Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    W32/Nsag.B

    elikkä otsikon mukaista virusta pukkaa koko ajan, antivirus sen kyllä löytää mutta ei näköjään saa poistettua sitä. kotisivukin on kaapattu eikä kone anna vaihtaa sitä internetasetuksista. kone ajettu läpi CWchedderillä, spybotilla ja adawarella mutta homma jatkuu entisellään.... kertokaa viisaammat ohjeita että koneeen sais taas kunnolla pelittään... ohessa Hithisjack logi
    Logfile of HijackThis v1.99.0
    Scan saved at 22:41:53, on 10.9.2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\netdde.exe
    C:\Program Files\AVPersonal\AVGUARD.EXE
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\imapi.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\tlntsvr.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Error Nuker\bin\ErrorNuker.exe
    C:\Program Files\AVPersonal\AVGNT.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\vssvc.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\WINDOWS\System32\dmadmin.exe
    C:\WINDOWS\System32\LogFiles\A7272100.so
    C:\WINDOWS\system32\ZONELABS\vsmon.exe
    C:\WINDOWS\System32\msole32.exe
    C:\WINDOWS\System32\ole32vbs.exe
    C:\WINDOWS\popuper.exe
    C:\WINDOWS\System32\shnlog.exe
    C:\WINDOWS\System32\intmonp.exe
    C:\WINDOWS\System32\intmon.exe
    C:\Backup\HijackThis1.99.0.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.security2k.net/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.security2k.net/search.php?qq=%1
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.security2k.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.security2k.net/
    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
    O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpD367.tmp
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
    O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
    O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O23 - Service: AntiVir Service - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
    O23 - Service: AntiVir Update - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
    O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Telnet - Unknown - C:\WINDOWS\System32\tlntsvr.exe
    O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
    O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
    151745
    Äänestä

    Muut lukivat myös

    Vastaukset 15

    Vanhimmat

    C:\HJT\HijackThis.exe
    ja tee scannaus juuri sieltä.

    nätisti omaan kansioon

    Äänestä

    • älä välitä tollasista vaatimuksista
      voit pistää mihin kansioon tahansa ja ajaa sieltä

      Äänestä

    • mikä tahansa kirjoitti:

      älä välitä tollasista vaatimuksista
      voit pistää mihin kansioon tahansa ja ajaa sieltä

      se on ohje ja sillä siisti

      Äänestä

    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    mees windows updateen ja päivitä koneesi

    Äänestä

    fiksaa tämä se on virus
    O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
    Nasty Added as a result of an unidentified VIRUS!. This iexplore.exe file is located eleswhere rather than in the default Program Files\Internet Explorer folder
    Hit rate: 80 % (result)
    Must be fixed

    Äänestä

    • On todennäköisesti virhetulkinta, kuten noi nettianalysaatorit joskus tekevät. Suosittelen tuon rivin jättämistä.

      Äänestä

    gurut tuli ja epäluotettavat testit.

    Äänestä

    Joo se on smitfraudi,Koitetaan tällä ohjeella:

    Päivitä hijacki, niin kuin "mutta" jo neuvoi linkin kanssa.

    Päivitä Ad-aware, älä scannaa sillä vielä.

    Ota tosta smitRem.exe ja tallenna se työpöydälle

    http://noahdfear.geekstogo.com/click%20counter/click.ph p?id=1

    Tuplaklikkaa sitä ja sitten klikkaa Start jollon smitRem kansio ilmestyy työpöydälle

    Ota tosta Ewido

    http://www.ewido.net/en/download/

    Asenna ja päivitä se

    Käynnistä kone vikasietotilassa.

    Scannaa Hijackillä ja ruksaa nuo

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.security2k.net/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.security2k.net/search.php?qq=%1
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.security2k.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.security2k.net/
    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
    O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpD367.tmp


    Sitten avaa smitRem kansio ja tuplaklikkaa RunThis.bat
    Vastaile myöntävästi ja anna sen rauhassa scannata kone.

    Sitten putsaa Ad-Awarella

    Sen jälkeen putsaa Ewidolla

    Käynnistä sitte normaalisti ja scannaa kone Pandan on-line scannerilla.

    http://www.pandasoftware.com/activescan/

    Pandan jälkeen lähetä uusi Hijack logi, smitfiles.txt logi ja Ewidon logi.
    Smitfiles.txt. löytynee tuolta C:\smitfiles.txt.

