Netti pätkii ja suoritin käyttö on aina vähintään 55%, vaikka ennen n.4%. Onko logissa jotain ylimääräistä? Logfile of HijackThis v1.99.1 Scan saved at 1:18:36, on 8.12.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\WINDOWS\SOUNDMAN.EXE C:\ATI-CPanel\atiptaxx.exe D:\WINDOWS\system32\ctfmon.exe D:\Program Files\MSN Messenger\MsnMsgr.Exe D:\WINDOWS\system32\slserv.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe D:\WINDOWS\System32\snmp.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\ZoneLabs\vsmon.exe D:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe D:\Program Files\DC++\DCPlusPlus.exe D:\WINDOWS\system32\wuauclt.exe C:\Program Files\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://D:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://D:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://D:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://D:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://D:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - AutorunsDisabled - (no file) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com?fref=149133 (file missing) O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - D:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O10 - Broken Internet access because of LSP provider 'xfire_lsp_10650.dll' missing O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - D:\WINDOWS\system32\ZoneLabs\isafe.exe O23 - Service: SmartLinkService (SLService) - Smart Link - D:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe
Mikä prosessi vie noin paljon tehoja, oletko katsonut tehtävänhallinnasta? Fixaa[hjt,do a system scan, merkkaa, sulje selain ja paina fix cheked]: O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com?fref=149133 (file missing) Hae LSPFix -> http://cexx.org/LSPFix.exe ->Tallenna se vaikka työpöydälle tai johonkin hakemistoon. ->Avaa LSPFix ->Laita rasti ruutuun, "I know what I’m doing". ->Klikkaa vasemmassa ruudussa olevaa (saattaa ilmeisesti olla oikealla valmiiksi) "xfire_lsp_10650.dll" , siirrä se oikealla olevaan ruutuun nuolinäppäimellä, klikkaa "Remove" ja sulje LSPFix. Lataa eScan -> http://koti.mbnet.fi/pattaya1/escanmwav.htm Tee ohjeiden mukainen päivitys ja aja koko kone läpi. Lähetä lopuksi ne alapalkin tulokset tänne uuden Hjt loki kera.
Kiitos. Ei löytynyt viruksia, mutta jotain add/spywarea kylläkin. Sain suoritinkäytön laskemaan 55%--> 1% . ei tarvi enää kuuunnella tuulettimien melua kokoajan.
Laitatko sen eScanin lokin tänne? Koska eScan ei poista ad/spywarea, vaan ainoastaan huomauttaa niistä.
Jos et muistanut kopioida sitä tarkistuksen jälkeen niin mene -> C:\Kaspersky ja sieltä "mwXface" notepad jonka sisällön kopioi tänne.
[0x00000ccc] 08/12/2005 11:39:45:546 :[msvLclnt.dll]ModuleName = C:\Kaspersky\mwavscan.com [0x00000ccc] 08/12/2005 11:39:45:546 :[msvLclnt.dll]WARNING!!! "Autokey" Not Found [0x00000ccc] 08/12/2005 11:39:49:312 :[msvLclnt.dll]Options Set by External applications mwavscan.com are 9896960 (0x970400): [0x00000ccc] 08/12/2005 11:39:49:312 :[msvLclnt.dll]Mode ACKED,ARCHIVED,CA,WARNINGS,MAILPLAIN [0x00000ccc] 08/12/2005 11:39:49:312 :[msvLclnt.dll]TimeOut : ffffffff [0x00000ccc] 08/12/2005 11:39:49:312 :[msvLclnt.dll]Priority : NORMAL [0x00000ccc] 08/12/2005 11:39:49:812 :[msvLclnt.dll]VirusCount = 162735 Latest Date = 2005/12/02 [0x00000874] 08/12/2005 11:50:23:171 :[msvLclnt.dll]ModuleName = C:\Kaspersky\mwavscan.com [0x00000874] 08/12/2005 11:50:23:171 :[msvLclnt.dll]Registry Key Deleted Properly!!! [0x00000874] 08/12/2005 11:50:26:171 :[msvLclnt.dll]Options Set by External applications mwavscan.com are 9896960 (0x970400): [0x00000874] 08/12/2005 11:50:26:171 :[msvLclnt.dll]Mode ACKED,ARCHIVED,CA,WARNINGS,MAILPLAIN [0x00000874] 08/12/2005 11:50:26:171 :[msvLclnt.dll]TimeOut : ffffffff [0x00000874] 08/12/2005 11:50:26:171 :[msvLclnt.dll]Priority : NORMAL [0x00000874] 08/12/2005 11:50:26:609 :[msvLclnt.dll]VirusCount = 163892 Latest Date = 2005/12/08 [0x00000f54] 08/12/2005 11:59:48:640 :[msvLclnt.dll][00000001] File C:\Ohjelma paketit\unzipped\Ohjelmat\mirc asennus\mirc616.exe infected by not-a-virus:Client-IRC.Win32.mIRC.616 [0x00000f54] 08/12/2005 12:01:44:328 :[msvLclnt.dll][00000001] File C:\Program Files\DAEMON Tools\SetupDTSB.exe infected by not-a-virus:AdWare.Win32.SaveNow.bo [0x00000f54] 08/12/2005 12:13:02:781 :[msvLclnt.dll][00000001] File D:\Program Files\VVSN\VVSN.exe infected by not-a-virus:AdWare.Win32.SaveNow.bi [0x00000f54] 08/12/2005 12:22:09:703 :[msvLclnt.dll]VirusCount = 163892 Latest Date = 2005/12/08 [0x00000874] 08/12/2005 12:33:53:875 :[msvLclnt.dll]VirusCount = 163892 Latest Date = 2005/12/08
Näyttää kyllä aika puhtaalta. Nuo spywaret ja adwaret lähtevätkin halutessasi ewidolla -> http://keskustelu.afterdawn.com/thread_view.cfm/1/269186#1522334
