Java Virtual Machine] javaw.exe
    O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Win32 Wmls Driver] winitr32.exe
    O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    18762
    Äänestä

    Muut lukivat myös

    Vastaukset 18

    Vanhimmat

    • siis toi housecall pyytää asentamaan netscapelle tarkotetun ohjelman.. eikä mulla ole netscapea vaan mozilla. mitä teen?

      Äänestä

    • apua!! kirjoitti:

      siis toi housecall pyytää asentamaan netscapelle tarkotetun ohjelman.. eikä mulla ole netscapea vaan mozilla. mitä teen?

      Onko sulla IE:tä koneella,jos on niin mee sillä scannaan.

      Äänestä

    • Juu kirjoitti:

      Onko sulla IE:tä koneella,jos on niin mee sillä scannaan.

      onko tää oikea versio?

      Logfile of HijackThis v1.98.2
      Scan saved at 18:16:59, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lsjptvucazkagspkawcysx.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPCCvCtlwTuMag2WxmBkIS4.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKLM\..\Run: [THIRDABOUTHEARTCLOSE] C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      O4 - HKLM\..\RunServices: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Äänestä

    • apua!! kirjoitti:

      onko tää oikea versio?

      Logfile of HijackThis v1.98.2
      Scan saved at 18:16:59, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lsjptvucazkagspkawcysx.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPCCvCtlwTuMag2WxmBkIS4.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKLM\..\Run: [THIRDABOUTHEARTCLOSE] C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      O4 - HKLM\..\RunServices: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Pistä se HijackThis.exe omaan kansioon.

      Poista Lisää/Poista paneelista jos näkyy

      VBouncer

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lsjptvucazkagspkawcysx.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPCCvCtlwTuMag2WxmBkIS4
      O4 - HKLM\..\Run: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKLM\..\Run: [THIRDABOUTHEARTCLOSE] C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      O4 - HKLM\..\RunServices: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe


      Sitte etsi ja poista jos löytyy

      C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      - tuolta pois Mail Book Third About kansio

      C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      - tuolta pois NAMEEL~1 kansio

      C:\Program Files\VBouncer\VirtualBouncer.exe
      - tuolta pois VBouncer kansio


      Käynnistä sitte kone uudestaan ja uus Hijack logi.

      Äänestä

    • Juu kirjoitti:

      Pistä se HijackThis.exe omaan kansioon.

      Poista Lisää/Poista paneelista jos näkyy

      VBouncer

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina FIX checked

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lsjptvucazkagspkawcysx.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPCCvCtlwTuMag2WxmBkIS4
      O4 - HKLM\..\Run: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKLM\..\Run: [THIRDABOUTHEARTCLOSE] C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      O4 - HKLM\..\RunServices: [Java Virtual Machine] javaw.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe


      Sitte etsi ja poista jos löytyy

      C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      - tuolta pois Mail Book Third About kansio

      C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      - tuolta pois NAMEEL~1 kansio

      C:\Program Files\VBouncer\VirtualBouncer.exe
      - tuolta pois VBouncer kansio


      Käynnistä sitte kone uudestaan ja uus Hijack logi.

      no nii.. vieläkö löytyy poistettavaa?

      Logfile of HijackThis v1.98.2
      Scan saved at 20:04:35, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\WINDOWS\System32\wuauclt.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.voclwmyhupwygktftnl.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPYNo4H_Zql3qg2WxmBkIS4.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Äänestä

    • apua!! kirjoitti:

      no nii.. vieläkö löytyy poistettavaa?

      Logfile of HijackThis v1.98.2
      Scan saved at 20:04:35, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\WINDOWS\System32\wuauclt.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.voclwmyhupwygktftnl.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPYNo4H_Zql3qg2WxmBkIS4.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      etsi-toiminto ei löytänyt niitä tiedostoja, jotka piti poistaa..

