Får regelmessig 64 popups, samtidig! [LØST]

since91 · 28. mai 2007

Hello!

Tidligere hadde jeg problemer med partypoker og noen svenske IE-popups.

Og siden jeg ikke bruker IE, slettet jeg det. Men når jeg nå logger inn på MSN eller åpner firefox, popper det opp 64 pop-ups! - Sinnsykt irriterende.

Det som er rart, er at jeg har slettet IE, men alikevel kommer disse pop-upsa opp i IE. En annen ting er at de er helt tomme! - Ingen reklame eller noe, bare helt hvite...

Håper noen har en løsning

Edit: Btw, de popper visst også opp som de vil, fant jeg ut...

Endret 31. mai 2007 av Jonatan777

norbat · 28. mai 2007

Heisann,

Start med å kjøre gjennom langversjonen i følgende post: https://www.diskusjon.no/index.php?showtopic=691246, så tar vi det derfra :thumbup:

since91 · 28. mai 2007

oki

Edit:

Klikk for å se/fjerne innholdet nedenfor

Logfile of HijackThis v1.99.1

Scan saved at 15:22:53, on 28.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

D:\Programmer\PC Tools AntiVirus\PCTAVSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\TBPanel.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\QuickTime\qttask.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe

D:\Programmer\DAEMON Tools\daemon.exe

D:\Programmer\PC Tools AntiVirus\PCTAV.exe

D:\Programmer\iTunes\iTunesHelper.exe

D:\Programmer\CounterSpy\SBCSTray.exe

C:\Programfiler\Azureus Installer\Azureus-Installer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Programfiler\MSN Messenger\usnsvc.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Programfiler\MSN Messenger\msnmsgr.exe

C:\Documents and Settings\Jonatan\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A

O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [DAEMON Tools] "D:\Programmer\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [PCTAVApp] "D:\Programmer\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN

O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmer\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sBCSTray] D:\Programmer\CounterSpy\SBCSTray.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKCU\..\Run: [Azureus Installer] "C:\Programfiler\Azureus Installer\Azureus-Installer.exe" hmw

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: Adobe Gamma.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O10 - Unknown file in Winsock LSP: c:\programfiler\fellesfiler\pc tools\lsp\pctlsp.dll

O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {5CD4310E-88FB-43C1-BE24-5F3FA9C5C9D1} (KooPlayer Control) - http://www.tvlution.com/KooPlayer.ocx

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: GoogleDesktopManager - Google - C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - D:\Programmer\PC Tools AntiVirus\PCTAVSvc.exe

Klikk for å se/fjerne innholdet nedenfor

********************************* ROOTCHK-(21-05-07)-LOG, by ejvindh

28.05.2007 15:41:53,75

Driver npf (visible) is present. Run COMBOFIX by sUBs.

********************************* ROOTCHK-LOG-end

catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-28 15:41:54

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Klikk for å se/fjerne innholdet nedenfor

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 05/28/2007 at 05:11 PM

Application Version : 3.8.1002

Core Rules Database Version : 3245

Trace Rules Database Version: 1256

Scan type : Complete Scan

Total Scan Time : 01:27:54

Memory items scanned : 416

Memory threats detected : 0

Registry items scanned : 5579

Registry threats detected : 0

File items scanned : 41488

File threats detected : 3

Trojan.NewDotNet

C:\SYSTEM VOLUME INFORMATION\_RESTORE{BC3CEBC5-72EA-4575-8B8C-FF55E4013033}\RP68\A0011457.EXE

C:\SYSTEM VOLUME INFORMATION\_RESTORE{BC3CEBC5-72EA-4575-8B8C-FF55E4013033}\RP68\A0011493.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{BC3CEBC5-72EA-4575-8B8C-FF55E4013033}\RP68\A0011494.EXE

Endret 28. mai 2007 av Jonatan777

norbat · 28. mai 2007

Loggen viser ingen spesielle ting, men få kjørt en rens med CCleaner og en full scan med SAS (se langversjonen). Ta også å kjør Rootchk. Hvis den finner noe, poster du også den loggen.

norbat · 29. mai 2007

Last ned Winsockfix. Denne kan du gjemme på og bruke om nettforbindelsen blir korrupt etter fixet.

Hent Combofix, og legg det på skrivebordet

Kjør combofix.exe, og følg veiledningen.

Du må ikke klikke på vinduet mens programmet kjører.

Post loggfilen fra combofix. (vanligvis c:\combofix.txt) + ny HJT-logg

since91 · 29. mai 2007

Klikk for å se/fjerne innholdet nedenfor

2007-03-09 23:38:49 0 ----a-w C:\AUTOEXEC.BAT

2007-03-09 23:37:06 21,704 ----a-w C:\WINDOWS\system32\emptyregdb.dat

2007-03-09 07:57:40 27,376 ----a-w C:\WINDOWS\system32\SBBD.exe

2007-03-08 15:39:11 577,536 ----a-w C:\WINDOWS\system32\user32.dll

2007-03-08 15:39:11 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll

2007-03-08 15:39:11 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll

2007-03-08 15:38:06 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx [2001-04-16 17:39]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Programfiler\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PtiuPbmd"="ptipbm.dll" [2003-01-15 13:41 C:\WINDOWS\system32\ptipbm.dll]

"SoundMan"="SOUNDMAN.EXE" []

"QuickTime Task"="C:\Programfiler\QuickTime\qttask.exe" [2007-02-16 11:54]

"nwiz"="nwiz.exe" [2006-10-22 13:22 C:\WINDOWS\system32\nwiz.exe]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

"DAEMON Tools"="D:\Programmer\DAEMON Tools\daemon.exe" [2005-12-10 16:57]

"PCTAVApp"="D:\Programmer\PC Tools AntiVirus\PCTAV.exe" [2007-05-07 06:30]

"iTunesHelper"="D:\Programmer\iTunes\iTunesHelper.exe" [2007-03-14 19:05]

"@"="" []

"SBCSTray"="D:\Programmer\CounterSpy\SBCSTray.exe" [2007-03-09 10:31]

"Google Desktop Search"="C:\Programfiler\Google\Google Desktop Search\GoogleDesktop.exe" [2007-05-17 21:09]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Azureus Installer"="C:\Programfiler\Azureus Installer\Azureus-Installer.exe" [2007-03-15 16:45]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:03]

"SUPERAntiSpyware"="C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-05-23 10:12]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Programfiler\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\L]

AutoRun\command- L:\SETUP.EXE /AUTORUN

configure\command- L:\SETUP.EXE

install\command- L:\SETUP.EXE

Contents of the 'Scheduled Tasks' folder

2007-05-26 15:03:01 C:\WINDOWS\tasks\AppleSoftwareUpdate.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-05-29 14:50:04

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

********************************************************************

Completion time: 2007-05-29 14:50:49 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-05-29 14:50

--- E O F ---

Klikk for å se/fjerne innholdet nedenfor

Logfile of HijackThis v1.99.1

Scan saved at 14:52:39, on 29.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\WINDOWS\system32\nvsvc32.exe

D:\Programmer\PC Tools AntiVirus\PCTAVSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Java\jre1.6.0_01\bin\jusched.exe

D:\Programmer\DAEMON Tools\daemon.exe

D:\Programmer\PC Tools AntiVirus\PCTAV.exe

D:\Programmer\iTunes\iTunesHelper.exe

D:\Programmer\CounterSpy\SBCSTray.exe

C:\Programfiler\Azureus Installer\Azureus-Installer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\notepad.exe