Przekierowania w witrynie Google


(Kajko10) #1

Złączono Posta : 10.12.2007 (Pon) 18:04

Witam. Przekierowania w czasie odwiedzania witryny Google. Po wyszukaniu tematów w Googlach otwierają się stronki reklamowe, a nie znalezione przez witrynę.

Pozdrawiam kajko

Uwaga: Jak wklejasz loga to obejmuj go znacznikiem (tagiem) CODE lub QUOTE

Pozdrawiam Gutek2222


(Gutek) #2

usuń wpisy HJT

Użyj FixWareOut - http://downloads.subratam.org/Fixwareout.exe

Daj log z ComboFix


(Kajko10) #3

CODE Username "Imperator" - 2007-12-10 18:14:21 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

HKLM\SOFTWARE\~\Winlogon\ "System"="kdfjm.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

"nameserver"="85.255.115.45 85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{048B6076-D97B-4BDA-B20F-9491EC7A3DC4}

"nameserver"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{44C8C720-02AE-4758-8012-B2AFBBB6F90F}

"nameserver"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{761F71E0-A1FB-455D-B5BC-92CC092593ED}

"nameserver"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{7E6274FD-74C7-473B-AA95-869A7BF3648B}

"nameserver"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{806356A4-C86A-48AD-8424-9934A1196A67}

"nameserver"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{A7B99E96-D135-41EA-9116-11451CCC9309}

"nameserver"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{048B6076-D97B-4BDA-B20F-9491EC7A3DC4}

"DhcpNameServer"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{44C8C720-02AE-4758-8012-B2AFBBB6F90F}

"DhcpNameServer"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{806356A4-C86A-48AD-8424-9934A1196A67}

"DhcpNameServer"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{A7B99E96-D135-41EA-9116-11451CCC9309}

"DhcpNameServer"="85.255.115.45,85.255.112.110"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\interfaces{B73359C6-5B5B-4901-8250-BAD31B5456F4}

"DhcpNameServer"="85.255.115.45,85.255.112.110"

Pomyślnie opróżniono pamięć podręczną programu rozpoznawania nazw DNS.

System was rebooted successfully.

~~~~~ Postrun check

HKLM\SOFTWARE\~\Winlogon\ "system"=""

....

....

~~~~~ Misc files.

....

~~~~~ Checking for older varients.

....

~~~~~ Other

C:\WINDOWS\Temp\kdfjm.ren 72729 2007-06-13

~~~~~ Current runs (hklm hkcu "run" Keys Only)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup"

"nwiz"="nwiz.exe /install"

"SoundMan"="SOUNDMAN.EXE"

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe"

"HP Software Update"="\"C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe\""

"HP Component Manager"="\"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe\""

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe"

"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe"

"SunJavaUpdateSched"="\"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe\""

"iaxLite"="C:\Documents and Settings\Imperator\Pulpit\iaxLite.exe"

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"

"NvMediaCenter"="RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit"

"a-winpoet-service"="\"C:\Program Files\DialNet\winpppoverethernet.exe\""

@="\"C:\PROGRA~1\DialNet\FPLICE~1.EXE zhimakaimen//WINPOET_QUITTING_EVENT\""

"z-wrdialer"="\"C:\Program Files\DialNet\wrdialer.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"

"MSMSGS"="\"C:\Program Files\Messenger\msmsgs.exe\" /background"

"eyeBeam SIP Client"=""

"Gadu-Gadu"="\"C:\Program Files\Gadu-Gadu\gg.exe\" /tray"

"z-WrDialer"="C:\Program Files\DialNet\WrDialer.exe"

"AlcoholAutomount"="\"E:\Programy\Alkohol 120%\bebechy\Alcohol 120\axcmd.exe\" /automount"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater]

....

Hosts file was reset, If you use a custom hosts file please replace it...

~~~~~End report~~~~~ QUOTE

Złączono Posta : 10.12.2007 (Pon) 18:27

Wita. Użyłem FixWareOut, wyłączył , przeskanował, włączył. Nie wiem czy mam samodzielnie coś usuwać ??

Złączono Posta : 10.12.2007 (Pon) 18:29

Witam. Rozumiem że 9 wpisów "O17" mam usunąć ręcznie ???

Złączono Posta : 10.12.2007 (Pon) 18:37

Witam. ComboFix.exe nie jest prawidłową aplikacją systemu Win32. Otrzymuję taki komunikat w trakcie uruchamiania ComboFix, i nic się nie dzieje.

Pozdrawiam kajko

Złączono Posta : 10.12.2007 (Pon) 18:46

CODE ComboFix 07-12-09.1 - Imperator 2007-12-10 18:42:06.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.626 [GMT 1:00]

Running from: E:\Pliki z Menadżera\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Program Files\myglobalsearch

C:\Program Files\myglobalsearch\bar\History\search

C:\WINDOWS\hosts

.

((((((((((((((((((((((((( Files Created from 2007-11-10 to 2007-12-10 )))))))))))))))))))))))))))))))

.

