Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    kone täynnä kakkaa!

    Logfile of HijackThis v1.99.1
    Scan saved at 16:43:05, on 17.8.2005
    Platform: Windows 2000 (WinNT 5.00.2195)
    MSIE: Internet Explorer v5.00 (5.00.2920.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\csrss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINNT\Explorer.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\WINNT\System32\spooIsv.exe
    C:\WINNT\System32\msupdate32.exe
    C:\WINNT\System32\winamp.exe
    C:\winnt\system32\elitewgl32.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINNT\System32\internat.exe
    C:\WINNT\System32\RUNDLL32.EXE
    C:\WINNT\System32\cmmon.pif
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINNT\etb\pokapoka63.exe
    C:\Program Files\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mtv3.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINNT\System32\spooIsv.exe
    O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe
    O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
    O4 - HKLM\..\Run: [Winamp Agent] C:\WINNT\System32\winamp.exe
    O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\elitewgl32.exe
    O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
    O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe
    O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
    O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
    O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
    O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
    151450
    Äänestä

    Muut lukivat myös

    Vastaukset 15

    Vanhimmat

    • ed as not-a-virus:AdWare.ToolBar.EliteBar.ap. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\131316_772_988_1100_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\131688_892_1144_1872_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\327896_756_936_940_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\65682_836_760_1200_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\65684_804_760_1112_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\65740_936_868_1188_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\WINNT\EliteToolBar\EliteToolBar version 60.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.af. No Action Taken.
      File C:\WINNT\etb\nt_hide63.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\WINNT\etb\pokapoka63.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.ap. No Action Taken.
      File C:\WINNT\etb\xud_63.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.ap. No Action Taken.
      File C:\WINNT\system32\bleh.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: File Renamed.
      File C:\WINNT\system32\internat.exe infected by "Trojan-Dropper.Win32.Paradrop.a" Virus. Action Taken: File Deleted.
      File C:\WINNT\system32\lssas.exe infected by "Trojan-Dropper.Win32.Paradrop.a" Virus. Action Taken: File Deleted.
      File C:\WINNT\system32\rundll32.exe infected by "Trojan-Dropper.Win32.Paradrop.a" Virus. Action Taken: File Deleted.
      File C:\WINNT\system32\scvhost.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: File Renamed.

      Äänestä

    • mummo kirjoitti:

      ed as not-a-virus:AdWare.ToolBar.EliteBar.ap. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\131316_772_988_1100_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\131688_892_1144_1872_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\327896_756_936_940_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\65682_836_760_1200_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\65684_804_760_1112_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\Documents and Settings\Järjestelmänvalvoja\Local Settings\Temp\65740_936_868_1188_63.41.tmp1 tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\WINNT\EliteToolBar\EliteToolBar version 60.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.af. No Action Taken.
      File C:\WINNT\etb\nt_hide63.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.am. No Action Taken.
      File C:\WINNT\etb\pokapoka63.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.ap. No Action Taken.
      File C:\WINNT\etb\xud_63.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.ap. No Action Taken.
      File C:\WINNT\system32\bleh.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: File Renamed.
      File C:\WINNT\system32\internat.exe infected by "Trojan-Dropper.Win32.Paradrop.a" Virus. Action Taken: File Deleted.
      File C:\WINNT\system32\lssas.exe infected by "Trojan-Dropper.Win32.Paradrop.a" Virus. Action Taken: File Deleted.
      File C:\WINNT\system32\rundll32.exe infected by "Trojan-Dropper.Win32.Paradrop.a" Virus. Action Taken: File Deleted.
      File C:\WINNT\system32\scvhost.exe infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: File Renamed.

      tässä hijacklogi kanssa..

      Logfile of HijackThis v1.99.1
      Scan saved at 18:26:01, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\Explorer.exe
      C:\Kaspersky\mwavscan.com
      C:\Kaspersky\kavss.exe
      C:\WINNT\System32\TRed.pif
      C:\WINNT\system32\svchost.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      Äänestä

    • mummo kirjoitti:

      tässä hijacklogi kanssa..

      Logfile of HijackThis v1.99.1
      Scan saved at 18:26:01, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\WINNT\Explorer.exe
      C:\Kaspersky\mwavscan.com
      C:\Kaspersky\kavss.exe
      C:\WINNT\System32\TRed.pif
      C:\WINNT\system32\svchost.exe
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      C:\Program Files\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      logi otettu vikasietotilassa,jos niin pistä uus logi joka on otettu normaalitilassa.
      Scannaa myös tuo tuolla ja ilmoita tulos

      C:\WINNT\System32\TRed.pif

      http://virusscan.jotti.org/

      Äänestä

    • Juu kirjoitti:

      logi otettu vikasietotilassa,jos niin pistä uus logi joka on otettu normaalitilassa.
      Scannaa myös tuo tuolla ja ilmoita tulos

      C:\WINNT\System32\TRed.pif

      http://virusscan.jotti.org/

      Logfile of HijackThis v1.99.1
      Scan saved at 18:41:51, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\WINNT\System32\svchost.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINNT\etb\pokapoka63.exe
      C:\WINNT\system32\TRed.pif
      C:\WINNT\System32\csrs.exe
      C:\WINNT\system32\cmmon.pif
      C:\Program Files\HijackThis.exe
      C:\WINNT\System32\cmmon.pif
      C:\WINNT\System32\TRed.pif

