Automaticke otvaranie stranok

[cloud28]

Ahoj.
Navstivil som nejake stránky a teraz pri kazdom otvoreni exporeru sa mi otvara automaticky stránka z reklamov.Ako sa mam toho zbaviť? Je to velmi otravne

[Reklama]

[Baron Prášil]

tak sem pošli log z HikackThis.
HijackThis stahneš tady-
http://www.bleepingcomputer.com/files/M ... ckThis.zip
rozbal do vlastní složky,spusť,klikni na "Do a system scan and save a logfile"
Vygenerovaný texťák zkopíruj sem.

a zatim co to budeš dělat přemejšlej o nějaké alternativě k Internet Exploreru.
třeba Firefoxu
http://www.czilla.cz/produkty/firefox/

[cloud28]

Odpisujem až tak neskoro mam nainštalovaný hijack ale už mu skončila platnosť. Neviete o neakej inej alternatíve.

pls

[mijaja]

HijackThis je freeware, tam neexistuje žádné časové omezení, leda tak, že je starší verze a tu lehce přepíšeš novou. Navíc HJT se neinstaluje - jen rozbalí do samostatného adresáře a poklikáním spustí.

[cloud28]

mam ten log dik
Logfile of HijackThis v1.99.1
Scan saved at 16:21:57, on 22.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\PDF\pdfSaver\pdfSaver3.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Monika\LOCALS~1\Temp\Rar$EX02.446\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.atlas.cz/?from=icqhp
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Program Files\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [bags log less store] C:\Documents and Settings\All Users\Application Data\Frag The Bags Log\Spam Mags.exe
O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\PDF\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [isodate] C:\DOCUME~1\Monika\APPLIC~1\OPTION~1\Rdr 2 Type.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: PageSpy - C:\Program Files\PageSpy\PageSpy.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{020F468D-03BC-4C20-B54D-5CA0BA768BA2}: NameServer = 84.16.32.234,62.168.116.88
O17 - HKLM\System\CS1\Services\Tcpip\..\{020F468D-03BC-4C20-B54D-5CA0BA768BA2}: NameServer = 84.16.32.234,62.168.116.88
O17 - HKLM\System\CS2\Services\Tcpip\..\{020F468D-03BC-4C20-B54D-5CA0BA768BA2}: NameServer = 84.16.32.234,62.168.116.88
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

[mijaja]

Vyzkoušej na Jottiscanu toto:

C:\Documents and Settings\All Users\Application Data\Frag The Bags Log\Spam Mags.exe
C:\DOCUME~1\Monika\APPLIC~1\OPTION~1\Rdr 2 Type.exe
C:\Program Files\PageSpy\PageSpy.html

Dej vědět výsledky.

Nainstaluj si firewall a nějaké antispyware - v mém podpisu, link Důležité....

Jinak v logu nic špatného nevidím. Bude vhodnější sken MWAVu a jeho log - návod mám v podpisu (důkladně přečíst!).

Tohle je ti známo?
84.16.32.0 - 84.16.32.255
netname: MICRONET
descr: MICRONET-NET-I
descr: Bratislava

inetnum: 62.168.116.64 - 62.168.116.127
netname: SK-GTS-HOSTING
descr: GTS Slovakia Server Hosting
descr: GTS Slovakia
descr: Bratislava
country: SK
admin-c: GSNH1-RIPE
tech-c: GSNH1-RIPE
status: ASSIGNED PA
mnt-by: GTSSK-MNT
source: RIPE # Filtered

role: GTS-INEC Slovak Net Hostmaster
address: GTS Nextra a.s.
address: Prievozska 2/A
address: Bratislava
address: 842 99
address: Slovak Republic
phone: +421 2 32487 666 # nmc
phone: +421 2 32487 111
fax-no: +421 2 32487 222
abuse-mailbox: Whois Privacy and Spam Prevention by DomainTools.com