      Äänestä

    • apua!! kirjoitti:

      no nii.. vieläkö löytyy poistettavaa?

      Logfile of HijackThis v1.98.2
      Scan saved at 20:04:35, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\WINDOWS\System32\wuauclt.exe
      c:\progra~1\intern~1\iexplore.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.voclwmyhupwygktftnl.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPYNo4H_Zql3qg2WxmBkIS4.html
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa ja FIX:saa nuo

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.voclwmyhupwygktftnl.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPYNo4H_Zql3qg2WxmBkIS4
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe


      Käynnistä sitte vikasietotilassa etsi ja poista

      winitr32.exe

      C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      - tuolta pois NAMEEL~1 kansio

      Käynnistä sitte normaalisti ja uus logi.

      Äänestä

    • Juu kirjoitti:

      Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa ja FIX:saa nuo

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.voclwmyhupwygktftnl.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPYNo4H_Zql3qg2WxmBkIS4
      O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
      O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe


      Käynnistä sitte vikasietotilassa etsi ja poista

      winitr32.exe

      C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      - tuolta pois NAMEEL~1 kansio

      Käynnistä sitte normaalisti ja uus logi.

      tunnen oloni äärimmäisen tyhmäksi mutta kuinka tämän saa vikasietotilaan?

      Äänestä

    • apua!! kirjoitti:

      tunnen oloni äärimmäisen tyhmäksi mutta kuinka tämän saa vikasietotilaan?

      Koneen käynnistymisvaiheessa painele F8:sia ja avautuvasta valikosta vikasietotila ja Enter.

      Äänestä

    • Juu kirjoitti:

      Koneen käynnistymisvaiheessa painele F8:sia ja avautuvasta valikosta vikasietotila ja Enter.

      löysin jopa lopulta sinne vikasietotilaan, mutta sieltäkään etsi-toiminto ei löytänyt noita tiedostoja, ei vaikka avasin ne piilotetut tiedostot..
      joka tapauksessa tässä ois tää uusin logi. se eka vaikuttaa kovasti samanlaiselta, ku ne aiemmat, jotka poistin..

      Logfile of HijackThis v1.98.2
      Scan saved at 21:11:01, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dqqnkqflgwpapuuplzbjncwg.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPHnC2Vype6aag2WxmBkIS4.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Äänestä

    • apua!! kirjoitti:

      löysin jopa lopulta sinne vikasietotilaan, mutta sieltäkään etsi-toiminto ei löytänyt noita tiedostoja, ei vaikka avasin ne piilotetut tiedostot..
      joka tapauksessa tässä ois tää uusin logi. se eka vaikuttaa kovasti samanlaiselta, ku ne aiemmat, jotka poistin..

      Logfile of HijackThis v1.98.2
      Scan saved at 21:11:01, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\WINDOWS\System32\wuauclt.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\WINDOWS\System32\msiexec.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dqqnkqflgwpapuuplzbjncwg.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPHnC2Vype6aag2WxmBkIS4.htm
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Merkkaa ja FIX:saa tuo

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dqqnkqflgwpapuuplzbjncwg.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpPHnC2Vype6aag2WxmBkIS4


      Sitte pitäs olla kunnossa

      Äänestä

    • apua!! kirjoitti:

      kiitän, kumarran ja niiaan!! :)

      ai nii.. tuo, minkä äsken poistin, ilmestyy uudestaan lähes samanlaisena joka kerta, ku scannaan. onko isokin ongelma?

      Kato jos noita kansioita löytyy ja poista ne

      C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      - tuolta pois Mail Book Third About kansio

      C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      - tuolta pois NAMEEL~1 kansio


      Älä käytä etsi toimintoa,vaan seuraa noita polkuja.

      Äänestä

    • Juu kirjoitti:

      Kato jos noita kansioita löytyy ja poista ne

      C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
      - tuolta pois Mail Book Third About kansio

      C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
      - tuolta pois NAMEEL~1 kansio


      Älä käytä etsi toimintoa,vaan seuraa noita polkuja.

      juu, nyt löytyi ja poissa ovat! suurensuuri kiitos avusta!!