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      Äänestä

    • mummo kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 18:41:51, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\WINNT\System32\svchost.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINNT\etb\pokapoka63.exe
      C:\WINNT\system32\TRed.pif
      C:\WINNT\System32\csrs.exe
      C:\WINNT\system32\cmmon.pif
      C:\Program Files\HijackThis.exe
      C:\WINNT\System32\cmmon.pif
      C:\WINNT\System32\TRed.pif

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      AntiVir Found nothing
      ArcaVir Found nothing
      Avast Found nothing
      AVG Antivirus Found nothing
      BitDefender Found nothing
      ClamAV Found nothing
      Dr.Web Found nothing
      F-Prot Antivirus Found nothing
      Fortinet Found nothing
      Kaspersky Anti-Virus Found nothing
      NOD32 Found nothing
      Norman Virus Control Found nothing
      UNA Found nothing
      VBA32 Found nothing

      Äänestä

    • mummo kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 18:41:51, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\WINNT\System32\svchost.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINNT\etb\pokapoka63.exe
      C:\WINNT\system32\TRed.pif
      C:\WINNT\System32\csrs.exe
      C:\WINNT\system32\cmmon.pif
      C:\Program Files\HijackThis.exe
      C:\WINNT\System32\cmmon.pif
      C:\WINNT\System32\TRed.pif

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      Scannaa nuo molemmat yksitellen

      C:\WINNT\system32\TRed.pif
      C:\WINNT\System32\cmmon.pif

      tuolla ja ilmoita tulos

      http://virusscan.jotti.org/

      Äänestä

    • Juu kirjoitti:

      Scannaa nuo molemmat yksitellen

      C:\WINNT\system32\TRed.pif
      C:\WINNT\System32\cmmon.pif

      tuolla ja ilmoita tulos

      http://virusscan.jotti.org/

      Dr.Web Found Win32.HLLW.MyBot
      F-Prot Antivirus Found W32/Sdbot.IKU

      Äänestä

    • mummo kirjoitti:

      Dr.Web Found Win32.HLLW.MyBot
      F-Prot Antivirus Found W32/Sdbot.IKU

      C:\WINNT\system32\TRed.pif

      Äänestä

    • mummo kirjoitti:

      C:\WINNT\system32\TRed.pif

      Joo ootas pikkasen mää vastaan kohta.

      Äänestä

    • mummo kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 18:41:51, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\WINNT\System32\svchost.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\WINNT\etb\pokapoka63.exe
      C:\WINNT\system32\TRed.pif
      C:\WINNT\System32\csrs.exe
      C:\WINNT\system32\cmmon.pif
      C:\Program Files\HijackThis.exe
      C:\WINNT\System32\cmmon.pif
      C:\WINNT\System32\TRed.pif

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif


      Käynnistä sitte vikasietotilassa ja poista

      C:\WINNT\System32\csrs.exe
      C:\WINNT\System32\cmmon.pif

      C:\WINNT\etb\ < kansio
      C:\WINNT\EliteToolBar\ < kansio

      Sitte tyhjennä roskis
      Sitte poista tuo

      C:\WINNT\System32\TRed.pif

      Anna sen sitte olla roskissa typ 2 päivää ja jos kaikki toimii normaalisti niin sitte vasta poista se sieltä roskista.
      Tyhjennä myös kaikki Tempit

      Äänestä

    • Juu kirjoitti:

      Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif


      Käynnistä sitte vikasietotilassa ja poista

      C:\WINNT\System32\csrs.exe
      C:\WINNT\System32\cmmon.pif

      C:\WINNT\etb\ < kansio
      C:\WINNT\EliteToolBar\ < kansio

      Sitte tyhjennä roskis
      Sitte poista tuo

      C:\WINNT\System32\TRed.pif

      Anna sen sitte olla roskissa typ 2 päivää ja jos kaikki toimii normaalisti niin sitte vasta poista se sieltä roskista.
      Tyhjennä myös kaikki Tempit

      Logfile of HijackThis v1.99.1
      Scan saved at 19:33:18, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\WINNT\System32\svchost.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\Program Files\HijackThis.exe
      C:\WINNT\System32\TRed.pif

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124294299175
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      Äänestä

    • Juu kirjoitti:

      Piilotiedostot näkyviin,ohje tuolla

      http://www.xtra.co.nz/help/0,,4155-1916458,00.html

      Merkkaa nuo sulje selain ja muut avoimet ikkunat ja paina Fix checked

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
      O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [Configuration Loader] scvhost.exe
      O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINNT\System32\lssas.exe
      O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINNT\System32\csrs.exe
      O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\RunServices: [Configuration Loader] scvhost.exe
      O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
      O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif


      Käynnistä sitte vikasietotilassa ja poista

      C:\WINNT\System32\csrs.exe
      C:\WINNT\System32\cmmon.pif

      C:\WINNT\etb\ < kansio
      C:\WINNT\EliteToolBar\ < kansio

      Sitte tyhjennä roskis
      Sitte poista tuo

      C:\WINNT\System32\TRed.pif

      Anna sen sitte olla roskissa typ 2 päivää ja jos kaikki toimii normaalisti niin sitte vasta poista se sieltä roskista.
      Tyhjennä myös kaikki Tempit

      lataa myös tämä bottien poisto-ohjelma

      ftp://ftp.europe.f-secure.com/anti-virus/tools/f-bot.exe

      ja ohjeet

      ftp://ftp.europe.f-secure.com/anti-virus/tools/f-bot.txt

      sekä scannaa koneesi ohjeiden mukaan. Tämä kaiken varalta !!!

