Ajattelin itsekkin laittaa hjt logini tarkastettavaksi, kun näyttää että monet tekevät niin Elikkä tässä se olisi: Logfile of HijackThis v1.99.1 Scan saved at 21:51:42, on 22.1.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Daemon\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\AVPersonal\AVGUARD.EXE C:\Program Files\AVPersonal\AVGNT.EXE C:\hjt\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1035 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O1 - Hosts: 217.17.85.12 L2testauthd.lineage2.com O1 - Hosts: 217.17.85.12 L2authd.lineage2.com O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - (no file) O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Daemon\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\RunOnce: [MessengerPlusUninstall] C:\WINDOWS\system32\cmd.exe /C "C:\DOCUME~1\Mika\LOCALS~1\Temp\MsgPlusUninst.bat" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Tallenna - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing) O9 - Extra 'Tools' menuitem: Tallenna lomakkeet &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing) O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing) O9 - Extra 'Tools' menuitem: RF Työkalupalkki &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O16 - DPF: {EABA57A8-B747-46F2-9E3F-CDCD4C6C6A33} - http://www.vapaatila.net/nokia/sense/vj/packages/metainstaller.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by19fd.bay19.hotmail.msn.com/activex/HMAtchmt.ocx O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Puhtaalta näyttää mun silmissä kun nopeesti katoin, mutta eiköhän tohon joku noista paremmista ilmottele olenko oikeassa.
Fixaa nämä: R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank O1 - Hosts: 217.17.85.12 L2testauthd.lineage2.com O1 - Hosts: 217.17.85.12 L2authd.lineage2.com Sinulla näyttäisi olevan Ewido, joten päivitä se, ja käynnistä sen jälkeen vikasietotilaan ja skannaa siellä ( F8 käynnistyksen yhteydessä ) Tallenna Ewidon raportti, ja lähetä se, sekä uusi HjT-loki.
spertti: mikä vika noissa on? -Ihan vaan uteliaisuuttani kysäsen että oppii ite vähän paremmin kattelemaan noita.
@W8M No tuo about:blank on aina pahis. Eli tuo on luotu rekisteriarvo, joka on aina pahis. Lisää tietoa tuolla > http://www.virustorjunta.net/modules.php?name=Forums&file=viewtopic&t=2519 Tosin tuo ei välttämättä lähde Ewidolla, jolloin keksitään jotain muuta =). Nuo IP:t 01 rivillä johtavat Liettuaan, joka on aina huolestuttavaa. Lisää tietoa > http://www.dnsstuff.com/tools/whois.ch?ip=217.17.85.12&server=whois.radb.net
@blade81 Sama kävi äsken itsellänikin mielessä =) Tuo vain, että se johtaa Liettuaan teki siitä pelottavan... Noh nuo nyt saa takaisin, jos ne eivät ongelmaa aiheuttaneet.
Ainakin IE:ssä kun laittaa "kotisivun" tyhjäksi, siitä tulee "about:blank" ja sen ei ainakaan pitäisi olla pahis.
Se ei ole pahis se mutta siksi siittä on olemassa erilaisia kaappariversioita. Yleensä about:blank kaapparin tunnistaa näistä muista riveistä kuten 01-04. Tuossa yksi versio vaikkapa: http://koti.mbnet.fi/pattaya1/aboutbuster.htm Mutta odotellaan uutta Hjt lokia ja ewidon raporttia...
--------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 17:19:22, 24.1.2006 + Report-Checksum: 9098283 + Scan result: HKLM\SOFTWARE\Altnet -> Spyware.Altnet : Error during cleaning HKLM\SOFTWARE\Altnet\Dashboard -> Spyware.Altnet : Error during cleaning HKLM\SOFTWARE\Altnet\Dashboard\Messages -> Spyware.Altnet : Error during cleaning HKLM\SOFTWARE\Altnet\Dashboard\Settings -> Spyware.Altnet : Error during cleaning HKLM\SOFTWARE\Classes\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C} -> Spyware.Gator : Error during cleaning :mozilla.20:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.21:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.22:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.30:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.31:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.52:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.53:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.54:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.55:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.56:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.57:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.58:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.59:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.60:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.62:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.63:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Adbrite : Cleaned with backup :mozilla.68:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.80:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.81:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.84:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.87:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.88:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.89:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.105:C:\Documents and Settings\Mika\Application Data\Mozilla\Firefox\Profiles\pb50vgp1.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup C:\Documents and Settings\Mika\Cookies\mika@tradedoubler[1].txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup :mozilla.7:C:\Documents and Settings\Mika Heinonen\Application Data\Mozilla\Firefox\Profiles\m6uwfbul.Miksu28\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.8:C:\Documents and Settings\Mika Heinonen\Application Data\Mozilla\Firefox\Profiles\m6uwfbul.Miksu28\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.23:C:\Documents and Settings\Mika Heinonen\Application Data\Mozilla\Firefox\Profiles\m6uwfbul.Miksu28\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.30:C:\Documents and Settings\Yleinen\Application Data\Mozilla\Firefox\Profiles\emw7nqc0.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup :mozilla.31:C:\Documents and Settings\Yleinen\Application Data\Mozilla\Firefox\Profiles\emw7nqc0.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup ::Report End Ja hjt: Logfile of HijackThis v1.99.1 Scan saved at 17:23:43, on 24.1.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Daemon\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\AVPersonal\AVGNT.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AVPersonal\AVGUARD.EXE C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\system32\wuauclt.exe C:\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1035 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - (no file) O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Daemon\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Tallenna - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing) O9 - Extra 'Tools' menuitem: Tallenna lomakkeet &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing) O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing) O9 - Extra 'Tools' menuitem: RF Työkalupalkki &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O16 - DPF: {EABA57A8-B747-46F2-9E3F-CDCD4C6C6A33} - http://www.vapaatila.net/nokia/sense/vj/packages/metainstaller.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by19fd.bay19.hotmail.msn.com/activex/HMAtchmt.ocx O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
Ajoitko ewidon vikasietotilassa? Fixaa: O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - (no file)
Uusi hjt logi: Logfile of HijackThis v1.99.1 Scan saved at 20:28:06, on 25.1.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Daemon\daemon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\AVPersonal\AVGNT.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AVPersonal\AVGUARD.EXE C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1035 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Daemon\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Tallenna - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing) O9 - Extra 'Tools' menuitem: Tallenna lomakkeet &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html (file missing) O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing) O9 - Extra 'Tools' menuitem: RF Työkalupalkki &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html (file missing) O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://www.bitdefender.com/scan8/oscan8.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} - http://messenger.zone.msn.com/binary/Chess.cab31267.cab O16 - DPF: {EABA57A8-B747-46F2-9E3F-CDCD4C6C6A33} - http://www.vapaatila.net/nokia/sense/vj/packages/metainstaller.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} - http://by19fd.bay19.hotmail.msn.com/activex/HMAtchmt.ocx O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe Ja kyllä tuo aikasempi ewidon logi oli ajettu vikasieto tilassa.
Loki on ok, mutta nuo vanhat alt.netin ja Gatorin jämät jäi kiusaamaan tuossa Ewidon lokissa... Kokeilepa CCleanerilla korjata rekisteri. Aja ne muutkin puhdistukset sillä. http://www.filehippo.com/download/e9b4dd0b974788db2d13344d8411cdca/download/
