Har virus, Hjelp!

henape · 20. august 2011

Ser følgende programmer på Oppgavebehandling:

nvvsvc.exe

winlogon.ege

csrss.exe

prosessane går selfølgelig ikke ann å avtryte, hvordan fjerner jeg det fra min pc??

På forhond takk for gode svar.

Munty · 20. august 2011

Last ned Malware Bytes og scan. Om det ikke løser problemet, start maskinen i "Safe mode" og scan med Malware og Antivirus.

henape · 20. august 2011

skal bli, takk

Faller · 20. august 2011

Hva bruker du som antivirus-program?

Mvh Faller

henape · 20. august 2011

Bruker AVG og har hatt ett ad-awere programm som e sletta for noken daga sia, for e trur de laga meir trøbbel enn det fiksa noke.

Logg fra ditta programme, fann en del...

Malwarebytes' Anti-Malware 1.51.1.1800

www.malwarebytes.org

Databaseversjon: 7520

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19120

20.08.2011 20:36:42

mbam-log-2011-08-20 (20-36-42).txt

Skanntype: Hurtigsøk

Objekter skannet: 185757

Tid tilbakelagt: 32 minutt(er), 23 sekund(er)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 45

Registerverdier infisert: 3

Registerfiler infisert: 0

Mapper infisert: 4

Filer infisert 14

Minneprosesser infisert:

(Ingen skadelige objekter funnet)

Minnemoduler infisert:

(Ingen skadelige objekter funnet)

Registernøkler infisert:

HKEY_CLASSES_ROOT\CLSID\{5C00A371-2011-4AF3-97C8-6CE66AA744CB} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Dealio.DealioSearch.1 (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Dealio.DealioSearch (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{4C1E5902-FE99-4591-8582-2A2605462857} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{03C390E8-B836-4B82-8D56-1BFDDC06AE8A} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6A87B991-A31F-4130-AE72-6D0C294BF082} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Dealio.DealioBHO.1 (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Dealio.DealioBHO (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6A87B991-A31F-4130-AE72-6D0C294BF082} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{6A87B991-A31F-4130-AE72-6D0C294BF082} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6A87B991-A31F-4130-AE72-6D0C294BF082} (PUP.Dealio.TB) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{2F9AD413-2E0B-4a85-BB2A-CF961238262A} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{69725738-CD68-4f36-8D02-8C43722EE5DA} (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CntntCntr.CntntDic (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CntntCntr.CntntDic.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CntntCntr.CntntDisp (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CntntCntr.CntntDisp.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CoreSrv.CoreServices (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CoreSrv.CoreServices.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CoreSrv.LfgAx (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CoreSrv.LfgAx.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HBMain.CommBand (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HBMain.CommBand.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\hbr.HbMain (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\hbr.HbMain.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HostIE.Bho (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HostIE.Bho.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HostOL.MailAnim (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HostOL.MailAnim.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HostOL.WebmailSend (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HostOL.WebmailSend.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HotbarAx.Info (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HotbarAx.Info.1 (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HotbarAX.UserProfiles (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HotbarAX.UserProfiles.1 (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HotbarWeather.WeatherController (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\HotbarWeather.WeatherController.1 (Adware.Hotbar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Srv.CoreServices (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Srv.CoreServices.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Toolbar.HtmlMenuUI (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Toolbar.HtmlMenuUI.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Toolbar.ToolbarCtl (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Toolbar.ToolbarCtl.1 (Adware.Zango) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\hotbarsa (Adware.Hotbar) -> Quarantined and deleted successfully.

Registerverdier infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\PROGRAM FILES\DEALIO\DEALIOAU.EXE (PUP.Dealio.TB) -> Value: DEALIOAU.EXE -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\au (PUP.Dealio.TB) -> Value: au -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions\[email protected] (Adware.Hotbar) -> Value: [email protected] -> Quarantined and deleted successfully.

Registerfiler infisert:

(Ingen skadelige objekter funnet)

Mapper infisert:

c:\programdata\2aca5cc3-0f83-453d-a079-1076fe1a8b65 (Adware.Seekmo) -> Quarantined and deleted successfully.

c:\programdata\HotbarSA (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\Users\Henrik\AppData\Roaming\weatherdpa (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.

Filer infisert

c:\program files\Dealio\DealioAU.exe (PUP.Dealio.TB) -> Quarantined and deleted successfully.

c:\program files\Dealio\kb125\Dealio.dll (PUP.Dealio.TB) -> Quarantined and deleted successfully.

c:\programdata\HotbarSA\HotbarSA.dat (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\HotbarSA\hotbarsaabout.mht (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\HotbarSA\hotbarsaau.dat (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\HotbarSA\hotbarsaeula.mht (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\HotbarSA\hotbarsa_kyf.dat (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\about hotbar.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\hotbar customer support center.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\hotbar games!.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\hotbar uninstall instructions.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\hotbar videos!.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\reset cursor.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\programdata\microsoft\Windows\start menu\Programs\Hotbar\Weather.lnk (Adware.Hotbar) -> Quarantined and deleted successfully.

henape · 20. august 2011

Har fått sletta dissa filene, men dei tre prosessane her har ikkje gått vekk. og har ikke tilgang til å fjerne dei heller. noke spesielt e kan gjer?

nvvsvc.exe

winlogon.ege

csrss.exe

Munty · 20. august 2011

Har du startet maskinen i safe mode?

Dr.Geek · 21. august 2011

Har fått sletta dissa filene, men dei tre prosessane her har ikkje gått vekk. og har ikke tilgang til å fjerne dei heller. noke spesielt e kan gjer?

nvvsvc.exe

winlogon.ege

csrss.exe

Hai!

Dette er SYSTEMFILER! Ikke avslutt dem eller slett dem! Det er ingenting galt at disse er aktive. Hvis du avslutter dem vil systemet ikke kunne fungere riktig lenger.

Malwarebytes fant bare Adware. Post en Hijackthislog:

> http://free.antivirus.com/hijackthis/

Endret 21. august 2011 av TheGenius

henape · 21. august 2011

Har fått sletta dissa filene, men dei tre prosessane her har ikkje gått vekk. og har ikke tilgang til å fjerne dei heller. noke spesielt e kan gjer?

nvvsvc.exe

winlogon.ege

csrss.exe

Hai!

Dette er SYSTEMFILER! Ikke avslutt dem eller slett dem! Det er ingenting galt at disse er aktive. Hvis du avslutter dem vil systemet ikke kunne fungere riktig lenger.

Malwarebytes fant bare Adware. Post en Hijackthislog:

> http://free.antivirus.com/hijackthis/

Google:

csrss.exe

- csrss - Process Information

www.liutilities.com/products/wintaskspro/.../csrss/ - I hurtigbufferen

csrss.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, ...

winlogon.ege

Trudde jeg fann noe på den om att de kunne vær virus på, finn det ikke nå.

nvvsvc.exe

Why is nvvsvc.exe giving me errors?

System process errors are mainly due to problems with conflicting applications running on your PC. Consider uninstalling any applications you are not using or use SpeedUpMyPC to selectively disable or remove unnecessary background and auto-start processes. The safest way to stop these errors is to uninstall the application and run a registry scan to remove any residue or corrupt entries.

http://www.processlibrary.com/directory/files/nvvsvc/433585/

Legg ved bilde av prosessane: og dei 3 nevnte prosessane har ingen beskrivelse, deik kan ikkje stoppast (som burde gå ann) og har ingenting på brukernavn...

Jeg har startet datan i sikkerhetsmodus, og kjørte AVG-søk og Malwarebytes-søk (fann ingenting)

henape · 21. august 2011

Oppgavebehandling:

Dr.Geek · 21. august 2011

csrss.exe

- csrss - Process Information

www.liutilities.com/products/wintaskspro/.../csrss/ - I hurtigbufferen

csrss.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, ...

winlogon.ege

Trudde jeg fann noe på den om att de kunne vær virus på, finn det ikke nå.

:no:

Tro meg- dette er systemprosesser. Hvis du må absolut ha linker:

> http://www.neuber.com/taskmanager/process/csrss.exe.html

> http://www.neuber.com/taskmanager/process/winlogon.exe.html

Legg ved bilde av prosessane: og dei 3 nevnte prosessane har ingen beskrivelse, deik kan ikkje stoppast (som burde gå ann) og har ingenting på brukernavn...

Nei, de kan ikke stoppes fordi de er med på å holde ditt windows-systemet gående. Dette er pågrunn av Windows egen system-beskyttelse-rutiner. Disse file kan bare slettes når windows ikke kjører - men som sagt: filene er helt uskadelig og tilhører windows systemet.

Jeg har startet datan i sikkerhetsmodus, og kjørte AVG-søk og Malwarebytes-søk (fann ingenting)

Da ser du, alt er i orden.

Endret 21. august 2011 av TheGenius

henape · 21. august 2011

Ok, takk for alle svar..

Har lastet ned spyware doctor, Avira og Comodo Firewall nå. og spywere doctor fann 36 nye files som nå er slettet.

Dr.Geek · 21. august 2011

Ok, takk for alle svar..

Har lastet ned spyware doctor, Avira og Comodo Firewall nå. og spywere doctor fann 36 nye files som nå er slettet.

PC Sikkerhet handler ikke om flest Antivirus og Firewall Programmer men om egen holdning og Internet-praksis:

> http://download01.norman.no/books/nor/little_green_internet_security_nor.pdf

Mest viktig:

1. Ha EN Antivirusprogramm + Windows Firewall aktiv

2. Update windows system og all installert software

Vær forsiktig med alle downloads og linker, spesielt i de sosiale mediene som facebook & Co.

henape · 21. august 2011

Masse nyttig informasjon, takk

henape · 21. august 2011

Ett lite spørsmål på slutten Hva betyr dette? :S

Logg inn

Har virus, Hjelp!

Anbefalte innlegg

henape

Lenke til kommentar

Videoannonse

Munty

Lenke til kommentar

henape

Lenke til kommentar

Faller

Lenke til kommentar

henape

Lenke til kommentar

henape

Lenke til kommentar

Munty

Lenke til kommentar

Dr.Geek

Lenke til kommentar

henape

Lenke til kommentar

henape

Lenke til kommentar

Dr.Geek

Lenke til kommentar

henape

Lenke til kommentar

Dr.Geek

Lenke til kommentar

henape

Lenke til kommentar

henape

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Hvem er aktive 0 medlemmer