vroča stran, ponovno
Zdravo!
hvala vsem, ki ste mi že pomagali, ker se mi ob vklopu računalnika pokaže porno stran. Pridno sem sledila vašim navodilom, najprej AD- awware, inštalirala,snenirla, pokazalo kar nekaj napak, mi je potem uspešno po pritisku select all…delete izbrisalo.
Problem je v tem, da se mi še vedno po prižigu pokaže ta stran.
PROSIM ŠE ZA KAKŠNE NASVETE in če lahko natančno napišete kaj naj pritisnem.
100x hvala!
Normalno, da se ti samodejno prikazuje vroča stran. Tisti, ki so ti svetovali uporabo AdAware namreč ne vedo, da le-ta le redko pomaga pri tovrstnih problemih.
S skoraj vsemi zapleti okrog odpiranja in uporabe browserja namreč najbolj elegantno opravi programček Hijack This, s katerim napraviš scan in enostavno zbrišeš sumljive vrstice, ki se nanašajo na neznane ali sex strani.
Ni ravno res, da Ad Aware pomaga le redko, res pa je, da so novi in novi vsiljivci tako iznajdljivi, da je včasih resen problem odstraniti črvička.
Mogoče je še za poizkusiti ponovno čiščenje z AdAware orodjem, tokrat pa prej izklopi obnovitev sistema (Klikni z desno na Moj računalnik, izberi Lastnosti in v zavihku “Obnovitev sistema” onemogoči obnavljanje sistema na vseh pogonih).
Potem ponovi vajo, mogoče bo uspelo.
HiJackThis program pa dobiš tule:
Odzipaj ga in zaženi, izberi prvi gumb (nekaj podobega kot do a system scan and save a log file) na koncu se ti pokaže v notepadu (beležnici) spisek vseh tvojih težav in ne-težav v registru. Naredi copy vsega skupaj in prilepi sem, zgledalo bo približno takole:
Logfile of HijackThis v1.99.1
Scan saved at 11:14:14, on 27.4.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
c:\progra~1\mcafee\mcafee antispyware\massrv.exe
………
…….
…
Nekaj pametnih glavic iz tega foruma ti bo že vedelo svetovati, kaj označi in izbriši (tudi to počneš v hijack programu), obstajajo pa tudi prav v ta namen specializirani spletni svetovalci.
Srečno!
PS: da se ti to ne ponovi je potrebno nekoliko paziti:
najprej namesti vse Windows popravke (le ti se naj bi nameščali sproti, samodejno, če nimaš posodabljanja izklopljenega), namesti proitivirusne ščite, naslove dobiš tudi na tem forumu že večkrat napisane, na sumljivih straneh pa ne klikaj nobenih okenc OK, Cancel…
Ni pa zaradi tega potrebno paranoično bežati stran od strani z prijetno vsebino.
Torej težave postajajo vedno bolj zoprne, na začetku so se ti porno strani odpirale ob zagonu explorerja, sedaj praviš, da se ti že ob zagonu računalnika. Po tej informaciji sklepam, da se ti je naložil kakšen program. Poiščeš in zbrišeš ga z sistemskim Add or Remove Programs.
Ali si začela uporabljati brskalnik Mozilla oz. Opera?
Ne vem, doslej mi AdAware še ni uspel odpraviti težav z odpiranjem nezaželenih spletnih strani. Kadar pa gre za kakšen smotan toolbar ali search bar pa je povsem nemočen.
Sam v takih primerih prisegam na Hijacka, po izkušnjah pač. Lahko se tudi motim. Imel sem primere, ko se IE sploh ni hotel več odpreti, pa je Hijack takoj opravil z nesnago – na mojo željo seveda, ne pa kar avtomatično.
odpira se mi ta:
prvič sem ga pa zagnala, ko sem bila nekaj na
http://povezave.kopa.si, tam je ena tema spolnost, in naju je mal zanimalo kaj je tam
Jaz bi tudi prosila, če mi lahko kdo pove, kaj od tega so smeti, ker mi tudi nekaj nagaja in to reklame, ki se non-stop kažejo takoj ko priklopim internet – je prav nadležno. Poskusila sem že z ad-awarom, F-secure, pa mi nič pametnega ne pokaže. Za trojance mi javi sproti in tudi sproti brišem.
