Hei
Koneeni näyttää että suoritinkäyttö on 100% ja hyvin vähän alla.
Mistä tämä voi johtua että kovalevy kirjoittaa vähän väliä.
Alla logi tiedosto, onko kaikki ok?
Jos ei ole niin mitenkä HijackThis ohjelma ni kohdat poistetaan, vai mitenkä nyt edeten?
Kiitoksia vaivannäkijöille, itse en tajua mitään.
Logfile of HijackThis v1.99.1
Scan saved at 17:33:41, on 29.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
E:\CloneCD\CloneCDTray.exe
E:\QuickTime\qttask.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
E:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
E:\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\Nokia\Nokia PC Suite 6\PcSync2.exe
E:\AnyDVD\AnyDVD.exe
E:\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
E:\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
E:\common\Bin\WinCinemaMgr.exe
E:\Logitech\SetPoint\SetPoint.exe
E:\F-Secure\Anti-Virus\fsgk32st.exe
E:\F-Secure\Common\FSMA32.EXE
E:\F-Secure\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\System32\svchost.exe
E:\F-Secure\Common\FSMB32.EXE
E:\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
E:\F-Secure\Common\FCH32.EXE
E:\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
E:\F-Secure\Anti-Virus\fssm32.exe
E:\F-Secure\Common\FAMEH32.EXE
E:\F-Secure\Anti-Virus\fsqh.exe
E:\F-Secure\FSAUA\program\fsaua.exe
E:\F-Secure\FSPC\fspc.exe
E:\F-Secure\FWES\Program\fsdfwd.exe
E:\F-Secure\Anti-Virus\fsav32.exe
E:\F-Secure\FSGUI\fsguidll.exe
D:\eMule\emule.exe
E:\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Hannu\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://plaza.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "E:\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "E:\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "E:\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "E:\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] E:\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AnyDVD] E:\AnyDVD\AnyDVD.exe
O4 - Startup: Yahoo! Widget Engine.lnk = E:\Konfabulator\YahooWidgetEngine.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - E:\F-Secure\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - E:\F-Secure\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - E:\F-Secure\FSPC\fspcmsie.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\F-Secure\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Koneeni näyttää että suoritinkäyttö on 100% ja hyvin vähän alla.
Mistä tämä voi johtua että kovalevy kirjoittaa vähän väliä.
Alla logi tiedosto, onko kaikki ok?
Jos ei ole niin mitenkä HijackThis ohjelma ni kohdat poistetaan, vai mitenkä nyt edeten?
Kiitoksia vaivannäkijöille, itse en tajua mitään.
Logfile of HijackThis v1.99.1
Scan saved at 17:33:41, on 29.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
E:\CloneCD\CloneCDTray.exe
E:\QuickTime\qttask.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
E:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
E:\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\Nokia\Nokia PC Suite 6\PcSync2.exe
E:\AnyDVD\AnyDVD.exe
E:\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
E:\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
E:\common\Bin\WinCinemaMgr.exe
E:\Logitech\SetPoint\SetPoint.exe
E:\F-Secure\Anti-Virus\fsgk32st.exe
E:\F-Secure\Common\FSMA32.EXE
E:\F-Secure\Anti-Virus\FSGK32.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\System32\svchost.exe
E:\F-Secure\Common\FSMB32.EXE
E:\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
E:\F-Secure\Common\FCH32.EXE
E:\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
E:\F-Secure\Anti-Virus\fssm32.exe
E:\F-Secure\Common\FAMEH32.EXE
E:\F-Secure\Anti-Virus\fsqh.exe
E:\F-Secure\FSAUA\program\fsaua.exe
E:\F-Secure\FSPC\fspc.exe
E:\F-Secure\FWES\Program\fsdfwd.exe
E:\F-Secure\Anti-Virus\fsav32.exe
E:\F-Secure\FSGUI\fsguidll.exe
D:\eMule\emule.exe
E:\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Hannu\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://plaza.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "E:\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "E:\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "E:\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "E:\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] E:\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AnyDVD] E:\AnyDVD\AnyDVD.exe
O4 - Startup: Yahoo! Widget Engine.lnk = E:\Konfabulator\YahooWidgetEngine.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - E:\F-Secure\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - E:\F-Secure\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - E:\F-Secure\FSPC\fspcmsie.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\F-Secure\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Vastaukset 4
Vanhimmat
Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
Siihen laatikkoon tuli tämmöinen:
File C:\Documents and Settings\Hannu\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-110b179d-78bd342f.zip infected by "Trojan.Java.Binny.a" Virus. Action Taken: File Deleted.
Mitäs sitten nyt pitäs tehdä?
Kiitos jo etukäteen vaivannäöstäsi.
Poista Yahoo Toolbar ainakin. Tyhjennä Ohjauspaneelin kautta Javan cache. Kaikki tempit kans mielellään pois.
Kiitos tiedoista, tarviiko tehdä enää muuta?