Podmieniające się stronki...
26 Lut 2007, 16:32
Witajcie. Mam problem. Jak wchodze do google wpisuje jakas stronka to mi ją podmienia na jakąś xxx(porno). Komputer czysty- przeskanowałem antyvirem. Tu macie logi:
Logfile of HijackThis v1.99.1
Scan saved at 00:41:01, on 2002-04-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAVPersonalAVWUPSRV.EXE
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindService.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesJavajre1.5.0_07injusched.exe
C:Program FilesHPHP Software UpdateHPWuSchd2.exe
C:Program FilesDAEMON Toolsdaemon.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32WgaTray.exe
C:Program FilesHPDigital Imaginginhpqtra08.exe
C:Program FilesHPDigital ImaginginhpqSTE08.exe
C:Program FilesHPDigital ImagingProduct Assistantinhprblog.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32wuauclt.exe
C:Documents and SettingsXPulpitFolder PawłaHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://szukaj.wp.pl
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:PROGRA~1NEOSTR~1SEARCH~1.DLL (file missing)
O1 - Hosts: 217.96.35.130 auto.search.msn.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_07inssv.dll
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 - HKLM..Run: [System32] "user32.exe" -user
O4 - HKLM..Run: [WebServ] C:Program FilesWebServWebServ.exe -winstart
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_07injusched.exe
O4 - HKLM..Run: [HP Software Update] C:Program FilesHPHP Software UpdateHPWuSchd2.exe
O4 - HKLM..Run: [DAEMON Tools] "C:Program FilesDAEMON Toolsdaemon.exe" -lang 1033
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imaginginhpqtra08.exe
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_07inssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O17 - HKLMSystemCCSServicesTcpip..{72B2D327-78CB-4F35-8EBD-DFD93757D255}: NameServer = 85.255.116.40,85.255.112.115
O17 - HKLMSystemCCSServicesTcpip..{802AA9EC-954D-4760-91A0-14918E5FD660}: NameServer = 85.255.116.40,85.255.112.115
O17 - HKLMSystemCS1ServicesTcpipParameters: NameServer = 85.255.116.40 85.255.112.115
O17 - HKLMSystemCCSServicesTcpipParameters: NameServer = 85.255.116.40 85.255.112.115
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:Program FilesAVPersonalAVWUPSRV.EXE
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindService.exe
Prosze o pomoc. Z góry dzienki.
Logfile of HijackThis v1.99.1
Scan saved at 00:41:01, on 2002-04-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAVPersonalAVWUPSRV.EXE
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindService.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:Program FilesJavajre1.5.0_07injusched.exe
C:Program FilesHPHP Software UpdateHPWuSchd2.exe
C:Program FilesDAEMON Toolsdaemon.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32WgaTray.exe
C:Program FilesHPDigital Imaginginhpqtra08.exe
C:Program FilesHPDigital ImaginginhpqSTE08.exe
C:Program FilesHPDigital ImagingProduct Assistantinhprblog.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:WINDOWSsystem32wuauclt.exe
C:Documents and SettingsXPulpitFolder PawłaHijackThis.exe
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://szukaj.wp.pl
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl/
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:PROGRA~1NEOSTR~1SEARCH~1.DLL (file missing)
O1 - Hosts: 217.96.35.130 auto.search.msn.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_07inssv.dll
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 - HKLM..Run: [System32] "user32.exe" -user
O4 - HKLM..Run: [WebServ] C:Program FilesWebServWebServ.exe -winstart
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_07injusched.exe
O4 - HKLM..Run: [HP Software Update] C:Program FilesHPHP Software UpdateHPWuSchd2.exe
O4 - HKLM..Run: [DAEMON Tools] "C:Program FilesDAEMON Toolsdaemon.exe" -lang 1033
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..Run: [Skype] "C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imaginginhpqtra08.exe
O8 - Extra context menu item: &Search - http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_07inssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_07inssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:PROGRA~1MICROS~2OFFICE11REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O17 - HKLMSystemCCSServicesTcpip..{72B2D327-78CB-4F35-8EBD-DFD93757D255}: NameServer = 85.255.116.40,85.255.112.115
O17 - HKLMSystemCCSServicesTcpip..{802AA9EC-954D-4760-91A0-14918E5FD660}: NameServer = 85.255.116.40,85.255.112.115
O17 - HKLMSystemCS1ServicesTcpipParameters: NameServer = 85.255.116.40 85.255.112.115
O17 - HKLMSystemCCSServicesTcpipParameters: NameServer = 85.255.116.40 85.255.112.115
O20 - Winlogon Notify: WgaLogon - C:WINDOWSSYSTEM32WgaLogon.dll
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:Program FilesAVPersonalAVWUPSRV.EXE
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:Program FilesAlcohol SoftAlcohol 120StarWindStarWindService.exe
Prosze o pomoc. Z góry dzienki.
08 Mar 2007, 00:19
antywirusem tego nie znajdziesz
trojan -u mnie podszywal sie pod przegladarke o tej samej nazwie a sciagnalem go razem z filmikiem z emule (filmika nie mozna bylo usunac wiec wiedzialem gdzie go szukac)
lub w windows-> system 32 zainstalowal sie maly szpieg posortuj wedlug daty to moze cos znajdziesz
ale to tylko dorazna pomoc na bardziej szczegolowa musisz poczekac na starszych kolegow pozdrowienia
trojan -u mnie podszywal sie pod przegladarke o tej samej nazwie a sciagnalem go razem z filmikiem z emule (filmika nie mozna bylo usunac wiec wiedzialem gdzie go szukac)
lub w windows-> system 32 zainstalowal sie maly szpieg posortuj wedlug daty to moze cos znajdziesz
ale to tylko dorazna pomoc na bardziej szczegolowa musisz poczekac na starszych kolegow pozdrowienia
12 Mar 2007, 14:36
Chyba jednak komp nie jest czysty,sprobuj skanowac SpyBot Search and Destroy,zrob tez skan online Kasperem albo F-Securem,Antyvir moze go nie widziec 
W pierwszej kolejnosci postawilbym jednak na skanowanie Spybotem,daj znac jak ci poszlo
W pierwszej kolejnosci postawilbym jednak na skanowanie Spybotem,daj znac jak ci poszlo