      Äänestä

    • apua!! kirjoitti:

      juu, nyt löytyi ja poissa ovat! suurensuuri kiitos avusta!!

      >ai nii.. tuo, minkä äsken poistin, ilmestyy uudestaan lähes samanlaisena joka kerta, ku scannaan. onko isokin ongelma? <

      Merkkaa ja FIX:saa se vielä kerran,niin sitte sen ei pitäs tulla enää näkyviin.

      Äänestä

    • Juu kirjoitti:

      >ai nii.. tuo, minkä äsken poistin, ilmestyy uudestaan lähes samanlaisena joka kerta, ku scannaan. onko isokin ongelma? <

      Merkkaa ja FIX:saa se vielä kerran,niin sitte sen ei pitäs tulla enää näkyviin.

      nyt pitäs olla puhdas (jopa omaan silmään näyttää siltä :) )..

      Logfile of HijackThis v1.98.2
      Scan saved at 22:23:43, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Äänestä

    • apua!! kirjoitti:

      nyt pitäs olla puhdas (jopa omaan silmään näyttää siltä :) )..

      Logfile of HijackThis v1.98.2
      Scan saved at 22:23:43, on 12.12.2004
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
      C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
      C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
      C:\Program Files\F-Secure\Common\FSMA32.EXE
      C:\Program Files\F-Secure\Common\FSMB32.EXE
      C:\Program Files\F-Secure\Common\FCH32.EXE
      C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
      C:\Program Files\F-Secure\Common\FAMEH32.EXE
      C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
      C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      C:\COMPAQ\CPQINET\CPQInet.exe
      C:\Compaq\EAKDRV\EAUSBKBD.EXE
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\F-Secure\Common\FSM32.EXE
      C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\Program Files\MSN Messenger\msnmsgr.exe
      C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
      C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
      C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
      C:\Program Files\F-Secure\Common\FNRB32.EXE
      C:\Program Files\F-Secure\Common\FIH32.EXE
      C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
      C:\Program Files\HijackThis2\HijackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
      O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
      O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
      O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
      O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
      O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab

      Nyt on logi kunnossa ja vielä ku haet asennat kaikki tärkeät päivitykset koneeseen,niin Ok.

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    apua!! kirjoitti:

    miltäs vaikuttaa? epäilen, että poistettavaa löytyy ja paljon..

    Logfile of HijackThis v1.97.7
    Scan saved at 14:50:35, on 12.12.2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
    C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
    C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
    C:\COMPAQ\CPQINET\CPQInet.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Compaq\EAKDRV\EAUSBKBD.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\Program Files\Messenger Plus! 3\MsgPlus.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.pbtfmeypaismbkmu.com/wh7VlA9_gwH7iRPe/2nXms33MVacyp3mUH2ZVPZhzpOAn32f9OkOz6g2WxmBkIS4.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redirectors/presario/deskredir2.dll?s=consumer&ap=b201&c=3C01&lc=040b&ac
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3C01&lc=040b&s=search&ap=b204
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Java Virtual Machine] javaw.exe
    O4 - HKLM\..\Run: [Win32 Wmls Driver] winitr32.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [THIRDABOUTHEARTCLOSE] C:\Documents and Settings\All Users\Application Data\Mail Book Third About\Team Bird.exe
    O4 - HKLM\..\RunServices: [Java Virtual Machine] javaw.exe
    O4 - HKLM\..\RunServices: [Win32 Wmls Driver] winitr32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Win32 Wmls Driver] winitr32.exe
    O4 - HKCU\..\Run: [free bike] C:\DOCUME~1\Jaana\APPLIC~1\NAMEEL~1\dent bags close.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Works Kalenterin muistutukset.lnk = ?
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
    O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu