(Fikset)"You are infected" popups, kan noe hjelpe?

[Potetfar]

Hei.

 

Jeg har nettop funnet ut at jeg har virus, og ikke et som lar seg fjerne så lett. Jeg har funnet ut at det er et slags virus som viser meg popups (nei, ikke vanlig adware ) som hyler ut "Attention! Virus detected!" og anbefaler meg tre programmer. WinAntiVirus, VirusRescue og SpyHealer.

 

Etter hva jeg har funnet ut er WinAntiVirus et virus selv, og da trenger man ikke tenke langt for å komme på tanken at de to andre er det også. Jeg har prøvd diverse løsninger - Ad-Aware, NOD32, AVG Antivirus og ewido (produkt fra Grisoft). De tre sistnevnte fant hver sin mengde dritt (=/), som jeg fjernet etter alle kunsens regler, men når det fortsatt kommer popups som jeg har beskrevet tidligere, tviler jeg på alt som skal fjernes er fjernet.

 

I tillegg kommer det en sånn boks nede til venstre, som redirecter meg til først "www.thesecuritypages.com", som endrer seg til "www.spytrap.com", og til slutt til "Siden kan ikke vises".

 

Kan noen hjelpe meg?

 

Edit: HijackThis log:

 

Logfile of HijackThis v1.99.1

Scan saved at 18:44:00, on 07.09.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5450.0004)

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

D:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

D:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

D:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\Explorer.EXE

D:\Programfiler\PCODEC\isamonitor.exe

D:\Programfiler\PCODEC\pmsngr.exe

D:\WINDOWS\SOUNDMAN.EXE

D:\Programfiler\PCODEC\isamini.exe

D:\Programfiler\PCODEC\pmmon.exe

D:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

D:\Programfiler\Microsoft IntelliPoint\point32.exe

D:\Programfiler\QuickTime\qttask.exe

D:\Programfiler\Creative\Shared Files\CAMTRAY.EXE

D:\Programfiler\Winamp\winampa.exe

D:\WINDOWS\system32\RunDLL32.exe

D:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

D:\Programfiler\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe

D:\Programfiler\Eset\nod32kui.exe

D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Programfiler\Globe Software\StatBar\StatBar.exe

D:\programfiler\steam\steam.exe

D:\Programfiler\MSI\Core Center\CoreCenter.exe

D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

D:\Programfiler\OpenOffice.org 2.0\program\soffice.exe

D:\Programfiler\OpenOffice.org 2.0\program\soffice.BIN

D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

D:\Programfiler\Executive Software\DiskeeperLite\DKService.exe

D:\Programfiler\ewido\security suite\ewidoctrl.exe

D:\Programfiler\ewido\security suite\ewidoguard.exe

D:\WINDOWS\System32\GEARSec.exe

D:\Programfiler\NetLimiter 2 Pro\nlsvc.exe

D:\Programfiler\Eset\nod32krn.exe

D:\Programfiler\Norton SystemWorks\Norton Ghost\Agent\VProSvc.exe

D:\WINDOWS\system32\nvsvc32.exe

D:\WINDOWS\System32\svchost.exe

D:\Programfiler\NetLimiter 2 Pro\NLClient.exe

D:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\system32\rundll32.exe

D:\Uinst\hijackthis\HijackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - D:\Programfiler\PCODEC\isaddon.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Programfiler\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Protection Bar - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - D:\Programfiler\PCODEC\iesplugin.dll

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [intelliPoint] "D:\Programfiler\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [QuickTime Task] "D:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Creative WebCam Tray] D:\Programfiler\Creative\Shared Files\CAMTRAY.EXE

O4 - HKLM\..\Run: [WinampAgent] D:\Programfiler\Winamp\winampa.exe

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ccApp] "D:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Norton Ghost 10.0] "D:\Programfiler\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe"

O4 - HKLM\..\Run: [XoftSpy] D:\Programfiler\XoftSpy\XoftSpy.exe -s

O4 - HKLM\..\Run: [nod32kui] "D:\Programfiler\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [statBar] D:\Programfiler\Globe Software\StatBar\StatBar.exe

O4 - HKCU\..\Run: [steam] "d:\programfiler\steam\steam.exe" -silent

O4 - Startup: OpenOffice.org 2.0.lnk = D:\Programfiler\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: CoreCenter.lnk = D:\Programfiler\MSI\Core Center\CoreCenter.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programfiler\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O12 - Plugin for .spop: D:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1143646969484

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: Diskeeper - Executive Software International, Inc. - D:\Programfiler\Executive Software\DiskeeperLite\DKService.exe

O23 - Service: ewido security suite control - ewido networks - D:\Programfiler\ewido\security suite\ewidoctrl.exe

O23 - Service: ewido security suite guard - ewido networks - D:\Programfiler\ewido\security suite\ewidoguard.exe

O23 - Service: GEARSecurity - GEAR Software - D:\WINDOWS\System32\GEARSec.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NetLimiter (nlsvc) - Locktime Software - D:\Programfiler\NetLimiter 2 Pro\nlsvc.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Programfiler\Eset\nod32krn.exe

O23 - Service: Norton Ghost - Symantec Corporation - D:\Programfiler\Norton SystemWorks\Norton Ghost\Agent\VProSvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - D:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SPBBCSvc - Symantec Corporation - D:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - D:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

Endret 8. september 2006 av Potetfar

[Pozzolan]

Prøv denne: http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

[berxter]

Jepp, SFF skulle ta den. Husk; dersom alt 1(search) finner den, må du kjøre alt 2(clean) i safe mode.

 

Bernt K

[ub1soft]

KJør i sikkermodus og så bruk antivirus!

hvis du ikke vet hvordan du starter i sikkermodus så spammer du "f5" knappen når du starter pcn og velger sikkermodus der.

[Kasius De'Vias]

KJør i sikkermodus og så bruk antivirus!

hvis du ikke vet hvordan du starter i sikkermodus så spammer du "f5" knappen når du starter pcn og velger sikkermodus der.

6824700[/snapback]

Hoy, der!

 

Mener du ikke F8?

 

Personlig har jeg aldri møtt på et system som bruker F5 for å få fram oppstartsmenyen.

[Potetfar]

Tusen takk for alle svar, men jeg tror faktisk SpyBot pluss litt manuell searching i registeret og greier fikset det.

 

Tusen takk!

[berxter]

Så nå er alle disse vekk? eller ihvertfall med (file missing)

 

D:\Programfiler\PCODEC\isamonitor.exe

D:\Programfiler\PCODEC\pmsngr.exe

D:\Programfiler\PCODEC\isamini.exe

D:\Programfiler\PCODEC\pmmon.exe

O2 - BHO: (no name) - {202a961f-23ae-42b1-9505-ffe3c818d717} - D:\Programfiler\PCODEC\isaddon.dll

O3 - Toolbar: Protection Bar - {479fd0cf-5be9-4c63-8cda-b6d371c67bd5} - D:\Programfiler\PCODEC\iesplugin.dll

O4 - HKCU\..\Run: [statBar] D:\Programfiler\Globe Software\StatBar\StatBar.exe

 

O11 - Options group: [iNTERNATIONAL] International* (dersom du vet hvorfor den er slått på er den grei)

 

Bernt K