Spyware mainokset

Discussion in 'Virukset ja haittaohjelmat' started by Aras88, Sep 1, 2005.

Page 1 of 2
  1. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Aina kun menen internettiin tietokoneessani, niin tulee hirveesti mainoksia että tietokoneessasi on havaitsettu spyware. Miten saan nämä mainokset pois?
     
    Aras88, Sep 1, 2005
    #1
  2. pkaksp

    pkaksp Moderator Staff Member

    Joined:
    Jan 10, 2005
    Messages:
    12,231
    Likes Received:
    53
    Trophy Points:
    128
    pkaksp, Sep 1, 2005
    #2
  3. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    -kemisti-, Sep 1, 2005
    #3
  4. Alukard

    Alukard Regular member

    Joined:
    Apr 8, 2005
    Messages:
    158
    Likes Received:
    0
    Trophy Points:
    26
    Alukard, Sep 1, 2005
    #4
  5. Osku87

    Osku87 Regular member

    Joined:
    Nov 30, 2004
    Messages:
    2,634
    Likes Received:
    0
    Trophy Points:
    46
    Osku87, Sep 1, 2005
    #5
  6. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Mulla on tällä hetkellä koneessa Avast 4 ja sbybot search and destroy.
    Olen kokeillut molemmilla poistaa spywarea ja se onnistuu mut sit ku meen nettiin niin taas ne spyware mainokset ilmestyvät :/
     
    Aras88, Sep 1, 2005
    #6
  7. mika

    mika Moderator Staff Member

    Joined:
    Mar 26, 2003
    Messages:
    5,157
    Likes Received:
    0
    Trophy Points:
    116
    Asenna se Hijackthis-ohjelma ja laita loki tonne virus-/haittaohjelma.forumiin. Täällä on kyllä henkilöitä, jotka osaa auttaa sua sen lokin kanssa :)
     
    mika, Sep 1, 2005
    #7
  8. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Nyt kun latasin Sen Mozilla fire foxin, niin näyttää siltä että ne mainokset eivät ilmesty enää... ;)

    mutta mulla on toinenkin ongelma ennen kun käytin tätä tietokonetta, netti toimi suht nopeasti mut nyt tämä kone on hemmetin hidas kestä melkein minuutin ennen kun jonkun ohjelman ikkuna ilmestyy!! miten saan tämän koneen nopeammaksi
     
    Aras88, Sep 1, 2005
    #8
  9. Osku87

    Osku87 Regular member

    Joined:
    Nov 30, 2004
    Messages:
    2,634
    Likes Received:
    0
    Trophy Points:
    46
    Tuossa on ny jo pari kertaa annettu ohjeet, mitä pitää tehdä. Jos vaikka noudattaisit niitä.
     
    Osku87, Sep 1, 2005
    #9
  10. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    @Aras88:Kuten mika, Osku87 ja minä olemme jo sanoneet, lataa tuo hijackthis tuosta antamastani linkistä ja postita sen loki tänne. Siitä ongelma selvinnee.

    EDIT: Osku87:n nikki korjattu :p
     
    Last edited: Sep 1, 2005
    -kemisti-, Sep 1, 2005
    #10
  11. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    latasin sen hijack this ohjelman mut kun yritän käynnistää sen ohjelman siihen tulee ilmotus jossa lukee ''A required .DLL file MSVBVM60.DLL, was not found'' :/
     
    Aras88, Sep 1, 2005
    #11
  12. Osku87

    Osku87 Regular member

    Joined:
    Nov 30, 2004
    Messages:
    2,634
    Likes Received:
    0
    Trophy Points:
    46
    Osku87, Sep 1, 2005
    #12
  13. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    ei kyl onnistu tostakaan linkistä...:( ja tietokoneeni näyttää olevan hemmetin hidas
     
    Aras88, Sep 1, 2005
    #13
  14. winxp

    winxp Member

    Joined:
    Jun 27, 2003
    Messages:
    45
    Likes Received:
    0
    Trophy Points:
    16
    Lueppa tuosta ohjeet

    http://koti.mbnet.fi/pattaya1/hijackthis.htm#Tietoa

    jatkuu......
     
    winxp, Sep 1, 2005
    #14
  15. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    mä sain sen hijack this ohjelman toimimaan ja mä tein sen ''do a system scan and save a logfile'' ;)

    Tässä se logfile:


    Logfile of HijackThis v1.99.1
    Scan saved at 22:11:35, on 1.9.2005
    Platform: Windows 98 Gold (Win9x 4.10.1998)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
    C:\WINDOWS\SYSTEM\OUTPOSTUPDATE.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\MY DOCUMENTS\HIJACKTHIS.EXE
    C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {09EFCAC1-197C-11DA-A0A6-00114208F3E9} - C:\WINDOWS\SYSTEM\MMMD.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O4 - HKLM\..\RunServices: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - HKLM\..\RunOnce: [InstMsi0] C:\WINDOWS\SYSTEM\msiexec.exe /regserver
    O4 - HKLM\..\RunOnce: [InstMsi1] rundll32.exe C:\WINDOWS\SYSTEM\advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Installer\InstMsi0"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - HKCU\..\RunServices: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\RunServices: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - http://download.badpopup.com/875464/files/installer.cab
    O18 - Filter: text/html - {09EFCAC0-197C-11DA-A0A6-00112D445672} - C:\WINDOWS\SYSTEM\MMMD.DLL
    O18 - Filter: text/plain - {09EFCAC0-197C-11DA-A0A6-00112D445672} - C:\WINDOWS\SYSTEM\MMMD.DLL
     
    Aras88, Sep 1, 2005
    #15
  16. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Sammuta prosessi tehtävienhallinnasta(ctrl+alt+del -> lopeta prosessi):

    outpostupdate.exe

    Avaa hijackthis, klikkaa do a system scan only, merkkaa nämä ja paina fix checked:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    O4 - HKLM\..\Run: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O4 - HKLM\..\RunServices: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - HKCU\..\Run: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O4 - HKCU\..\RunServices: [outpostupdate] C:\WINDOWS\SYSTEM\outpostupdate.exe
    O16 - DPF: {8A0DCBDA-6E20-489C-9041-C1E8A0352E75} - http://download.badpopup.com/875464/files/installer.cab

    Sitten käynnistä vikasietotilaan, eli paina Ctrl-näppäintä käynnistyksen yhteydessä ja valitse valikosta vikasietotila.

    Poista seuraavat tiedostot:

    C:\WINDOWS\TEMP\==>SE.DLL<==
    C:\WINDOWS\SYSTEM\==>outpostupdate.exe<==

    Käynnistä uudestaan normaalisti ja laita uusi loki.
     
    Last edited: Sep 2, 2005
    -kemisti-, Sep 1, 2005
    #16
  17. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    mä tein sen merkatut kohdat fix checked, mut tota vikaseotila mä en saanut siis mä käynnistän ja sen yhteydestä painan ctrl-näppäintä.

    Näin mä tein mut en mä saanut sitä vikaseotilaa

    mut täs on taas uusi logfile:

    Logfile of HijackThis v1.99.1
    Scan saved at 13:15:48, on 2.9.2005
    Platform: Windows 98 Gold (Win9x 4.10.1998)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\MY DOCUMENTS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {09EFCAC1-197C-11DA-A0A6-00114208F3E9} - C:\WINDOWS\SYSTEM\MMMD.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O18 - Filter: text/html - {09EFCAC0-197C-11DA-A0A6-00112D445672} - C:\WINDOWS\SYSTEM\MMMD.DLL
    O18 - Filter: text/plain - {09EFCAC0-197C-11DA-A0A6-00112D445672} - C:\WINDOWS\SYSTEM\MMMD.DLL
     
    Aras88, Sep 2, 2005
    #17
  18. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Sori, mun moka.

    Tees näin:

    Käynnistyksen yhteydessä pidä pohjassa F8-näppäintä, kunnes tulee käynnistysvalikko. Valitse siitä vikasietotila.

    Poista vikasietotilassa seuraavat tiedostot:

    C:\WINDOWS\TEMP\==>SE.DLL<==
    C:\WINDOWS\SYSTEM\==>outpostupdate.exe<==
    C:\WINDOWS\SYSTEM\==>MMMD.DLL<==

    Ja fixaa hijackthisillä, kuten äsken:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\se.dll/space.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
    O2 - BHO: (no name) - {09EFCAC1-197C-11DA-A0A6-00114208F3E9} - C:\WINDOWS\SYSTEM\MMMD.DLL
    O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
    O18 - Filter: text/html - {09EFCAC0-197C-11DA-A0A6-00112D445672} - C:\WINDOWS\SYSTEM\MMMD.DLL
    O18 - Filter: text/plain - {09EFCAC0-197C-11DA-A0A6-00112D445672} - C:\WINDOWS\SYSTEM\MMMD.DLL

    Käynnistä uudestaan ja laita uusi loki.
     
    Last edited: Sep 2, 2005
    -kemisti-, Sep 2, 2005
    #18
  19. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    mä sain sen vikaseotilaan ja mä sain poistettua c:\windows\system\outpostupdate.exe mut niit kahta muuta en kyl löydänyt!?

    mitä nyt teen?
    ku mun pitäis se about:blank juttu saada pois :/
     
    Aras88, Sep 2, 2005
    #19
  20. Aras88

    Aras88 Regular member

    Joined:
    May 21, 2005
    Messages:
    114
    Likes Received:
    0
    Trophy Points:
    26
    Ai niin mun piti kertoo et ku mä siin hijack this ohjelmalla otan sen system scanin ja fixaan ne jotka sä ilmotit mulle. Ne kyl korjaantuu mut sit ku mä käynnistän uudelleen tietokoneen ja ku mä otan uudestaan sen scan jutun. Ne jutut on taas ilmestynyt ?:/
     
    Aras88, Sep 2, 2005
    #20
Page 1 of 2

Share This Page