Irriterande "Virus Alert"

krepsos · 8. mai 2006

"Your computer is infected" kjem det av og til opp frå eit stoppskilt attmed klokka i skrivebordet windows. Kjører på ad-awere frå lavasoft og avg free edition, men dei finn ingen ting...denne banneren viser altså att eg treng ny spyware, men det er jo den som irriterer, avg og ad stoppar jo alt effektivt bortsett frå denne.

Korleis får eg den vekk? Ser ikkje noko i "prosesser" i windows oppgavebehandling som eg kan ta bort...evnt. tips om betre spyware som får den bort

Pozzolan · 8. mai 2006

Hei,

Høres ut som spyfalckon

Følg denne guiden for å bli kvitt det.

Så poster du en hijackthis log. Hijackthis finner du i signaturen min.

ultRAW · 10. mai 2006

stealthy, vet du hvor glad jeg er i deg akkurat nå? Endelig er jeg fri! Takk for den guiden, SpyFalcon er borte for godt. :thumbup:

zjulik · 10. mai 2006

Og den loggen har vi ikke sett noe til. Vil du maskinen din vel, poster du en. :thumbup:

krepsos · 19. mai 2006

Gjekk til det steget å kjøpa panda titanium, men "Virus alert" er der framleis... Blinkar mellom grønn rullestolbrukar og raudt stoppskilt.

Fyrst står det ein raud banner med "Your computer is infected! Critical system error! System detected..."osb, og når eg så trykker på banneren kjem denne sida opp http://www.spywarequake.com/?aff=264

Så panda er ypperleg, men tek ikkje denne. Har gjort den fyrst biten med smitRem òg...banneren kjem opp i ny og ne, og er veldig irriterande når vinduet i td. wow plutseleg går ned fordi denne får fokus

zjulik · 19. mai 2006

Og den loggen har vi ikke sett noe til. Vil du maskinen din vel, poster du en.

6078149[/snapback]

*kremt, host* ka det blir til?

krepsos · 19. mai 2006

Greit, no er loggen lagt til...kommentarar/inspel?

Logfile of HijackThis v1.99.1

Scan saved at 15:03:58, on 19.05.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

c:\programfiler\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe

C:\Programfiler\Fellesfiler\Panda Software\PavShld\pavprsrv.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\apvxdwin.exe

C:\Programfiler\NVIDIA Corporation\NvMixer\NVMixerTray.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\Microsoft ActiveSync\WCESCOMM.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Programfiler\Opera\Opera.exe

C:\Documents and Settings\Asgeir Langeland.KREPSOS.000\Mine dokumenter\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.5000.1021\no\msntb.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.5000.1021\no\msntb.dll

O4 - HKLM\..\Run: [NVMixerTray] "C:\Programfiler\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Programfiler\NVIDIA Corporation\nTune\\nTune.exe" clear

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [APVXDWIN] "C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programfiler\Microsoft ActiveSync\WCESCOMM.EXE"

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Opprett mobil favoritt - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programfiler\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programfiler\Microsoft ActiveSync\inetrepl.dll

O9 - Extra 'Tools' menuitem: Opprett mobil favoritt... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programfiler\Microsoft ActiveSync\inetrepl.dll

O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Programfiler\UltimateBet\UltimateBet.exe

O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Programfiler\UltimateBet\UltimateBet.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Programfiler\Poker.com\poker.exe (HKCU)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1142434409014

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1142435321217

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Programfiler\Fellesfiler\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe

O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\programfiler\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe

O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

Endret 19. mai 2006 av krepsos

zjulik · 19. mai 2006

Tja. Ser ikke noe seriøst galt her, men en del anmerkninger:

O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Programfiler\UltimateBet\UltimateBet.exe

O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Programfiler\UltimateBet\UltimateBet.exe

O9 - Extra button: Poker.com - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Programfiler\Poker.com\poker.exe (HKCU)

- Disse tre er enten noe du bevisst vil ha, eller noe du bør fjerne.

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.5000.1021\no\msntb.dll

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.5000.1021\no\msntb.dll

- Jeg ville tatt disse og. Toolbars er no svineri.

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

- Hvis du ikke bruker den gamle msn-en, kan du ta denne bort. Alt sånt speeder opp maskinen når du fjerner det fra oppstart.

Alt tar du bort ved å krysse av for fiks i HJT. De to filene nevnt i de tre øverste linjene går du inn og sletter der de ligger (slett hele mappene), hvis du altså vil bli kvitt dem.

Etter dette kjører du en ny god rens med CCleaner, og pass på at nettlesere er avsluttet når du gjør det.

Omstart.

Post gjerne en ny logg etterpå.

krepsos · 19. mai 2006

Takk for gjennomgangen! Slik er det no:

Logfile of HijackThis v1.99.1

Scan saved at 16:08:04, on 19.05.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

c:\programfiler\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe

C:\Programfiler\Fellesfiler\Panda Software\PavShld\pavprsrv.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

C:\WINDOWS\System32\wdfmgr.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\userinit.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\apvxdwin.exe

C:\Programfiler\NVIDIA Corporation\NvMixer\NVMixerTray.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\Programfiler\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\Microsoft ActiveSync\WCESCOMM.EXE

C:\Programfiler\Opera\Opera.exe

C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\avciman.exe

C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\psimreal.exe

C:\Documents and Settings\Asgeir Langeland.KREPSOS.000\Skrivebord\Opprydding\HijackThis.exe