Hjt logi tarkastettavaksi.

Kone on välillä vähän hidas, ajattelin tarkistuttaa Hjt:n.

Logfile of HijackThis v1.99.1
Scan saved at 15:43:30, on 15.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Hjt\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1131278972577
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: F-Secure Automatic Update (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe

 

Puhdas on.

 

Ok. No hyvä sitten. rupesin escan:lla ajamaan ja jotain pöpöjä näyttää tulevan mut ei sitten onneksi ole mitään vakavampaa.
Kiitoksia...

 

Tuon voit fixata:

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

Ja laita ne eScanin tulokset tänne näkyviin(siitä Virus Log Information-laatikosta.

 

Nyt kävi semmoinen juttu et hitaus taitaa johtua muusta kuin viruksista. kone tuntuu lämpenevän kovasti kun tekee jotain enemmän koneella. Kävin hakemassa semmosen kuin speedfan:in ja se ilmoittaa lämpötilaksi temp1= 42 ja temp2= 58 astetta tällä hetkellä ja enemmän vaan lämpenee jos rupeaa vaik esim. jotain ohjelmaa käyttämään. Virtalähteen jo vaihdoin kun pimahti. mistäköhän se vika vois johtua?...

 

Pölyt otettu pois prossutuulettimen ym. läheltä?

 

Juu pyyhin pölyt, pistin myös kyselyjä tuonne " Pc rautaan liittyvä keskustelu" alueeseen. Täytyy vielä tarkistaa et onko prosessorin tuuletin ja siili kunnolla kiinni...

 

Tässä olis vielä tuo esan Logi tarkastettavaksi. Ei enään kone sammuile, auttoi kun vaihdoin virtalähteen ja pyyhin suurrimmat pölyt pois prossun tuulettimesta...

Fri Dec 16 23:00:37 2005 => Checking for Winupie Virus...
Fri Dec 16 23:00:37 2005 => Checking for Swen Virus...
Fri Dec 16 23:00:37 2005 => Checking for JS.Fortnight Virus...
Fri Dec 16 23:00:37 2005 => Checking for Novarg Virus...
Fri Dec 16 23:00:37 2005 => Checking for Pagabot Virus...
Fri Dec 16 23:00:37 2005 => Checking for Parite.b Virus...
Fri Dec 16 23:00:37 2005 => Checking for Parite.a Virus...

Fri Dec 16 23:00:37 2005 => ***** Scanning complete. *****
Fri Dec 16 23:00:37 2005 => Total Number of Files Scanned: 99822
Fri Dec 16 23:00:37 2005 => Total Number of Virus(es) Found: 4
Fri Dec 16 23:00:37 2005 => Total Number of Disinfected Files: 0
Fri Dec 16 23:00:37 2005 => Total Number of Files Renamed: 0
Fri Dec 16 23:00:37 2005 => Total Number of Deleted Files: 0
Fri Dec 16 23:00:37 2005 => Total Number of Errors: 4
Fri Dec 16 23:00:37 2005 => Time Elapsed: 01:46:43
Fri Dec 16 23:00:37 2005 => Virus Database Date: 2005/12/16
Fri Dec 16 23:00:37 2005 => Virus Database Count: 165540

Fri Dec 16 23:00:37 2005 => Scan Completed

File C:\Documents and Settings\Virpi Liimatta\Local Settings\Temp\180sainstallersilsais.exe tagged as not-a-virus:AdWare.Win32.180Solutions.g. No Action Taken.
File C:\Documents and Settings\Virpi Liimatta\Local Settings\Temp\res72.tmp tagged as not-a-virus:AdWare.Win32.180Solutions.g. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\ClientAX.dll tagged as not-a-virus:AdWare.Win32.180Solutions.g. No Action Taken.
File D:\FOUND.003\FILE0004.CHK tagged as not-a-virus:AdWare.Win32.Gator.c. No Action Taken.

 

Tyhjennä tuo hakemisto(siis poista tiedostot, älä hakemistoa):

C:\Documents and Settings\Virpi Liimatta\Local Settings\Temp\

ja poista tämä:

C:\WINDOWS\Downloaded Program Files\==>ClientAX.dll<==

 

Ok. tyhjennetty on...