C:\WINDOWS\jlwncct.exe
C:\Programmi\ISTsvc\istsvc.exe
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programmi\NewDotNet\newdotnet6_90.dll
O4 - HKLM\..\Run: [Microsoft Windows Updater] windates.exe
O4 - HKLM\..\Run: [3m3ef9oE] C:\WINDOWS\jlwncct.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [Á³# *K"h'þ9Óœ÷3rÅWC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\jlwncct.exe
O4 - HKLM\..\Run: [IST Service] C:\Programmi\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Á³# *s"h'þ9ÓœÏ3rÅ(WC:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\jlwncct.exe
O4 - HKLM\..\Run: [Á³# *s"h'þ9ÓœÏNb‰»9C:\Programmi\ISTsvc\istsvc.exe] C:\WINDOWS\jlwncct.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Updater] windates.exe
O4 - HKCU\..\Run: [Microsoft Windows Updater] windates.exe
O10 - Hijacked Internet access by New.Net
disabilita il ripristino di sistema e poi in modalità provvisoria fixa quei voci.
gli exe è meglio che cancelli manualmente
ma arrivi sempre prima
