Podejrzewam infekcję. Pojawiające i zamykające się okna przeglądarki. Próba otwarcia adresu 0.0.2.128?

vandalizmo · 11 Styczeń 2014 19:25

Hej,

komp mi się trochę dziwnie zachowuje.

Kilka razy przyłapałem Firefoxa na otwieraniu okien, które automatycznie się zamykały oraz przed chwilą Chrome (domyślna przeglądarka) miał jedną z kart otwartą na dziwacznym adresie 0.0.2.128.

Raz też się zdarzyło, że nie mogłem w ogóle pisać w żadnym oknie. Dopiero po zamknięciu wszystkich programów i odpaleniu od nowa było ok.

Firefox - powyłączane wszystkie pluginy oprócz Flash. Rozszerzenia: AdBlock, NoScript, Ghostery, BetterPrivacy, RefreshBlocker - z takich o bezpieczeństwie. Bardziej podejrzane strony na dodatek odpalam profilem skonfigurowanym z Sandboxie.

Chrome - w sumie tylko AdBlock.

Chrome jest co prawda domyślną przeglądarką ale dlatego, że mam Firefoxa z profilami i aplikacje desktopowe nie radzą sobie z otwieraniem linków przy takiej konfiguracji.

Pozatym niby wszstko jest ok. Nie zanotowałem jakiegoś większego zawieszania czy obciążenia podczas pracy.

Normalnie nie używam antywirusa, ale teraz na szybko zinastalowałem Avasta - niby jest czysto.

System Win 7 x64 Pro zainstalowany na laptopie.

Pozdrawiam i z góry dzięki za pomoc

OTL

http://www.wklej.org/id/1232788/

OTL Extras

http://www.wklej.org/id/1232789/

krzych5610 · 11 Styczeń 2014 20:17

Pobierz na pulpit i uruchom AdwCleaner - http://www.dobreprog…dows,38865.html

Wykonaj polecenia szukaj i usuń.

Pobierz na pulpit skaner RogueKiller ( Wszystkie wersje 64bit ) http://www.dobreprog…dows,39028.html

Wykonaj polecenia: skanuj, usuń, naprawa Hosts. Pokaż raporty.

Przygotuj nowy raport OTL.txt.

vandalizmo · 11 Styczeń 2014 21:08

AdwCleaner

Szukaj

http://www.wklej.org/id/1232924/

Usun

http://www.wklej.org/id/1232927/

RogueKiller

Usuń

http://www.wklej.org/id/1232922/

OTL

http://www.wklej.org/id/1232928/

krzych5610 · 11 Styczeń 2014 22:22

Uruchom OTL. W okno wklej podany tekst:

:OTL [2013-11-22 10:36:13 | 002,212,154 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\firebug@software.joehewitt.com.xpi [2013-09-10 21:25:00 | 000,084,201 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\FirePHPExtension-Build@firephp.org.xpi [2013-09-10 21:25:00 | 000,116,414 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\firequery@binaryage.com.xpi [2013-03-16 13:14:01 | 000,008,026 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\formfox@daniel.steinbrook.xpi [2013-03-10 03:53:00 | 000,021,763 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\locationbar2@design-noir.de.xpi [2013-09-11 09:31:43 | 000,021,258 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\selenium_ide_buttons@egarracingteam.com.ar.xpi [2013-11-14 14:46:00 | 000,664,293 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\uriloader@pdf.js.xpi [2013-12-28 10:18:21 | 000,179,023 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions{477c4c36-24eb-11da-94d4-00e08161165f}.xpi [2014-01-05 14:00:31 | 000,535,529 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-09-19 08:03:49 | 000,720,667 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions{a6fd85ed-e919-4a43-a5af-8da18bda539f}.xpi [2013-11-26 19:22:57 | 000,869,218 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2013-05-06 14:27:10 | 001,360,435 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions{c45c406e-ab73-11d8-be73-000a95be3b12}.xpi [2014-01-10 08:15:48 | 000,536,010 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\4pbbogpc.dev\extensions\staged{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-06-18 06:56:41 | 000,123,385 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\elemhidehelper@adblockplus.org.xpi [2013-06-27 12:31:05 | 000,027,050 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\feedly@devhd.xpi [2013-11-06 17:00:53 | 001,338,622 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\firefox@ghostery.com.xpi [2013-03-16 13:17:04 | 000,008,026 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\formfox@daniel.steinbrook.xpi [2013-08-14 11:31:04 | 000,004,671 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\jid0-XWJxt5VvCXkKzQK99PhZqAn7Xbg@jetpack.xpi [2013-03-09 16:06:03 | 000,021,763 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\locationbar2@design-noir.de.xpi [2013-03-16 13:07:18 | 000,006,283 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\secureornot@tiptt.blogspot.com.xpi [2013-05-09 21:41:49 | 000,003,597 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions\smart-referer@meh.paranoid.pk.xpi [2013-03-14 16:26:04 | 000,008,893 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions{55ce2530-61df-4ddc-b287-feae64e70575}.xpi [2014-01-10 11:28:36 | 000,536,010 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-11-21 07:33:45 | 000,869,218 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2013-10-10 08:39:36 | 000,915,554 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-03-16 13:19:07 | 000,138,614 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-12-15 19:40:49 | 000,287,503 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\8z5ek3ld.default\extensions{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-03-16 13:25:47 | 000,008,010 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions\jid0-XWJxt5VvCXkKzQK99PhZqAn7Xbg@jetpack.xpi [2013-03-16 11:01:07 | 000,021,763 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions\locationbar2@design-noir.de.xpi [2013-04-11 10:36:05 | 000,003,274 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions\smart-referer@meh.paranoid.pk.xpi [2013-03-16 11:00:21 | 000,008,893 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions{55ce2530-61df-4ddc-b287-feae64e70575}.xpi [2013-04-15 08:10:06 | 000,531,916 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-03-16 10:59:43 | 000,817,280 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-03-16 13:26:26 | 000,138,614 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\ahjaucqj.sandbox\extensions{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-07-26 21:21:42 | 000,123,385 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\elemhidehelper@adblockplus.org.xpi [2013-07-26 21:19:47 | 000,008,026 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\formfox@daniel.steinbrook.xpi [2013-10-10 08:23:38 | 000,004,671 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\jid0-XWJxt5VvCXkKzQK99PhZqAn7Xbg@jetpack.xpi [2013-07-26 21:22:38 | 000,021,763 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\locationbar2@design-noir.de.xpi [2013-07-26 21:26:39 | 000,006,283 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\secureornot@tiptt.blogspot.com.xpi [2013-07-26 16:17:08 | 000,363,136 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\sendtokindle@amazon.com.xpi [2013-07-26 21:20:20 | 000,008,893 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions{55ce2530-61df-4ddc-b287-feae64e70575}.xpi [2013-07-26 21:15:11 | 000,534,063 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-07-26 21:24:49 | 000,868,738 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi [2013-10-10 08:23:45 | 000,915,554 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-26 21:18:58 | 000,138,614 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-10-10 08:23:50 | 001,314,979 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\staged\firefox@ghostery.com.xpi [2013-10-10 08:23:40 | 000,534,789 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\epc21vtw.qwe\extensions\staged{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-11 09:42:33 | 000,536,010 | ---- | M] () (No name found) – C:\Users\ppaw\AppData\Roaming\mozilla\firefox\profiles\i5gv0jtj.sec\extensions{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi O4 - HKLM…\Run: [AdobeCS5.5ServiceManager] “C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe” -launchedbylogin File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-2851395884-3016128024-700621859-1005…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O33 - MountPoints2{bff32e2f-3987-11e3-9cd5-5cac4cd22ea0}\Shell - “” = AutoRun O33 - MountPoints2{bff32e2f-3987-11e3-9cd5-5cac4cd22ea0}\Shell\AutoRun\command - “” = “I:\WD Drive Unlock.exe” autoplay=true :files C:\AdwCleaner C:\0efe984b69aafe3959354595709848 C:\Windows\tasks\GoogleUpdateTaskMachineCore.job C:\Windows\tasks\GoogleUpdateTaskMachineUA.job :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [EMPTYTEMP] Uruchom polecenie “wykonaj skrypt”. Po restarcie wykonaj polecenie sprzątanie.