Virus - Netsky

Lad os kigge på den;)
Følg denne anvisning punkt 1-4 http://www.spywarefri.dk/hjtanv.htm resultatet skal du kopiere ind i denne tråd

Hej Mischel

Nej den enste info jeg også kan finde på McAfee er her:
(http://vil.nai.com/vil/content/v_122190.htm)

Prøv at kigge på et andet McAfee program: AVERT Stinger
(www.mcafee.dk/stinger)

PT: løser den alle varianter af bl.a. Netsky, men husk at lade den gennemsøge alle drev.

Håber at dette kan være en hjælp.

Mvh. Claus

Info om din Virus

Hej Mischel

Glem lige den sidste linie "Info om din Virus", den kom ind ved en fejl, og nåede ikke at blive fjernet.

Mvh. Claus

Hej!

Spybot og Stinger kender jeg godt og har lige endnu en gang skannet computeren med netop disse programmer. Men det har ikke hjulpet på problemet - desværre.

Jeg vil gerne prøve HijackThis, men det må lige vente et par dage, da jeg er optaget. Jeg vender tilbage...

Hej Mischel

Har desværre ikke lige haft tid at se dit indlæg før nu, men jeg har lige et spørgsmål til dig.

Undskyld, men hvilken version af McAfee Anti-Virus benytter du, for det lyder som om at den ikke er sat til at gennemsøge din indbakke i dine mails, da det jo er en email virus.

Det kunne lyde lidt som om at du benytter version 4.51 eller tilsvarende, og at du kun har kørt en standard installation (Her er hverken MAPI eller POP3 slået til pr. default)

Derfor vil jeg råde dig til, hvis du benytter denne version, til at gennemgå din Anti-Virus opsætning.

Det kan du lettest gøre ved at højreklikke på McAfee skjoldet og vælge "properties" og så kan du jo starte med "System scan".

Under System Scan skal følgende som minimum være slået til for ordentlig beskyttelse.
Enable System scan (Inbound.., Outbound), scan floppies (Acces, shutdown), what to scan (minimum: default files (helst all files), compressed files), klik nu på advanced og slå enable macro and program file heuristics scanning.

Under E-Mail scan skal følgende være slået til: Enable scanning of e-mail attachments, Enable corporate mail (Microsoft exchange (mapi)), Internet mail, All attachments, compressed files,  klik nu på advanced og slå enable macro and program file heuristics scanning.

Under download scanning, Enable Internet download scanning, All files, scan compressed files, klik nu på advanced og slå enable macro and program file heuristics scanning.

Du kan evt. også slå Internet filter til.

Når du er færdig så tryk OK. Det er tilrådeligt at genstarte computeren.

NB!!!: Denne "guide" gælder kun for version 4.51, hvis du har en anden så send det lige i et indlæg, og jeg skal prøve at guide dig igennem.

NB!!!: Husk altid at køre med opdateret DAT og engine (PT. DAT 4415 og Engine 4.4.20 til Windows), samt opdateret Stinger (PT. version 2.4.6)

Håber at dette kunne være dig en hjælp

Mvh. Claus

Hej!

Jeg bruger; McAfee Security 6 - 2004. Har ellers været inde og pille i de forskellige indstillinger, men er ikke 100 % fortrolig med hele Security pakken. Men, jeg må hellere se at få den opdateret til 2005 modellen, da den vist trænger. ;-)

Ja, jeg får virusbefængte mails, men dem sletter mit spamkiller- og antivirusprogram jo, renser computeren og fortæller at det var: W32/Netsky.b.eml!exe. Men næste DAG jeg starter den op sker det samme igen én gang den dag. Næste nye dag sker det samme igen... Virussen må være tidsbestemt og ligge i start op... ? Computeren bliver tilsyneladende ikke rigtig renset!

Hej!


Jeg har kørt spybot, og den fandt ingen ting.