2007-12-10 17:17 . 2007-12-10 17:17

2007-12-06 22:24 . 2007-12-06 22:47

2007-12-06 22:24 . 2007-12-10 18:15

2007-12-05 18:59 . 2007-12-05 18:59 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll

2007-11-29 20:18 . 2007-12-04 19:23

2007-11-26 16:30 . 2007-11-26 16:30

2007-11-26 15:57 . 2007-11-26 15:57 360 --a------ C:\drmHeader.bin

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-10 17:16 --------- d-----w C:\Program Files\DialNet

2007-12-10 11:57 --------- d-----w C:\Documents and Settings\Imperator\Dane aplikacji\Programer

2007-12-08 21:14 --------- d-----w C:\Documents and Settings\Imperator\Dane aplikacji\GanymedeNet

2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-12-03 16:59 --------- d-----w C:\Documents and Settings\Imperator\Dane aplikacji\Skype

2007-11-24 18:17 --------- d-----w C:\Documents and Settings\Imperator\Dane aplikacji\Ahead

2007-11-20 16:34 --------- d-----w C:\Program Files\Ganymede

2007-11-10 16:45 23,008 ----a-w C:\Documents and Settings\Imperator\Dane aplikacji\GDIPFONTCACHEV1.DAT

2007-11-02 17:20 --------- d-----w C:\Program Files\Zylom Games

2007-11-02 17:20 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Zylom

2007-10-31 18:19 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP

2007-10-24 19:55 --------- d-----w C:\Program Files\City Interactive

2007-10-24 16:41 --------- d-----w C:\Program Files\Java

2007-10-14 15:18 4,608 ----a-w C:\WINDOWS\system32\w95inf32.dll

2007-10-14 15:03 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-10-14 15:03 --------- d-----w C:\Program Files\LEGO Media

2007-10-11 18:30 --------- d-----w C:\Program Files\DivX

2007-10-04 18:33 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll

2007-09-27 09:26 740,442 ----a-w C:\WINDOWS\system32\DivX.dll

2007-09-27 09:26 167,936 ----a-w C:\WINDOWS\system32\ts.dll

2007-09-27 09:26 1,559,040 ----a-w C:\WINDOWS\system32\xvidcore.dll

2007-09-27 09:25 79,360 ----a-w C:\WINDOWS\system32\mkzlib.dll

2007-09-27 09:25 23,552 ----a-w C:\WINDOWS\system32\mkunicode.dll

2007-09-27 09:25 151,040 ----a-w C:\WINDOWS\system32\mkx.dll

2007-09-27 09:25 142,848 ----a-w C:\WINDOWS\system32\mp4.dll

2007-01-22 12:40 36 ----a-w C:\Documents and Settings\Imperator\klextlock.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24]

"eyeBeam SIP Client"="" []

"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-05-10 15:36]

"z-WrDialer"="C:\Program Files\DialNet\WrDialer.exe" [2007-01-18 12:18]

"AlcoholAutomount"="E:\Programy\Alkohol 120%\bebechy\Alcohol 120\axcmd.exe" [2007-07-02 11:29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]

"nwiz"="nwiz.exe" [2007-04-19 12:26 C:\WINDOWS\system32\nwiz.exe]

"SoundMan"="SOUNDMAN.EXE" [2005-06-20 14:42 C:\WINDOWS\SOUNDMAN.EXE]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]

"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 11:24]

"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 14:18]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 14:43]

"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 18:37]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]

"iaxLite"="C:\Documents and Settings\Imperator\Pulpit\iaxLite.exe" []

"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40]

"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe]

"a-winpoet-service"="C:\Program Files\DialNet\winpppoverethernet.exe" [2007-01-18 09:26]

"z-wrdialer"="C:\Program Files\DialNet\wrdialer.exe" [2007-01-18 12:18]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:44]

R2 TopWinPoETDriver;WinPoET PPPoE Optimized Driver;C:\WINDOWS\system32\DRIVERS\WrKPoET2000.sys

R3 dsnpfd;DeskSoft Service;C:\WINDOWS\system32\DRIVERS\dsnpfd.sys

R3 FPD;Fine Point Packet Service;\??\C:\WINDOWS\system32\drivers\fpd.sys

R3 WrKPoET2000;WrKPoET2000;\??\C:\Program Files\DialNet\WrKPoET2000.sys

R3 WRSWanDD;WinPoET PPPoE Adapter;C:\WINDOWS\system32\DRIVERS\WrKPoETNic2000.sys

S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys

S3 k510bus;Sony Ericsson K510 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\k510bus.sys

*Newly Created Service* - CATCHME

*Newly Created Service* - PROCEXP90

.

**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-10 18:43:27

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-12-10 18:43:51

.

--- E O F --- QUOTE

pROSZę LOG Z cOMOfIX

Złączono Posta : 10.12.2007 (Pon) 18:49

Witam. Ściągnąłem ComboFix z innej lokalizacji i zadziałał. Log powyżej !!

Pozdrawiam kajko

Złączono Posta : 10.12.2007 (Pon) 18:51

Witam i czekam na dalszą POMOC !!

Pozdrawiam kajko.


(Gutek) #4

Czyszczenie rejestru:

RegCleaner - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=177

możesz rejestr przelecieć albo

jv16 PowerTools - http://www.dobreprogramy.pl/index.php?dz=2&t=29&id=509