    Äänestä

    • smitrem scannaus ei onnistunut mutta muut kyllä
      ei näytä auttavan....
      ---------------------------------------------------------
      ewido security suite - Scan report
      ---------------------------------------------------------

      + Created on:         14:43:01, 11.9.2005
      + Report-Checksum:      F9503015

      + Scan result:

         HKLM\SOFTWARE\Classes\CLSID\{0ECEBD98-802F-9B4D-7308-C983A18EDBEC} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{151272FB-2CD4-E387-93B1-F52B2911D0EE} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{1DE20533-9118-BF9A-A6C6-F8E881A5FD4B} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{2D7C78D3-F49A-8BD3-9A98-41F319D802B2} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{2FB10B1F-E342-08A1-CBAA-D4A2CD2ABAC6} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{3B9E0A95-3EBA-124F-52D1-033C73734625} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{497AEAF3-0F8F-A4B6-48F2-A80144D90604} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4AEDA6FC-6816-F03C-12F8-CDE056451F16} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4C96C433-2EDC-3926-B873-410DB1199685} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4F8E9FA5-37E2-683E-E18D-19AC6697532D} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4FCD2C21-6232-FD0F-36AA-4EFFC9284B2A} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{59935BC1-5F4B-96F1-F3B6-C6B36821D102} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{5BCC3EE7-9153-E89F-6D4E-9B02B02B4E2E} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{679695BC-A811-4A9D-8CDF-BA8C795F261A} -> Spyware.Yellowpages : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{7A8EC00B-7964-C396-E2F8-621F6C9029FA} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{8E883EC3-ABB5-0CD9-EC0A-78CB81A818D1} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9A711817-CADB-FD03-EBB1-4E2FC70601C2} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9B9D4A7D-1232-E364-432D-B58ECFAE5AF4} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9C149FC6-86A5-C649-4760-9E20AC138BED} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A1BD0D9E-655B-CB60-6F75-1DFC720AEAB9} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A8703447-9782-72D3-AA41-606A7E155CE5} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A97B64CA-35C4-DD86-2890-054EE94CE844} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{BCA234F8-DBE0-1CBE-CE94-63240442E405} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{C0E27572-BE10-BE39-5F1B-F26255B8F141} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{D4451521-F203-568E-2657-C5AD1F0B1F77} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{EA8D7DFA-04BF-99E7-595C-535DC7F0EFBA} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{F1B10CDC-1975-EC0C-C522-2571525E92CF} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{F704A16D-BA8A-0DD4-CB9E-F0FA4A957D8D} -> Spyware.CoolWebSearch : Cleaned with backup
         C:\WINDOWS\system32\ntfsnlpa.exe -> Spyware.Msnagent : Cleaned with backup
         C:\WINDOWS\system32\cscut.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\WINDOWS\system32\shnlog.exe_tobedeleted -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\WINDOWS\Downloaded Program Files\CONFLICT.5\058439fi.exe -> Heuristic.Win32.Dialer : Cleaned with backup
         C:\WINDOWS\hceklt.dat -> TrojanDropper.Small.tn : Cleaned with backup
         C:\WINDOWS\givknz.dat -> TrojanDropper.Small.tn : Cleaned with backup
         C:\WINDOWS\dviyge.dat -> TrojanDownloader.Agent.pe : Cleaned with backup
         C:\WINDOWS\fwxwfu.dat -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\yiqnck.dat -> TrojanDownloader.Agent.lz : Cleaned with backup
         C:\WINDOWS\fytubl.dat -> TrojanDownloader.Agent.pe : Cleaned with backup
         C:\WINDOWS\obotda.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\wgrwfu.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\fqmzxu.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\dxvnyf.dat -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\jflvnq.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\n_ggfsiv.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\SDKTJ32.DLL.VIR -> TrojanDownloader.Agent.bc : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\25.tmp -> TrojanDownloader.WinShow.ay : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\1.qtdfmp -> TrojanDropper.Small.wp : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\5.qtdfmp -> TrojanDownloader.Small.awa : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx1.game -> TrojanDropper.Small.wv : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx2.game -> Trojan.Crypt.c : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\maxdd.game -> Dialer.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx4.game -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx6.game -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Cookies\teuvo@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
         C:\Documents and Settings\Teuvo\Cookies\teuvo@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\ntddetect.VIR -> TrojanProxy.Agent.eh : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\d3op.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\winrd32.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\appuq32.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP107\A0040360.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP108\A0040371.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0040405.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0040415.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0041413.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP111\A0041428.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP112\A0041447.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041457.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041471.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041488.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041507.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0042505.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042520.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042540.exe -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042559.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0043557.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044559.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044574.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044589.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP109\A0040383.exe -> TrojanDropper.Vidro.u : Cleaned with backup