      Kyseinen ohjelma on päivitetty viimeksi tänään 17.8.2005

      Äänestä

    • mummo kirjoitti:

      Logfile of HijackThis v1.99.1
      Scan saved at 19:33:18, on 17.8.2005
      Platform: Windows 2000 (WinNT 5.00.2195)
      MSIE: Internet Explorer v5.00 (5.00.2920.0000)

      Running processes:
      C:\WINNT\System32\smss.exe
      C:\WINNT\system32\winlogon.exe
      C:\WINNT\system32\services.exe
      C:\WINNT\system32\lsass.exe
      C:\WINNT\system32\svchost.exe
      C:\WINNT\system32\spoolsv.exe
      C:\WINNT\System32\svchost.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      C:\WINNT\System32\nvsvc32.exe
      C:\WINNT\system32\regsvc.exe
      C:\WINNT\system32\MSTask.exe
      C:\WINNT\System32\WBEM\WinMgmt.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\WINNT\Explorer.exe
      C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
      C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
      C:\Program Files\HijackThis.exe
      C:\WINNT\System32\TRed.pif

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
      F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
      O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
      O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKCU\..\Run: [internat.exe] internat.exe
      O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
      O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
      O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
      O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124294299175
      O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
      O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
      O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

      Merkkaa ja Fix:saa

      R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
      O4 - HKLM\..\Run: [Micr0s0ftf DDEs C0ntr0l] TRed.pif
      O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
      O4 - HKLM\..\RunServices: [Micr0s0ftf DDEs C0ntr0l] TRed.pif

      Sitte poista vikasietotilassa

      C:\WINNT\System32\TRed.pif

      ja anna sen sitte olla siellä roskissa jonku aikaa niinku jo aikasemmin kerroin.

      Äänestä

    • mkk kirjoitti:

      lataa myös tämä bottien poisto-ohjelma

      ftp://ftp.europe.f-secure.com/anti-virus/tools/f-bot.exe

      ja ohjeet

      ftp://ftp.europe.f-secure.com/anti-virus/tools/f-bot.txt

      sekä scannaa koneesi ohjeiden mukaan. Tämä kaiken varalta !!!

      Kyseinen ohjelma on päivitetty viimeksi tänään 17.8.2005

      kiitoksia.. olin kyläreisussa kaverilla ja sielä oli asennettu Win2k mutta unohtunut!! palomuurin asennus.. siitä tämä sotku.. nyt on kunnossa. Kiitos!

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    mummo kirjoitti:

    Logfile of HijackThis v1.99.1
    Scan saved at 16:43:05, on 17.8.2005
    Platform: Windows 2000 (WinNT 5.00.2195)
    MSIE: Internet Explorer v5.00 (5.00.2920.0000)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\csrss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINNT\Explorer.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
    C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\WINNT\System32\spooIsv.exe
    C:\WINNT\System32\msupdate32.exe
    C:\WINNT\System32\winamp.exe
    C:\winnt\system32\elitewgl32.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINNT\System32\internat.exe
    C:\WINNT\System32\RUNDLL32.EXE
    C:\WINNT\System32\cmmon.pif
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINNT\etb\pokapoka63.exe
    C:\Program Files\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search345quest.com/sp2.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search345quest.com/sp2.php
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search345quest.com/sp2.php
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mtv3.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.fi
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    F2 - REG:system.ini: UserInit=C:\WINNT\System32\Userinit.exe
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINNT\System32\spooIsv.exe
    O4 - HKLM\..\Run: [microsft Updates] msupdate32.exe
    O4 - HKLM\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
    O4 - HKLM\..\Run: [Winamp Agent] C:\WINNT\System32\winamp.exe
    O4 - HKLM\..\Run: [checkrun] C:\winnt\system32\elitewgl32.exe
    O4 - HKLM\..\Run: [System service63] C:\WINNT\etb\pokapoka63.exe
    O4 - HKLM\..\RunServices: [microsft Updates] msupdate32.exe
    O4 - HKLM\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
    O4 - HKCU\..\Run: [internat.exe] internat.exe
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [Microsoft Connection Manager Monitor] cmmon.pif
    O4 - HKCU\..\RunServices: [Microsoft Connection Manager Monitor] cmmon.pif
    O14 - IERESET.INF: START_PAGE_URL=http://www.msn.fi
    O14 - IERESET.INF: MS_START_PAGE_URL=http://www.msn.fi
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15014/CTPID.cab
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu