Stort problem. Hijacked

[Moony]

Har fått ett stort problem. Når jeg skal inn på google og hotbot så får jeg opp en blå side med følgende tekst:

Detected SPYware! System error #384 
__________________________________________________________________________ 
 
Your IP address is "tatt vekk". Using this address a remote computer has gained anaccess to your computer and probably is collecting the information about the sites you've visited and the files contained in the folder Temporary Internet Files. Attention! Ask for help or install the software for deleting secret information about the sites you visited.

__________________________________________________________________________

Your computer is full of evidences!


ISP of transmission: 154 
Your IP address: tatt vekk
They know you're using: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322) 
Your computer is: Windows XP 
Risk status for further investigation: VERY HIGH RISK 

 
 
 
To protect from the Spyware - click here 
To prevent information transmission  - click here 
To delete the history of your activity, click here 

 

 

Er linken til http://www.e-shredder.com/enter.phtml?wm=wwwilly

Har også en fil i c:\windows som heter secure.html som linker videre til pornosider.

 

Hostfila mi endres også. Får ikke endret den tilbake til det orginale.

Den ser sånn ut:

127.0.0.1 thehun.com
127.0.0.1 www.thehun.com
127.0.0.1 thehun.net
127.0.0.1 www.thehun.net
127.0.0.1 www.yahoo.com
127.0.0.1 yahoo.com
127.0.0.1 www.google.com
127.0.0.1 google.com
127.0.0.1 www.altavista.com
127.0.0.1 altavista.com
127.0.0.1 search.microsoft.com
127.0.0.1 search.msn.com
127.0.0.1 www.msn.com
127.0.0.1 msn.com
127.0.0.1 www.search.com
127.0.0.1 search.com
127.0.0.1 www.teoma.com
127.0.0.1 teoma.com
127.0.0.1 www.alltheweb.com
127.0.0.1 alltheweb.com
127.0.0.1 www.wisenut.com
127.0.0.1 wisenut.com
127.0.0.1 www.dmoz.org
127.0.0.1 dmoz.org
127.0.0.1 www.excite.com
127.0.0.1 excite.com
127.0.0.1 www.lycos.com
127.0.0.1 lycos.com
127.0.0.1 www.hotbot.com
127.0.0.1 hotbot.com
127.0.0.1 www.casino.com
127.0.0.1 casino.com

 

Er det noen som vet hvordan jeg skal bli kvitt dette shitet.Har kjørt både adaware og spybot + diverse andre.

Endret 2. juli 2004 av Moony

[sumptrollet]

Eneste som duger skikkelig er en re-innstallasjon. Har du spyware på maskinen så vet aldri hva slags drit som ligger der.

[Spragleknas]

Merjin siden er nede...

 

 

se her

http://www.net-integration.net/tools/hijackthis.html

[Moony]

Merjin siden er nede...

 

 

se her

http://www.net-integration.net/tools/hijackthis.html

Dette har jeg kjørt og slettet det jeg turde slette og viste hva var

 

Men hvordan kan den endre hostfila?

[Typhon]

Du har nok ett lite virus ja hehe...

 

Kjør antivirus du så ordner det seg nok

[agvg]

Men hvordan kan den endre hostfila?

CWShredder skal vel i tilleg til og rense også fikse opp hostfila di.

[Spragleknas]

CWShredder

 

A small utility for removing CoolWebSearch (aka CoolWwwSearch, YouFindAll, White-Pages.ws and a dozen other names). Spybot S&D tends to forget essential parts of the hijack, so until it updates, you can just this to completely remove the hijack. Updated to remove the new variants once they come out.

 

Any known information regarding CoolWebSearch can be found in the CoolWebSearch Chronicles.

 

If you find a system scan by SpybotS&D indicates CoolWebSearch present but does not effectively remove it download and run CWShredder.

Download CWShredder Now