Hjt logi tarkastettavaksi.

Discussion in 'Virukset ja haittaohjelmat' started by maukka81, Dec 16, 2005.

  1. maukka81

    maukka81 Member

    Joined:
    Nov 14, 2005
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Kone on välillä vähän hidas, ajattelin tarkistuttaa Hjt:n.

    Logfile of HijackThis v1.99.1
    Scan saved at 15:43:30, on 15.12.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Hjt\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1131278972577
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
    O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe
     
    maukka81, Dec 16, 2005
    #1
  2. Disa-

    Disa- Regular member

    Joined:
    Sep 6, 2005
    Messages:
    860
    Likes Received:
    0
    Trophy Points:
    26
    Puhdas on.
     
    Disa-, Dec 16, 2005
    #2
  3. maukka81

    maukka81 Member

    Joined:
    Nov 14, 2005
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Ok. No hyvä sitten. rupesin escan:lla ajamaan ja jotain pöpöjä näyttää tulevan mut ei sitten onneksi ole mitään vakavampaa.
    Kiitoksia...
     
    maukka81, Dec 16, 2005
    #3
  4. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tuon voit fixata:

    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

    Ja laita ne eScanin tulokset tänne näkyviin(siitä Virus Log Information-laatikosta.
     
    -kemisti-, Dec 16, 2005
    #4
  5. maukka81

    maukka81 Member

    Joined:
    Nov 14, 2005
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Nyt kävi semmoinen juttu et hitaus taitaa johtua muusta kuin viruksista. kone tuntuu lämpenevän kovasti kun tekee jotain enemmän koneella. Kävin hakemassa semmosen kuin speedfan:in ja se ilmoittaa lämpötilaksi temp1= 42 ja temp2= 58 astetta tällä hetkellä ja enemmän vaan lämpenee jos rupeaa vaik esim. jotain ohjelmaa käyttämään. Virtalähteen jo vaihdoin kun pimahti. mistäköhän se vika vois johtua?...
     
    maukka81, Dec 17, 2005
    #5
  6. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Pölyt otettu pois prossutuulettimen ym. läheltä?
     
    -kemisti-, Dec 17, 2005
    #6
  7. maukka81

    maukka81 Member

    Joined:
    Nov 14, 2005
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Juu pyyhin pölyt, pistin myös kyselyjä tuonne " Pc rautaan liittyvä keskustelu" alueeseen. Täytyy vielä tarkistaa et onko prosessorin tuuletin ja siili kunnolla kiinni...
     
    maukka81, Dec 17, 2005
    #7
  8. maukka81

    maukka81 Member

    Joined:
    Nov 14, 2005
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Tässä olis vielä tuo esan Logi tarkastettavaksi. Ei enään kone sammuile, auttoi kun vaihdoin virtalähteen ja pyyhin suurrimmat pölyt pois prossun tuulettimesta...

    Fri Dec 16 23:00:37 2005 => Checking for Winupie Virus...
    Fri Dec 16 23:00:37 2005 => Checking for Swen Virus...
    Fri Dec 16 23:00:37 2005 => Checking for JS.Fortnight Virus...
    Fri Dec 16 23:00:37 2005 => Checking for Novarg Virus...
    Fri Dec 16 23:00:37 2005 => Checking for Pagabot Virus...
    Fri Dec 16 23:00:37 2005 => Checking for Parite.b Virus...
    Fri Dec 16 23:00:37 2005 => Checking for Parite.a Virus...

    Fri Dec 16 23:00:37 2005 => ***** Scanning complete. *****
    Fri Dec 16 23:00:37 2005 => Total Number of Files Scanned: 99822
    Fri Dec 16 23:00:37 2005 => Total Number of Virus(es) Found: 4
    Fri Dec 16 23:00:37 2005 => Total Number of Disinfected Files: 0
    Fri Dec 16 23:00:37 2005 => Total Number of Files Renamed: 0
    Fri Dec 16 23:00:37 2005 => Total Number of Deleted Files: 0
    Fri Dec 16 23:00:37 2005 => Total Number of Errors: 4
    Fri Dec 16 23:00:37 2005 => Time Elapsed: 01:46:43
    Fri Dec 16 23:00:37 2005 => Virus Database Date: 2005/12/16
    Fri Dec 16 23:00:37 2005 => Virus Database Count: 165540

    Fri Dec 16 23:00:37 2005 => Scan Completed

    File C:\Documents and Settings\Virpi Liimatta\Local Settings\Temp\180sainstallersilsais.exe tagged as not-a-virus:AdWare.Win32.180Solutions.g. No Action Taken.
    File C:\Documents and Settings\Virpi Liimatta\Local Settings\Temp\res72.tmp tagged as not-a-virus:AdWare.Win32.180Solutions.g. No Action Taken.
    File C:\WINDOWS\Downloaded Program Files\ClientAX.dll tagged as not-a-virus:AdWare.Win32.180Solutions.g. No Action Taken.
    File D:\FOUND.003\FILE0004.CHK tagged as not-a-virus:AdWare.Win32.Gator.c. No Action Taken.
     
    maukka81, Dec 17, 2005
    #8
  9. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tyhjennä tuo hakemisto(siis poista tiedostot, älä hakemistoa):

    C:\Documents and Settings\Virpi Liimatta\Local Settings\Temp\

    ja poista tämä:

    C:\WINDOWS\Downloaded Program Files\==>ClientAX.dll<==
     
    -kemisti-, Dec 17, 2005
    #9
  10. maukka81

    maukka81 Member

    Joined:
    Nov 14, 2005
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Ok. tyhjennetty on...
     
    maukka81, Dec 18, 2005
    #10

Share This Page