Lp in hvala
Logfile of HijackThis v1.99.1
Scan saved at 22:39:38, on 27.4.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Documents and Settings\anamarija\My Documents\vse kar se nalaga, podnapis\Winamp\winampa.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\doris\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.najdi.si/
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com
R1 – HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://de.search.yahoo.com
R1 – HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
R3 – URLSearchHook: ICQ Toolbar – {855F3B16-6D32-4fe6-8A56-BBB695989046} – C:\Program Files\ICQToolbar\toolbaru.dll
R3 – URLSearchHook: SweetIM For Internet Explorer – {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} – C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 – BHO: SWEETIE – {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} – C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 – BHO: Najdi.si – {442599A9-EB41-4F1F-B999-737BC587F314} – C:\Program Files\Noviforum\Najdi.si toolbar\NajdiSiToolbar.1.dll
O2 – BHO: Need2Find Bar BHO – {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} – C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL
O2 – BHO: Google Toolbar Helper – {AA58ED58-01DD-4d91-8333-CF10577473F7} – c:\program files\google\googletoolbar1.dll
O2 – BHO: (no name) – {C8FC0613-AE44-FCD7-8025-9A2FDDC41C15} – C:\DOCUME~1\doris\APPLIC~1\MULTIP~1\Chin thunk.exe (file missing)
O3 – Toolbar: ICQ Toolbar – {855F3B16-6D32-4fe6-8A56-BBB695989046} – C:\Program Files\ICQToolbar\toolbaru.dll
O3 – Toolbar: Najdi.si – {442599A9-EB41-4F1F-B999-737BC587F314} – C:\Program Files\Noviforum\Najdi.si toolbar\NajdiSiToolbar.1.dll
O3 – Toolbar: &Google – {2318C2B1-4965-11d4-9B18-009027A5CD4F} – c:\program files\google\googletoolbar1.dll
O3 – Toolbar: SweetIM For Internet Explorer – {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} – C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 – HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 – HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 – HKLM\..\Run: [F-Secure Manager] “C:\Program Files\F-Secure\Common\FSM32.EXE” /splash
O4 – HKLM\..\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe”
O4 – HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 – HKLM\..\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 – HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 – HKLM\..\Run: [MessengerPlus3] “C:\Program Files\MessengerPlus! 3\MsgPlus.exe”
O4 – HKLM\..\Run: [time dog atom surf] C:\Documents and Settings\All Users\Application Data\Poll settings time dog\RectLite.exe
O4 – HKLM\..\Run: [WinampAgent] C:\Documents and Settings\anamarija\My Documents\vse kar se nalaga, podnapis\Winamp\winampa.exe
O4 – HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 – HKLM\..\Run: [send new comp mp3] C:\Documents and Settings\All Users\Application Data\Oneslowsendnew\objsend.exe
O4 – HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 – HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 – HKCU\..\Run: [Skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized
O4 – HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 – HKCU\..\Run: [skip hold] C:\DOCUME~1\doris\APPLIC~1\DRIVEC~1\Dvdfreeeach.exe
O4 – HKCU\..\Run: [MessengerPlus3] “C:\Program Files\MessengerPlus! 3\MsgPlus.exe” /WinStart
O4 – HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 – Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 – Global Startup: Picture Package VCD Maker.lnk = ?
O8 – Extra context menu item: &Google Search – res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 – Extra context menu item: &ICQ Toolbar Search – res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 – Extra context menu item: &Search – http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O8 – Extra context menu item: &Translate English Word – res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 – Extra context menu item: Backward Links – res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 – Extra context menu item: Cached Snapshot of Page – res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 – Extra context menu item: Similar Pages – res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 – Extra context menu item: Translate Page into English – res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 – Extra button: ICQ Lite – {B863453A-26C3-4e1f-A54D-A2CD196348E9} – C:\Program Files\ICQLite\ICQLite.exe
O9 – Extra ‘Tools’ menuitem: ICQ Lite – {B863453A-26C3-4e1f-A54D-A2CD196348E9} – C:\Program Files\ICQLite\ICQLite.exe
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) – http://dl.ltfe.org/courses/619/wd03bsi/awlm/awswax.cab
O16 – DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) – https://signup.msn.com/pages/MsnInstC.cab
O16 – DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 – DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) – http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 – DPF: {2AABC39C-B188-4E90-A343-966AFF556544} (FileSharingCtrl Class) – http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/sl/filesharingctrl.cab
O16 – DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) – http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 – DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1119287954656
O16 – DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) – http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 – DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) – http://advnt01.com/dialer/int_ver34.CAB
O16 – DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) – http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 – DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} – http://deposito.hostance.net/dialer/1064483.exe
O17 – HKLM\System\CCS\Services\Tcpip\..\{FA59E58E-E3A9-4DED-9B22-5F91314190D5}: NameServer = 193.189.160.13 193.189.160.23
O18 – Protocol: msnim – {828030A1-22C1-4009-854F-8E305202313F} – “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)
O18 – Filter: text/html – (no CLSID) – (no file)
O23 – Service: Ati HotKey Poller – Unknown owner – C:\WINDOWS\System32\Ati2evxx.exe
O23 – Service: ATI Smart – Unknown owner – C:\WINDOWS\system32\ati2sgag.exe
O23 – Service: F-Secure BackWeb (BackWeb Client – 7681197) – Unknown owner – C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 – Service: F-Secure BackWeb LAN Access – Unknown owner – C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 – Service: F-Secure Gatekeeper Handler Starter – F-Secure Corp. – C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 – Service: F-Secure Network Request Broker – F-Secure Corporation – C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 – Service: F-Secure Authentication Agent (FSAA) – F-Secure Corporation. All Rights Reserved. – C:\Program Files\F-Secure\Common\FSAA.EXE
O23 – Service: F-Secure Management Agent (FSMA) – F-Secure Corporation – C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 – Service: NajdiSiToolbarUpdate – Unknown owner – C:\Program Files\Noviforum\Najdi.si toolbar\NajdiSiToolbarUpdate.exe
Kj pa če imaš samo home page nastavljen na http://www.porn385.com?
Preveri na tools, internet options, general homepage?
Briši to:
O2 – BHO: Need2Find Bar BHO – {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} – C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL
O2 – BHO: (no name) – {C8FC0613-AE44-FCD7-8025-9A2FDDC41C15} – C:\DOCUME~1\doris\APPLIC~1\MULTIP~1\Chin thunk.exe (file missing)
O8 – Extra context menu item: &Search – http://kc.bar.need2find.com/KC/menusearch.html?p=KC
O16 – DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} – http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSe tup1.0.0.15.cab
O16 – DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) – http://advnt01.com/dialer/int_ver34.CAB
O16 – DPF: {DB893839-10F0-4AF9-92FA-B23528F530AF} – http://deposito.hostance.net/dialer/1064483.exe
O18 – Filter: text/html – (no CLSID) – (no file)
Lp, Max
Forum je zaprt za komentiranje.