      ::Report End
      sitten toinen logi
      Logfile of HijackThis v1.99.1
      Scan saved at 16:22:47, on 11.9.2005
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\netdde.exe
      C:\Program Files\AVPersonal\AVGUARD.EXE
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\Program Files\ewido\security suite\ewidoctrl.exe
      C:\Program Files\ewido\security suite\ewidoguard.exe
      C:\WINDOWS\System32\imapi.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\tlntsvr.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\vssvc.exe
      C:\WINDOWS\System32\wbem\wmiapsrv.exe
      C:\WINDOWS\System32\dmadmin.exe
      C:\WINDOWS\System32\msole32.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Error Nuker\bin\ErrorNuker.exe
      C:\Program Files\AVPersonal\AVGNT.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\ZONELABS\vsmon.exe
      C:\Backup\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.security2k.net/bar.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.security2k.net/search.php?qq=%1
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.security2k.net/search.php?qq=%1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.security2k.net/
      F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
      O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
      O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

      Äänestä

    • ansku kirjoitti:

      smitrem scannaus ei onnistunut mutta muut kyllä
      ei näytä auttavan....
      ---------------------------------------------------------
      ewido security suite - Scan report
      ---------------------------------------------------------

      + Created on:         14:43:01, 11.9.2005
      + Report-Checksum:      F9503015

      + Scan result:

         HKLM\SOFTWARE\Classes\CLSID\{0ECEBD98-802F-9B4D-7308-C983A18EDBEC} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{151272FB-2CD4-E387-93B1-F52B2911D0EE} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{1DE20533-9118-BF9A-A6C6-F8E881A5FD4B} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{2D7C78D3-F49A-8BD3-9A98-41F319D802B2} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{2FB10B1F-E342-08A1-CBAA-D4A2CD2ABAC6} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{3B9E0A95-3EBA-124F-52D1-033C73734625} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{497AEAF3-0F8F-A4B6-48F2-A80144D90604} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4AEDA6FC-6816-F03C-12F8-CDE056451F16} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4C96C433-2EDC-3926-B873-410DB1199685} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4F8E9FA5-37E2-683E-E18D-19AC6697532D} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4FCD2C21-6232-FD0F-36AA-4EFFC9284B2A} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{59935BC1-5F4B-96F1-F3B6-C6B36821D102} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{5BCC3EE7-9153-E89F-6D4E-9B02B02B4E2E} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{679695BC-A811-4A9D-8CDF-BA8C795F261A} -> Spyware.Yellowpages : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{7A8EC00B-7964-C396-E2F8-621F6C9029FA} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{8E883EC3-ABB5-0CD9-EC0A-78CB81A818D1} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9A711817-CADB-FD03-EBB1-4E2FC70601C2} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9B9D4A7D-1232-E364-432D-B58ECFAE5AF4} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9C149FC6-86A5-C649-4760-9E20AC138BED} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A1BD0D9E-655B-CB60-6F75-1DFC720AEAB9} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A8703447-9782-72D3-AA41-606A7E155CE5} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A97B64CA-35C4-DD86-2890-054EE94CE844} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{BCA234F8-DBE0-1CBE-CE94-63240442E405} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{C0E27572-BE10-BE39-5F1B-F26255B8F141} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{D4451521-F203-568E-2657-C5AD1F0B1F77} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{EA8D7DFA-04BF-99E7-595C-535DC7F0EFBA} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{F1B10CDC-1975-EC0C-C522-2571525E92CF} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{F704A16D-BA8A-0DD4-CB9E-F0FA4A957D8D} -> Spyware.CoolWebSearch : Cleaned with backup
         C:\WINDOWS\system32\ntfsnlpa.exe -> Spyware.Msnagent : Cleaned with backup
         C:\WINDOWS\system32\cscut.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\WINDOWS\system32\shnlog.exe_tobedeleted -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\WINDOWS\Downloaded Program Files\CONFLICT.5\058439fi.exe -> Heuristic.Win32.Dialer : Cleaned with backup
         C:\WINDOWS\hceklt.dat -> TrojanDropper.Small.tn : Cleaned with backup
         C:\WINDOWS\givknz.dat -> TrojanDropper.Small.tn : Cleaned with backup
         C:\WINDOWS\dviyge.dat -> TrojanDownloader.Agent.pe : Cleaned with backup
         C:\WINDOWS\fwxwfu.dat -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\yiqnck.dat -> TrojanDownloader.Agent.lz : Cleaned with backup
         C:\WINDOWS\fytubl.dat -> TrojanDownloader.Agent.pe : Cleaned with backup
         C:\WINDOWS\obotda.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\wgrwfu.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\fqmzxu.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\dxvnyf.dat -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\jflvnq.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\n_ggfsiv.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\SDKTJ32.DLL.VIR -> TrojanDownloader.Agent.bc : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\25.tmp -> TrojanDownloader.WinShow.ay : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\1.qtdfmp -> TrojanDropper.Small.wp : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\5.qtdfmp -> TrojanDownloader.Small.awa : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx1.game -> TrojanDropper.Small.wv : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx2.game -> Trojan.Crypt.c : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\maxdd.game -> Dialer.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx4.game -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx6.game -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Cookies\teuvo@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
         C:\Documents and Settings\Teuvo\Cookies\teuvo@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\ntddetect.VIR -> TrojanProxy.Agent.eh : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\d3op.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\winrd32.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\appuq32.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP107\A0040360.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP108\A0040371.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0040405.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0040415.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0041413.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP111\A0041428.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP112\A0041447.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041457.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041471.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041488.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041507.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0042505.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042520.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042540.exe -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042559.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0043557.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044559.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044574.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044589.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP109\A0040383.exe -> TrojanDropper.Vidro.u : Cleaned with backup


