Hjælp jeg har spyware

ja, du har spyware!! du skal downloade en antispyware program straks, f.eks. Windows Defender (gratis) spywarebuster (gratis) el. adadware (gratis)...helt alle 3...og samtidig opdater din symantic antivirus signature...

Jeg har allerede kørt Avg Antispyware(Det der før hen hed ewidomalware), det fjernede en masse men har ikke afhjulpet mit problem, kan du ikke fortælle hvilke linjer fra logfilen der er problemer med

Proceduren:

1. Du kan rense temp med denne fil, det tager kun få sek.
www.spywareinfo.dk/download/cleantempxp2k.bat

-------------------------------------------------

2. Hent og pak SmitfraudFix.zip ud til dit Skrivebord.

http://siri.urz.free.fr/Fix/SmitfraudFix.zip

Programmet pakker sig ud i en mappe, der hedder SmitfraudFix.
3. Hent denne scanner http://www.superantispyware.com/downloads/SUPERAntiSpyware1241.exe

Installer scanneren, og opdater den manuelt. OBS, ved installationen bliver det foreslået at du registrerer med din email. Det behøver du ikke at gøre.

Du skal ikke scanne endnu.

-------------------------------------------------

4. Genstart i fejlsikret tilstand http://www.spywareinfo.dk/#/htm/fejlsikret_tilstand.htm

-------------------------------------------------

5. Åbn mappen SmitfraudFix som du fik på Skrivebordet, og dobbeltklik på SmitfraudFix.cmd og tast 2 - svar ja til at rense (y=yes). Lad programmet gennemføre en rensning. Hvis fixet genstarter computeren, så skal du bagefter starte op i fejlsikret igen, og fortsætte proceduren med SuperAntiSpyware.

-------------------------------------------------

6. Start SuperantiSpyware, og klik "Scan your computer". Sæt flueben i dine drev, ovre til venstre i vinduet. Ovre til højre i vinduet, sætter du prik i "Perform Complete Scan". Klik "næste", nu scanner den. Når den er færdig, så markerer du det den finder, og lader scanneren fjerne det.

Genstart til normal tilstand (scanneren tilbyder måske at gøre det).

-------------------------------------------------

7. Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

O2 - BHO: (no name) - {c3703265-4671-4858-92a4-cba6a7b3bb45} - C:\WINDOWS\system32\ixt0.dll
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Programmer\Safety Bar\SafetyBar.dll (file missing)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O20 - Winlogon Notify: wintuh32 - wintuh32.dll (file missing)
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)

-------------------------------------------------

8. For at kunne se alle filer og mapper, så følg denne vejledning:
http://www.spywareinfo.dk/tip-og-tricks/mappeindstillinger.htm

Genstart i fejlsikret tilstand http://www.spywareinfo.dk/#/htm/fejlsikret_tilstand.htm

Søg og slet de markerede filer/mapper hvis de stadig findes. Ellers fortsætter du bare vejledningen. De kan være røget i fixet.

C:\WINDOWS\system32\ixt0.dll
C:\Programmer\Safety Bar\ <- Hele mappen
C:\WINDOWS\system32\urroxtl.dll
wintuh32.dll <- Søg efter den

Genstart normalt.

-------------------------------------------------

9. Åbn SuperantiSpyware scanneren igen, og klik "preferences"-> "stastics/logs". Marker loggen, og klik "View log". Kopier loggen her ind i tråden, sammen med en frisk HijackThis log. SmitfraudFix laver også en lille tekstfil (C:\rapport.txt). Kopier også denne log ind.

Det ser ud til det har hjulpet.

Her smitfraud logfilen.

SmitFraudFix v2.117

Scan done at 16:53:02,34, 31-10-2006
Run from C:\Documents and Settings\Henning Larsen\Skrivebord\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\ishost.exe Deleted
C:\WINDOWS\system32\ismini.exe Deleted
C:\WINDOWS\system32\isnotify.exe Deleted
C:\WINDOWS\system32\issearch.exe Deleted
C:\WINDOWS\system32\ixt?.dll Deleted
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\Documents and Settings\Henning Larsen\Application Data\Microsoft\Internet Explorer\Quick Launch\SpyQuake2.com 2.3.lnk Deleted
C:\DOCUME~1\HENNIN~1\FORETR~1\Antivirus Test Online.url Deleted
C:\DOCUME~1\HENNIN~1\MENUEN~1\SpyQuake2.com 2.3.lnk Deleted
C:\DOCUME~1\HENNIN~1\MENUEN~1\PROGRA~1\SpyQuake2.com Deleted
C:\DOCUME~1\ALLUSE~1\MENUEN~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\MENUEN~1\Security Troubleshooting.url Deleted
C:\Programmer\Safety Bar\ Deleted
C:\Programmer\SpyQuake2.com\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Her er Hijack this logfilen:


Logfile of HijackThis v1.99.1
Scan saved at 17:22:40, on 31-10-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\htpatch.exe
C:\Programmer\ATI Technologies\ATI.ACE\CLI.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Fælles filer\Ahead\Lib\NMIndexStoreSvr.exe
C:\Programmer\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Programmer\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\Programmer\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Henning Larsen\Skrivebord\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ni.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Programmer\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [ccApp] C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Programmer\Fælles filer\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160223972859
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160224454828
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - C:\Programmer\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Og til sidst logfilen fra antispyware:

SUPERAntiSpyware Scan Log
Generated 10/31/2006 at 05:10 PM

Application Version : 3.3.1020

Core Rules Database Version : 3117
Trace Rules Database Version: 1140

Scan type      : Complete Scan
Total Scan Time : 00:15:07

Memory items scanned      : 163
Memory threats detected  : 0
Registry items scanned    : 4699
Registry threats detected : 17
File items scanned        : 18362
File threats detected    : 39

Adware.Tracking Cookie
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@ehg-maniatv.hitbox[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@msnportal.112.2o7[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@tradedoubler[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@ehg-twi.hitbox[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@e-2dj6wgkiomcpiap.stats.esomniture[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@doubleclick[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@advertising[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@dk.winantivirus[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@stats.drivecleaner[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@ex=1_[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@adservices10.marchex[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@mediaplex[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@tribalfusion[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@www.drivecleaner[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@indexstats[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@warlog[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@c.enhance[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@dealtime[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@go.drivecleaner[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@adbrite[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@indextools[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@stats1.reliablestats[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@drivecleaner[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@stat.dealtime[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@mb[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@atdmt[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@hitbox[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@as-eu.falkag[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@winantivirus[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@cgi-bin[2].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@e2.emediate[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@www.winantivirus[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@microsoftwga.112.2o7[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@2o7[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@fastclick[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@adtech[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@www.pesttrap[1].txt
    C:\Documents and Settings\Henning Larsen\Cookies\henning larsen@track.adform[1].txt

Trojan.Unknown Origin
    HKLM\SOFTWARE\Microsoft\MSSMGR
    HKLM\SOFTWARE\Microsoft\MSSMGR#Data
    HKLM\SOFTWARE\Microsoft\MSSMGR#LSTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#Brnd
    HKLM\SOFTWARE\Microsoft\MSSMGR#MSLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#PID
    HKLM\SOFTWARE\Microsoft\MSSMGR#Rid
    HKLM\SOFTWARE\Microsoft\MSSMGR#LID
    HKLM\SOFTWARE\Microsoft\MSSMGR#SCLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#SSLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#BSTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#BPTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#PSTV
    HKLM\SOFTWARE\Microsoft\MSSMGR#SSTV

Malware.Safety Bar
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyBar
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyBar#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyBar#UninstallString

Browser Hijacker.Favorites
    C:\RECYCLER\S-1-5-21-1960408961-1450960922-682003330-1003\DC4.URL

Ser der bedre ud nu, de nævnte filer vi skulle slette kunne vi ikke finde, men de er
vel blevet taget at smitfraud eller spyware programmet.

Hvad gør smitfraud ??

MVH

Jes

Du er velkommen en anden gang...

Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt prik i "Vis ikke skjulte filer og mapper".

Du bør rense temp med denne fil, det tager kun få sek.
http://www.spywareinfo.dk/download/cleantempxp2k.bat

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelsesfilerne.
Deaktiver systemgendannelse -> http://www.spywareinfo.dk/#/tip-og-tricks/deaktiver_systemgendannelse.htm
Genstart din computer - aktiver systemgendannelse. Dette gøres samme sted, hvor du deaktiverede, denne gang skal du blot aktivere.
Det vil også være en god idé manuelt at oprette et nyt punkt, som du kan navngive, og vende tilbage til, hvis du skulle få problemer af nogen art.

Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414

Safe Surfing...