przekierowanie w IE i Avant Browserze

[Gość: Żona]

mam taki problem :
od pewnego czasu jzk klikam na różne linki znajdowane przed Google np:
rozkład jazdy pkp wyskakuje ,przekierowuje mnie na coś takiego:
www.camouflageclothingonline.net/pkp.cfm?nft=1&t=4&p=4
itp...
co się dzieje?

[Gość: Kolobos]

Avant to nakladka na IE wiec to to samo.

Wklej log z hijackthis pewnie zlapales wareout czy cos.

[Gość: Żona]

Logfile of HijackThis v1.99.1
Scan saved at 23:09:42, on 2006-11-20
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv50.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007
\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\program files\panda software\panda internet security 2007\WebProxy.exe
C:\Program Files\RAR\WinRAR.exe
C:\DOCUME~1\ABZ\USTAWI~1\Temp\Rar$EX00.797\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Fujijama
Eternet Ixplorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IExplore Helper - {3301A7C2-0ABD-11D4-914D-00C04F610D24} - (no file)
O2 - BHO: (no name) - {505775B5-93F3-429D-FF34-630B2063497C} - (no file)
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32
\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32
\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet
Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet
Security 2007\Inicio.exe"
O8 - Extra context menu item: Search with &Google - C:\Documents and
Settings\ABZ\Dane aplikacji\TuneUp Software\TuneUp Utilities\Web\gsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\WINNT\System32\msjava.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
cam1.gawex.pl/activex/AxisCamControl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner
3.0) - support.f-secure.com/ols/fscax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A71A95F-905C-471E-8B1E-DBD15B3060FD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{57ACE259-C7FF-42E6-BEE5-9B8A40875ACD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2724CD7-A4E1-47D1-835A-B52436475910}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.102
85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\..\{4A71A95F-905C-471E-8B1E-DBD15B3060FD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.102
85.255.112.199
O17 - HKLM\System\CS2\Services\Tcpip\..\{4A71A95F-905C-471E-8B1E-DBD15B3060FD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.102
85.255.112.199
O20 - Winlogon Notify: avldr - C:\WINNT\SYSTEM32\avldr.dll
O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision
Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32
\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINNT\System32\nvsvc32.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software
International - C:\Program Files\Panda Software\Panda Internet Security 2007
\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software -
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software
International - C:\Program Files\Panda Software\Panda Internet Security 2007
\pavsrv50.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software
International - C:\Program Files\Panda Software\Panda Internet Security 2007
\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International -
c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program
Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda
Software\Panda Internet Security 2007\TPSrv.exe
O23 - Service: Windows Management Service - Unknown owner - C:\WINNT\system32
\dmsng.exe

[Gość: Kolobos]

Uzyj: downloads.subratam.org/Fixwareout.exe log, ktory sie wygeneruje po uzyciu wklej na forum.

W hjt usun:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: IExplore Helper - {3301A7C2-0ABD-11D4-914D-00C04F610D24} - (no file)
O2 - BHO: (no name) - {505775B5-93F3-429D-FF34-630B2063497C} - (no file)
O2 - BHO: (no name) - {73364D99-1240-4dff-B12A-67E448373148} - (no file)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) -
cam1.gawex.pl/activex/AxisCamControl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4A71A95F-905C-471E-8B1E-DBD15B3060FD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{57ACE259-C7FF-42E6-BEE5-9B8A40875ACD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2724CD7-A4E1-47D1-835A-B52436475910}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.102
85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\..\{4A71A95F-905C-471E-8B1E-DBD15B3060FD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.102
85.255.112.199
O17 - HKLM\System\CS2\Services\Tcpip\..\{4A71A95F-905C-471E-8B1E-DBD15B3060FD}:
NameServer = 85.255.116.102,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.102
85.255.112.199

Do tego usluga do kasacji:
O23 - Service: Windows Management Service - Unknown owner - C:\WINNT\system32
\dmsng.exe

O tak: Start->Uruchom->sc stop "Windows Management Service"
oraz: sc delete "Windows Management Service"

Plik C:\WINNT\system32\dmsng.exe usun z dysku.

Do tego skan przy pomocy ewido.

[Gość: Żona]

Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\0mdm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\1mdm
...

Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT
IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\WINNT\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.

[Gość: Kolobos]

Juz powinno byc ok.

[Gość: Żona]

dziękuję bardzo fktycznie jest okej:)
Chociaż jak zblokował mi ten brute force komputer to zmroziło mnie hi hi
dziękuję jeszcze raz a przy okazji mógł byś mi napisać co to było za
świństwo ? bo to chyba nie virus ani szpieg??

[Gość: Kolobos]

Tak jak pisalem Wareout + robaki, nic groznego.