      ::Report End
      sitten toinen logi
      Logfile of HijackThis v1.99.1
      Scan saved at 16:22:47, on 11.9.2005
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\netdde.exe
      C:\Program Files\AVPersonal\AVGUARD.EXE
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\Program Files\ewido\security suite\ewidoctrl.exe
      C:\Program Files\ewido\security suite\ewidoguard.exe
      C:\WINDOWS\System32\imapi.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\tlntsvr.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\vssvc.exe
      C:\WINDOWS\System32\wbem\wmiapsrv.exe
      C:\WINDOWS\System32\dmadmin.exe
      C:\WINDOWS\System32\msole32.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Error Nuker\bin\ErrorNuker.exe
      C:\Program Files\AVPersonal\AVGNT.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\ZONELABS\vsmon.exe
      C:\Backup\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.security2k.net/bar.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.security2k.net/search.php?qq=%1
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.security2k.net/search.php?qq=%1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.security2k.net/
      F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
      O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
      O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

      Löytikö Panda mitään?

      Äänestä

    • juggis kirjoitti:

      Löytikö Panda mitään?

      koska active scan on muuttanut
      uusi linkki
      http://www.pandasoftware.com/products/activescan
      kyllä se smithfraudi on, koita juggis vielä kerran tota smitrem fiksiä

      jos ei muuten onnaa niin killbox

      toi msole32 ainakin vielä pyörii

      Äänestä

    • illukka kirjoitti:

      koska active scan on muuttanut
      uusi linkki
      http://www.pandasoftware.com/products/activescan
      kyllä se smithfraudi on, koita juggis vielä kerran tota smitrem fiksiä

      jos ei muuten onnaa niin killbox

      toi msole32 ainakin vielä pyörii

      Kiitti vinkistä ton pandan onlinescannerin muuttuneesta osoitteesta. Täytyy korjata linkki.

      Killboxi täs on ollut jo mielessä.

      Äänestä

    • ansku kirjoitti:

      smitrem scannaus ei onnistunut mutta muut kyllä
      ei näytä auttavan....
      ---------------------------------------------------------
      ewido security suite - Scan report
      ---------------------------------------------------------

      + Created on:         14:43:01, 11.9.2005
      + Report-Checksum:      F9503015

      + Scan result:

         HKLM\SOFTWARE\Classes\CLSID\{0ECEBD98-802F-9B4D-7308-C983A18EDBEC} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{151272FB-2CD4-E387-93B1-F52B2911D0EE} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{1DE20533-9118-BF9A-A6C6-F8E881A5FD4B} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{2D7C78D3-F49A-8BD3-9A98-41F319D802B2} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{2FB10B1F-E342-08A1-CBAA-D4A2CD2ABAC6} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{3B9E0A95-3EBA-124F-52D1-033C73734625} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{497AEAF3-0F8F-A4B6-48F2-A80144D90604} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4AEDA6FC-6816-F03C-12F8-CDE056451F16} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4C96C433-2EDC-3926-B873-410DB1199685} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4F8E9FA5-37E2-683E-E18D-19AC6697532D} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{4FCD2C21-6232-FD0F-36AA-4EFFC9284B2A} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{59935BC1-5F4B-96F1-F3B6-C6B36821D102} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{5BCC3EE7-9153-E89F-6D4E-9B02B02B4E2E} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{679695BC-A811-4A9D-8CDF-BA8C795F261A} -> Spyware.Yellowpages : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{7A8EC00B-7964-C396-E2F8-621F6C9029FA} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{8E883EC3-ABB5-0CD9-EC0A-78CB81A818D1} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9A711817-CADB-FD03-EBB1-4E2FC70601C2} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9B9D4A7D-1232-E364-432D-B58ECFAE5AF4} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{9C149FC6-86A5-C649-4760-9E20AC138BED} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A1BD0D9E-655B-CB60-6F75-1DFC720AEAB9} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A8703447-9782-72D3-AA41-606A7E155CE5} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{A97B64CA-35C4-DD86-2890-054EE94CE844} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{BCA234F8-DBE0-1CBE-CE94-63240442E405} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{C0E27572-BE10-BE39-5F1B-F26255B8F141} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{D4451521-F203-568E-2657-C5AD1F0B1F77} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{EA8D7DFA-04BF-99E7-595C-535DC7F0EFBA} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{F1B10CDC-1975-EC0C-C522-2571525E92CF} -> Spyware.CoolWebSearch : Cleaned with backup
         HKLM\SOFTWARE\Classes\CLSID\{F704A16D-BA8A-0DD4-CB9E-F0FA4A957D8D} -> Spyware.CoolWebSearch : Cleaned with backup
         C:\WINDOWS\system32\ntfsnlpa.exe -> Spyware.Msnagent : Cleaned with backup
         C:\WINDOWS\system32\cscut.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\WINDOWS\system32\shnlog.exe_tobedeleted -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\WINDOWS\Downloaded Program Files\CONFLICT.5\058439fi.exe -> Heuristic.Win32.Dialer : Cleaned with backup
         C:\WINDOWS\hceklt.dat -> TrojanDropper.Small.tn : Cleaned with backup
         C:\WINDOWS\givknz.dat -> TrojanDropper.Small.tn : Cleaned with backup
         C:\WINDOWS\dviyge.dat -> TrojanDownloader.Agent.pe : Cleaned with backup
         C:\WINDOWS\fwxwfu.dat -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\yiqnck.dat -> TrojanDownloader.Agent.lz : Cleaned with backup
         C:\WINDOWS\fytubl.dat -> TrojanDownloader.Agent.pe : Cleaned with backup
         C:\WINDOWS\obotda.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\wgrwfu.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\fqmzxu.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\dxvnyf.dat -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\jflvnq.log -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\n_ggfsiv.txt -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\WINDOWS\SDKTJ32.DLL.VIR -> TrojanDownloader.Agent.bc : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\25.tmp -> TrojanDownloader.WinShow.ay : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\1.qtdfmp -> TrojanDropper.Small.wp : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\5.qtdfmp -> TrojanDownloader.Small.awa : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx1.game -> TrojanDropper.Small.wv : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx2.game -> Trojan.Crypt.c : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\maxdd.game -> Dialer.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx4.game -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Local Settings\Temp\vx6.game -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\Documents and Settings\Teuvo\Cookies\teuvo@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
         C:\Documents and Settings\Teuvo\Cookies\teuvo@findwhat[1].txt -> Spyware.Cookie.Findwhat : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\ntddetect.VIR -> TrojanProxy.Agent.eh : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\d3op.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\winrd32.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\Program Files\AVPersonal\INFECTED\appuq32.VIR -> TrojanDownloader.Agent.bq : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP107\A0040360.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP108\A0040371.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0040405.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0040415.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP110\A0041413.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP111\A0041428.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP112\A0041447.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041457.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041471.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041488.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0041507.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP113\A0042505.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042520.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042540.exe -> Spyware.Hijacker.Generic : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0042559.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0043557.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044559.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044574.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP114\A0044589.exe -> TrojanDropper.Vidro.u : Cleaned with backup
         C:\System Volume Information\_restore{CE12B79C-4640-4326-AFED-03DA78D8B501}\RP109\A0040383.exe -> TrojanDropper.Vidro.u : Cleaned with backup