Her neden under er HijackThis loggen:


Logfile of HijackThis v1.99.0
Scan saved at 01:54:29, on 24-12-2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Programmer\Orme\Avast 4 home\aswUpdSv.exe
C:\Programmer\Orme\Avast 4 home\ashServ.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Programmer\Orme\Avast 4 home\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\McAfee\McAfee Privacy Service\GUARDDOG.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\Spionering\PestPatrol\PestPatrol\PPControl.exe
C:\Programmer\Spionering\PestPatrol\PestPatrol\PPMemCheck.exe
C:\Programmer\Spionering\PestPatrol\PestPatrol\CookiePatrol.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Programmer\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\WINDOWS\essspk.exe
C:\Programmer\popupkiller\aiepk.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\Orme\AVAST4~1\ashDisp.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\PROGRA~1\ICQ\2003B~1\ICQ\ICQ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Paltalk\PalTalk 2004\pnetaware.exe
C:\Programmer\Microsoft Office\Office10\msoffice.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Yahoo messenger\5,5\Messenger\YPager.exe
C:\Programmer\Outlook Express\Msimn.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskClnt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Documents and Settings\Henny Lund\Skrivebord\HijackThis\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/ymsgr/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fyn.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://rd.yahoo.com/customize/ymsgr/defaults/*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/customize/ymsgr/defaults/su/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/ymsgr/defaults/sp/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fyn.dk
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.opasia.dk/msie_search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/ymsgr/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPIONE~1\WINSOC~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Programmer\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Programmer\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O3 - Toolbar: (no name) - {2ECB7FB2-0333-416F-92FD-4904AD49252B} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Programmer\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: ydrththkquv - {0047aac8-dc74-4d6e-a8d6-fed065f06fb6} - C:\DOCUME~1\HENNYL~1\APPLIC~1\iytblbresh.dll (file missing)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programmer\Spionering\PestPatrol\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programmer\Spionering\PestPatrol\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programmer\Spionering\PestPatrol\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [McAfee Guardian] C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe /SU
O4 - HKLM\..\Run: [KeyPatrol] C:\Programmer\PestPatrol\KeyPatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [mmtask] C:\Programmer\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\2003B~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [aiepk] C:\Programmer\popupkiller\aiepk.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Orme\AVAST4~1\ashDisp.exe
O4 - HKCU\..\Run: [BeamsOfLight screen saver] "C:\Programmer\BeamsofLight\Screen Saver\TaskTray.exe"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [RoboForm] "C:\Programmer\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PalNetaware.lnk = C:\Programmer\Paltalk\PalTalk 2004\pnetaware.exe
O4 - Global Startup: 3DNA Desktop.lnk = C:\Programmer\Tegneprogram\3Dprogram\3DNA\Resources\3dnasys.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Gem &formularer &[ - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Tilpas RF menu - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Udfyld formularer &] - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Udfyld - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Udfyld formularer &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Gem - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Gem &formularer &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\2003B~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\2003B~1\ICQ\ICQ.exe
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF værktøjslinie &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Programmer\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Privacy Bar - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Programmer\McAfee\McAfee Privacy Service\GDIEHELP.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.msn.dk
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) -
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) -
O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.trojanscan.com/trojanscan/TDECntrl.CAB
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-gb/4,0,0,76/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/SDROP_Installer.exe
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/virusinfo/webscan.cab
O16 - DPF: {8602608F-EECD-471F-9D3E-7638F332154E} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-1103.exe
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs7b.instantservice.com/jars/customerxsigned33.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi_0727.dll
O16 - DPF: {A590956F-AE99-4419-BB39-3C721276C625} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0504.exe
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.com/oas/ActiveX/FileXfer.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4407/mcfscan.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_0_2_7.cab
O16 - DPF: {F9408298-9658-482C-8B02-93F09A80225F} (Util Class) - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-0104.exe
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Programmer\Orme\Avast 4 home\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Programmer\Orme\Avast 4 home\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmer\Orme\Avast 4 home\ashMaiSv.exe
O23 - Service: McAfee Privacy Service - Network Associates, Inc. - C:\Programmer\McAfee\McAfee Privacy Service\GUARDDOG.EXE
O23 - Service: McAfee Firewall - Network Associates, Inc. - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee SpamKiller Server - Networks Associates Technology. Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe

Hej!

Jeg hører ikke noget fra nogen! - Holder i ferie?  :-)