Logi - google przekierowuje na inne strony reklamowe

**Posty:** 3 · przez **pawko87** 07 Wrz 2008, 20:37

Proszę o sprawdzenie loga.
Przekierowują mi się pierwsze 2-4 pierwsze linki z google, na jakieś dziwne strony (nie porno

) zarówno w Mozilli jak i w IE.

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 12:27:41, on 2008-09-06 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Microsoft SQL Server\MSSQL$AIGSQLSKLEP\Binn\sqlservr.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Spyware Terminator\sp_rsser.exe C:\Program Files\Neostrada TP\neostradatp.exe C:\Program Files\Neostrada TP\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\Neostrada TP\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Konnekt\konnekt.exe C:\Program Files\Internet Explorer\Iexplore.exe C:\Documents and Settings\Andrzej\Pulpit\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [NodLogin] C:\Program Files\Eset\nodlogin.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1210316679921 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1210316946015 O17 - HKLM\System\CCS\Services\Tcpip\..\{2BCC992D-8E66-4240-9E57-B9A0D4E1C688}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{2BCC992D-8E66-4240-9E57-B9A0D4E1C688}: NameServer = 194.204.159.1 217.98.63.164 O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe -- End of file - 6332 bytes

**Posty:** 8001 · przez **Okocza** 07 Wrz 2008, 20:38

pawko87, zmień nazwę tematu i wklej log z combofixa

**Posty:** 684 · przez **djarta** 08 Wrz 2008, 08:30

Log wygląda na czysty.

Ściągnij -----> ComboFixa,przeskanuj daj log.

=========================================
K.

**Posty:** 3 · przez **pawko87** 08 Wrz 2008, 09:14

Kod: Zaznacz wszystko: ComboFix 08-09-05.05 - Andrzej 2008-09-08 9:07:40.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.238 [GMT 2:00] Running from: C:\Documents and Settings\Andrzej\Pulpit\ComboFix.exe * Created a new restore point * Resident AV is active [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\tdssinit.dll C:\WINDOWS\system32\tdssl.dll C:\WINDOWS\system32\tdsslog.dll C:\WINDOWS\system32\tdssmain.dll C:\WINDOWS\system32\tdssserf.dll C:\WINDOWS\system32\tdssservers.dat . ((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 ))))))))))))))))))))))))))))))) . 2008-09-06 11:06 . 2008-09-06 11:12 <DIR> d-------- C:\Program Files\Spyware Terminator 2008-09-06 11:06 . 2008-09-06 11:06 <DIR> d-------- C:\Documents and Settings\Andrzej\Dane aplikacji\Spyware Terminator 2008-09-06 11:06 . 2008-09-06 11:12 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spyware Terminator 2008-09-06 11:06 . 2008-09-06 11:06 141,312 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-09-06 10:18 . 2008-09-06 10:18 <DIR> d-------- C:\Program Files\SkanerOnline 2008-09-05 14:46 . 2008-09-05 14:46 <DIR> d-------- C:\Program Files\Lavasoft 2008-09-05 14:46 . 2008-09-05 14:46 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-09-05 14:46 . 2008-09-05 14:57 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Lavasoft 2008-09-05 14:25 . 2008-09-05 14:38 <DIR> d-------- C:\Program Files\Spyware Doctor 2008-09-05 14:25 . 2008-09-05 14:25 <DIR> d-------- C:\Documents and Settings\Andrzej\Dane aplikacji\PC Tools 2008-09-05 14:25 . 2008-09-05 14:45 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-09-05 14:25 . 2008-06-10 21:22 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-09-05 14:25 . 2008-06-02 15:19 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-09-05 14:25 . 2008-06-02 15:19 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-09-05 14:25 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-09-05 14:01 . 2008-09-05 14:03 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-09-05 14:01 . 2008-09-05 14:02 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-08-29 10:31 . 2008-04-14 19:20 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-08-29 10:23 . 2008-08-29 10:23 <DIR> d-------- C:\WINDOWS\system32\pl 2008-08-29 10:23 . 2008-08-29 10:23 <DIR> d-------- C:\WINDOWS\system32\bits 2008-08-29 10:23 . 2008-08-29 10:23 <DIR> d-------- C:\WINDOWS\l2schemas 2008-08-29 10:20 . 2008-08-29 10:20 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2008-08-29 10:12 . 2008-08-29 10:12 <DIR> d-------- C:\WINDOWS\EHome 2008-08-29 10:00 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys 2008-08-29 09:58 . 2004-08-04 00:35 327,040 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys 2008-08-13 09:05 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-08 07:07 --------- d-----w C:\Program Files\Neostrada TP 2008-09-04 07:35 --------- d-----w C:\Program Files\ESET 2008-08-09 08:03 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2008-08-09 08:03 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2008-08-09 08:03 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2008-07-28 07:29 --------- d-----w C:\Program Files\Konnekt 2008-07-23 13:49 --------- d-----w C:\Documents and Settings\Andrzej\Dane aplikacji\AdobeUM 2008-07-23 07:03 --------- d-----w C:\Program Files\Common Files\Adobe 2008-07-21 13:34 --------- d-----w C:\Program Files\Java Web Start 2008-07-21 10:54 33 ----a-w C:\WINDOWS\system32\drivers\adidsl.cfg 2008-07-21 10:54 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-21 10:54 --------- d-----w C:\Program Files\SAGEM 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-16 09:09 --------- d-----w C:\Program Files\Java 2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 16:42 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2004-08-23 20480] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-08-09 949376] "NodLogin"="C:\Program Files\Eset\nodlogin.exe" [2008-07-29 358448] "SoundMan"="SOUNDMAN.EXE" [2002-08-15 C:\WINDOWS\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-07-21 839680] Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= R2 MSSQL$AIGSQLSKLEP;MSSQL$AIGSQLSKLEP;C:\Program Files\Microsoft SQL Server\MSSQL$AIGSQLSKLEP\Binn\sqlservr.exe [2002-12-17 7520337] R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-09-19 116992] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-09-15 64000] S3 SQLAgent$AIGSQLSKLEP;SQLAgent$AIGSQLSKLEP;C:\Program Files\Microsoft SQL Server\MSSQL$AIGSQLSKLEP\Binn\sqlagent.EXE [2002-12-17 311872] *Newly Created Service* - PROCEXP90 . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Andrzej\Dane aplikacji\Mozilla\Firefox\Profiles\ecelld7h.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://wp.pl FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll FF -: plugin - C:\Program Files\Java\j2re1.4.0_03\bin\NPOJI610.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-08 09:09:50 Windows 5.1.2600 Dodatek Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv] "imagepath"="\systemroot\system32\drivers\TDSSserv.sys" . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\WINDOWS\system32\Ati2evxx.dll PROCESS: C:\WINDOWS\system32\lsass.exe -> C:\Program Files\Eset\pr_imon.dll . Completion time: 2008-09-08 9:11:14 ComboFix-quarantined-files.txt 2008-09-08 07:11:11 Pre-Run: 24,504,836,096 bajtów wolnych Post-Run: 24,675,975,168 bajtów wolnych 141 --- E O F --- 2008-08-30 08:11:08

**Posty:** 684 · przez **djarta** 08 Wrz 2008, 13:12

Ten log też jest czysty.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=================================
K.

**Posty:** 3 · przez **pawko87** 10 Wrz 2008, 09:03

Problem zniknął

dzięki wszystkim za pomoc.