      ::Report End
      sitten toinen logi
      Logfile of HijackThis v1.99.1
      Scan saved at 16:22:47, on 11.9.2005
      Platform: Windows XP (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 (6.00.2600.0000)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\netdde.exe
      C:\Program Files\AVPersonal\AVGUARD.EXE
      C:\Program Files\AVPersonal\AVWUPSRV.EXE
      C:\Program Files\ewido\security suite\ewidoctrl.exe
      C:\Program Files\ewido\security suite\ewidoguard.exe
      C:\WINDOWS\System32\imapi.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\tlntsvr.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\System32\vssvc.exe
      C:\WINDOWS\System32\wbem\wmiapsrv.exe
      C:\WINDOWS\System32\dmadmin.exe
      C:\WINDOWS\System32\msole32.exe
      C:\Program Files\QuickTime\qttask.exe
      C:\Program Files\Error Nuker\bin\ErrorNuker.exe
      C:\Program Files\AVPersonal\AVGNT.EXE
      C:\Program Files\Messenger\msmsgs.exe
      C:\WINDOWS\system32\ZONELABS\vsmon.exe
      C:\Backup\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.security2k.net/bar.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.security2k.net/search.php?qq=%1
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.security2k.net/search.php?qq=%1
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.security2k.net/
      F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
      O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
      O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
      O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
      O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
      O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
      O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
      O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
      O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

      Pandan osoite oli muuttunut.
      http://www.pandasoftware.com/products/activescan

      Koita tuo eka ohjeeni uusiksi. Jos ei smitrem scannaus onnistu, niin lopeta siihen ja ilmoita.
      koiteetaan toista konstia.

      Äänestä

    • juggis kirjoitti:

      Pandan osoite oli muuttunut.
      http://www.pandasoftware.com/products/activescan

      Koita tuo eka ohjeeni uusiksi. Jos ei smitrem scannaus onnistu, niin lopeta siihen ja ilmoita.
      koiteetaan toista konstia.

      kone alkoi noiden temppujen jälkeen itsekseen sammuilla käynnistettäessä. nyt ajoin xp:n korjauksen läpi koneelle. pelittää taas mutta
      kotisivua ei anna määrittää mitähän vois sen eteen tehdä...?!

      Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    ansku kirjoitti:

    elikkä otsikon mukaista virusta pukkaa koko ajan, antivirus sen kyllä löytää mutta ei näköjään saa poistettua sitä. kotisivukin on kaapattu eikä kone anna vaihtaa sitä internetasetuksista. kone ajettu läpi CWchedderillä, spybotilla ja adawarella mutta homma jatkuu entisellään.... kertokaa viisaammat ohjeita että koneeen sais taas kunnolla pelittään... ohessa Hithisjack logi
    Logfile of HijackThis v1.99.0
    Scan saved at 22:41:53, on 10.9.2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\netdde.exe
    C:\Program Files\AVPersonal\AVGUARD.EXE
    C:\Program Files\AVPersonal\AVWUPSRV.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\imapi.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\tlntsvr.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Error Nuker\bin\ErrorNuker.exe
    C:\Program Files\AVPersonal\AVGNT.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\vssvc.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\WINDOWS\System32\dmadmin.exe
    C:\WINDOWS\System32\LogFiles\A7272100.so
    C:\WINDOWS\system32\ZONELABS\vsmon.exe
    C:\WINDOWS\System32\msole32.exe
    C:\WINDOWS\System32\ole32vbs.exe
    C:\WINDOWS\popuper.exe
    C:\WINDOWS\System32\shnlog.exe
    C:\WINDOWS\System32\intmonp.exe
    C:\WINDOWS\System32\intmon.exe
    C:\Backup\HijackThis1.99.0.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.security2k.net/bar.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.security2k.net/search.php?qq=%1
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.security2k.net/search.php?qq=%1
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.security2k.net/search.php?qq=%1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.security2k.net/
    F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
    O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hpD367.tmp
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
    O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
    O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O23 - Service: AntiVir Service - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
    O23 - Service: AntiVir Update - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu - Unknown - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Tapahtumaloki - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu - Unknown - C:\WINDOWS\System32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
    O23 - Service: Verkon DDE - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Verkon DDE DSDM - Unknown - C:\WINDOWS\system32\netdde.exe
    O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta - Unknown - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti-apuohjelma - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Älykortti - Unknown - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Resurssilokit ja -hälytykset - Unknown - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Telnet - Unknown - C:\WINDOWS\System32\tlntsvr.exe
    O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
    O23 - Service: Aseman tilannevedos - Unknown - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu