Får popup hele tiden.

du bør afinstallere bear-share meget skidt kommer denne vej.

Derefter følg: www.exp.dk/artikler/755 & kom med alle logs

Har skannet med alle mulige programmer og ingen tager den skide virus popup!
Er 'skide' træt af den, hvordan i alverden fjerner jeg den?!
Den hedder pripop.exe og har kigget og søgt på google, men den kan ikke finde pripop.exe, så jeg er den første der har den??

Derefter følg: www.exp.dk/artikler/755 & kom med alle logs -
så vil <halvamatoer> guide dig videre ...

Hej igen.
har stadig det problem med de popups, så se disse logs:
Håber i vil hjælpe.

HiJACKTHIS:


Logfile of HijackThis v1.99.1
Scan saved at 19:14:02, on 20-12-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
C:\Programmer\Java\jre1.5.0_04\bin\jucheck.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ejer\Skrivebord\hjt.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 68.45.8.169:80
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [BearShare] "C:\Programmer\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"  -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CU1] C:\Programmer\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Programmer\Common Files\VCClient\VCMain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.0.69.cab
O16 - DPF: {68459DB3-59C9-449D-815B-65F729385C16} (VoiceSecure Control) - http://www.voice4web.com/vs.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\l0n40a5qed.dll
O20 - Winlogon Notify: csrs - csrs.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: R_dddtyermper - Realtek Semiconductor Corporation - (no file)






---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            18:58:47, 20-12-2005
+ Rapport-Checksum:        A9F70631

+ Scanningsresultat:
    [2624] C:\WINDOWS\system32\guard.tmp -> Spyware.Look2Me : Renset med backup
    C:\WINDOWS\country.exe -> Trojan.Small : Renset med backup
    C:\WINDOWS\iconu.exe -> Spyware.Zestyfind : Renset med backup
    C:\WINDOWS\iLookup -> Adware.eZula : Renset med backup
    C:\WINDOWS\inet20009\3.00.11.dll -> Spyware.Ihbo : Renset med backup
    C:\WINDOWS\SYSTEM32\apwiz.dll -> Logger.Goldun.fv : Renset med backup
    C:\WINDOWS\SYSTEM32\guard.tmp -> Spyware.Look2Me : Renset med backup
    C:\WINDOWS\SYSTEM32\ipoiuin.dll -> Downloader.Qoologic.az : Renset med backup
    C:\WINDOWS\SYSTEM32\j04o0ah3ed4.dll -> Spyware.Look2Me : Renset med backup
    C:\WINDOWS\SYSTEM32\jdsjbjd.exe -> Trojan.Pakes : Renset med backup
    C:\WINDOWS\SYSTEM32\ll.exe.mwt -> Proxy.Lager.f : Renset med backup
    C:\WINDOWS\SYSTEM32\lvp6097se.dll -> Spyware.Look2Me : Renset med backup
    C:\WINDOWS\SYSTEM32\m2280cfuef280.dll -> Spyware.Look2Me : Renset med backup
    C:\WINDOWS\SYSTEM32\sywsvcs.exe.mwt -> Proxy.Lager.f : Renset med backup
    C:\WINDOWS\SYSTEM32\wbawy.dat -> Downloader.Qoologic.at : Renset med backup
    C:\WINDOWS\SYSTEM32\__delete_on_reboot__guard.tmp -> Spyware.Look2Me : Renset med backup
    C:\WINDOWS\Temp\bw2.com -> Spyware.Zestyfind : Renset med backup
    C:\WINDOWS\tool1.exe -> Trojan.Small : Renset med backup
    C:\WINDOWS\tool2.exe.mwt -> Hijacker.Spywad.l : Renset med backup
    C:\WINDOWS\tool3.exe.mwt -> Downloader.Small.bwr : Renset med backup
    C:\WINDOWS\tool4.exe -> Trojan.Small : Renset med backup
    C:\WINDOWS\tool5.exe -> Trojan.Small : Renset med backup


::Rapport slut

Jeg har fået lov at hjælpe dig videre..

Du har den nyeste variant af VX2 infektionen.

Hent L2mfix.exe fra et af disse steder:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Gem filen på dit Skrivebord og dobbeltklik på l2mfix.exe. Klik på Install knappen og følg instruktionerne. Åben herefter den nye mappe der er dannet på dit Skrivebord (l2mfix). Dobbeltklik på l2mfix.bat og vælg option 1 (Run Find log) ved at taste "1" og "Enter". Din computer bliver nu scannet - efter et par minutter åbnes en tekstfil i Notesblok. Kopier indholdet herind.

NB: Du må ikke køre option 2 eller andre af filerne i l2mfix mappen, før du er blevet bedt om det.

arlet -> Takker er sgu lidt i tvivl om hvordan man læser L2mfix loggene

Hej igen, mange tak for jeres gode hjælp indtil videre.

Havde fundet ud af jeg havde look2me virussen, og kigget lidt - da der også står den laver popups.

Her kommer loggen, og tak på forhånd.



L2mfix Beta 121605
Creating Account.
Kommandoen blev udf›rt.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX  ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 492 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 572 'winlogon.exe'
Killing PID 572 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 124 'explorer.exe'
Killing PID 124 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 212 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators  OpenPolicy:

***Error*** OpenPolicy -1073741790
Granting SeDebugPrivilege to Administrateurs  OpenPolicy:

***Error*** OpenPolicy -1073741790
Granting SeDebugPrivilege to Administrat÷rer  OpenPolicy:

***Error*** OpenPolicy -1073741790
Granting SeDebugPrivilege to Administradores  OpenPolicy:

***Error*** OpenPolicy -1073741790
Granting SeDebugPrivilege to Amministratore  OpenPolicy:

***Error*** OpenPolicy -1073741790
Granting SeDebugPrivilege to Administratoren  OpenPolicy:

***Error*** OpenPolicy -1073741790

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
moving: C:\WINDOWS\system32\__delete_on_reboot__crbcatex.dll 
moving: C:\WINDOWS\system32\__delete_on_reboot__j0j6la1s1d.dll 
moving: C:\WINDOWS\system32\p64ulgh9164.dll 

Desktop.ini sucessfully removed




Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\csrs]
"DllName"="csrs.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"Lock"="WLELock"
"Logoff"="WLELogoff"
"Logon"="WLELogon"
"Shutdown"="WLEShutdown"
"StartScreenSaver"="WLEStartScreenSaver"
"Startup"="WLEStartup"
"StopScreenSaver"="WLEStopScreenSaver"
"Unlock"="WLEUnlock"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SharedDLLs]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\j0j6la1s1d.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\__delete_on_reboot__crbcatex.dll
C:\WINDOWS\system32\__delete_on_reboot__j0j6la1s1d.dll
C:\WINDOWS\system32\p64ulgh9164.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok. 
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8334EEA1-37DC-469D-854F-ED3AADDE4CC3}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8334EEA1-37DC-469D-854F-ED3AADDE4CC3}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8334EEA1-37DC-469D-854F-ED3AADDE4CC3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B9F59D14-13D9-45CE-A03B-3440C5BB2BFE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9F59D14-13D9-45CE-A03B-3440C5BB2BFE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9F59D14-13D9-45CE-A03B-3440C5BB2BFE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9F59D14-13D9-45CE-A03B-3440C5BB2BFE}\InprocServer32]
@="C:\\WINDOWS\\system32\\crbcatex.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{CFC52720-88C7-4563-9E76-47AF4777C0AD}"=-
"{8334EEA1-37DC-469D-854F-ED3AADDE4CC3}"=-
"{B9F59D14-13D9-45CE-A03B-3440C5BB2BFE}"=-
[-HKEY_CLASSES_ROOT\CLSID\{CFC52720-88C7-4563-9E76-47AF4777C0AD}]
[-HKEY_CLASSES_ROOT\CLSID\{8334EEA1-37DC-469D-854F-ED3AADDE4CC3}]
[-HKEY_CLASSES_ROOT\CLSID\{B9F59D14-13D9-45CE-A03B-3440C5BB2BFE}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
    zip warning: name not matched: dlls\*.*

zip error: Nothing to do! (backup.zip)
  adding: backregs/8334EEA1-37DC-469D-854F-ED3AADDE4CC3.reg (104 bytes security) (deflated 69%)
  adding: backregs/B9F59D14-13D9-45CE-A03B-3440C5BB2BFE.reg (104 bytes security) (deflated 70%)
  adding: backregs/notibac.reg (140 bytes security) (deflated 88%)

Takker. Har ikke modtaget popups siden.
Vil du/i være venlig(e) at lægge et svar?

Og endnu en gang mange tak for hjælpen.

God jul

Arlets indsats her. Jeg springer over.

Arlet -> hvad ser man efter på denne log før man hopper til step 2?

Nu var yezbarh lidt hurtig og kopieret kun loggen fra selve fixet ind, men beskrivelsen af hele fixet er en længere forklaring, så kontakt mig via www.arlet.dk/kontakt.htm

Så skal jeg nok beskrive det..

God jul.

Hej, derude, jeg har samme problem `:( er der ikke nogle der kan hjælpe mig ?

ca. hver 10 min kommer der et tomt vindue op, hvor de alle ender med yyy102 eller yyy65, syntes det er meget træls hvis jeg er inde i spil og sådan..

ole 87 Jeg har svaret på din mail, så vi tager den der..