Problema IE

IE nu deschide decat ceva pagina despre Assa Abloy - The world's leading lock group. Pagina e si in engleza si in romana.
Problema e ca nu apare numai cand dau un search sau ca homepage, ci pur si simplu indiferent ce dau in adress bar nu-mi apare decat siteul asta. se poate naviga in el si pastreaza titulatura initial (de ex adresa ramane de genul http://www.softpedia...use/index.php3).

Am facut un log cu HiJackThis pe care il postez mai jos.
Mentionez ca scanarile cu AdAware sau CWshredder nu au gasit nimic.

Logfile of HijackThis v1.98.2
Scan saved at 19:46:35, on 10/23/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\NetLimiter\NetLimiter.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IChat\iChat.exe
C:\Program Files\totalcmd\TOTALCMD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\DOCUME~1\alecs\LOCALS~1\Temp\_tc\HIJACK~1.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 81.196.12.46:80
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1095763793328
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{57534226-7FD0-4E52-BD15-309B94FCD913}: NameServer = 192.168.2.1

Pls help.

Edited by sapho, 23 October 2004 - 18:51.

Buna sapho,

Download Hoster de aici: Hoster Download. Extrage programul undeva, pe Desktop de exemplu. Executa Hoster.exe Apasa Restore Original Hosts si apoi OK.

Inchide programul si REBOOT.

Spune-mi daca mai ai problema.

Edited by cryo, 23 October 2004 - 19:17.

Nu s-a intamplat nimic (in bine vreau sa zic). De altfel m-am uitat si eu inainte sa rulez Hoster prin  fisierul hosts si in afara de 127.0.0.1 nu era nimic in plus.

Bineinteles (am uitat sa zic) cu Mozilla Firefox imi merge netul f bine (altfel nici nas fi reusit sa postez aici).

Edited by sapho, 23 October 2004 - 19:40.

Copiaza continutul Quote Box de mai jos in Notepad.
Denumeste fisierul PrefixFix.reg
Selecteaza tipul All Files si salveaza-l pe Desktop.

Citat

Dublu click pe PrefixFix.reg si apasa Yes.

REBOOT.

Fa un full scan la http://housecall.antivirus.com/. Asigura-te ca este bifat "AutoClean".

Cum e acum ?

Am pus .reg-ul respectiv (fara nici un rezultat). Scanarea nam reusit s-o fac, probabil datorita integrarii defectuoase Java in Firefox, pentru ca appletul care este de fapt scannerul imi tine procesorul la 100%, insa nu se incarca deloc.

Ce sa mai fac? Sa incerc o scanare cu NAV-ul in SafeMode?
De fapt tu cam ce banuiesti ca este?

Primele doua banuieli s-au dus.  
Te-ai uitat in Windows Registry daca prefix e OK ?
Mergi aici: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes si vezi daca nu sunt modificate.

Sa fie FlashGet ?? Ai varianta free ? Asta free e adware din cate stiu.

Alternativa la Online Scan.
Download System Cleaner de la TrendMicro
http://www.trendmicr...sc/sysclean.com

Salveaza-l intr-un director al lui: de ex. syscleaner

Download cel mai recent pattern file de aici (Official Pattern Release 2.214.00 - 22.10.2004):
http://www.trendmicr...oad/pattern.asp
si extrage continutul arhivei ZIP in acelasi director cu sysclean.com .

Run sysclean.com in SafeMode, asigura-te ca este bifat "Automatically Clean Infected Files" si apasa SCAN.

adevarul e ca sunt si fraier (ca sa nu zic prost).

problema era proxyul setat aiurea. nu stiu daca era setat de mine (s-ar putea sa fi umblat mai demult pe-acolo) sau exista posibilitatea sa fi fost setat de vreun programel, cert e ca am modificat setarea (no proxy) si totul a revenit la normal. (nu prea folosesc IE, dar de cateva zile observasem "problema" si nu-i dadeam de cap).

mii de scuze, si mersi mult oricum.

Si incepusem sa ma gandesc la tot felul de trasnai.
Proxy e de la RDS si nu mi s-a parut suspect, dar ar fi trebuit sa mi se para   .

Happy Surfing !