» »

Čudna reč z razrešitvijo naslova

Čudna reč z razrešitvijo naslova

mr1two ::

Pozdravljeni!
Imam problem na enem od računalnikov, ki je verjetno napaden s kakšo zlo kodo. Gre pa za sledeč problem: Ko se poskusim povezat ali na www.google.com ali kakšno njegovo podstran, se mi stran ne naloži. Google.si mi normalno odpre.
Za hec sem naredil en tracert do www.google.com in dobil zelo sumljive rezultate in sicer:

2 93 ms 97 ms 96 ms 89-212-0-1.gw.t-2.net [89.212.0.1]
3 71 ms 71 ms 82 ms 84-255-209-221.core.t-2.net [84.255.209.221]
4 35 ms 45 ms 47 ms 84-255-250-9.core.t-2.net [84.255.250.9]
5 73 ms 54 ms 26 ms 212.73.203.5
6 101 ms 110 ms 107 ms ae-6-6.ebr1.Frankfurt1.Level3.net [4.69.135.34]

7 117 ms 114 ms 129 ms ae-61-61.csw1.Frankfurt1.Level3.net [4.69.140.2]

8 74 ms 60 ms 56 ms ae-1-69.edge5.Frankfurt1.Level3.net [4.68.23.13]

9 54 ms 65 ms 66 ms xe-0-2-0.mpr1.fra4.de.above.net [64.125.14.5]
10 126 ms 132 ms 97 ms xe-1-0-0.mpr1.fra3.de.above.net [64.125.31.221]

11 128 ms 144 ms 139 ms xe-4-1-0.mpr1.ams1.nl.above.net [64.125.24.9]
12 184 ms 189 ms 206 ms so-0-2-0.mpr1.lga5.us.above.net [64.125.25.57]
13 210 ms 209 ms 158 ms xe-1-3-0.cr1.lga5.us.above.net [64.125.29.53]
14 155 ms 158 ms 134 ms xe-0-1-0.er1.lga5.us.above.net [64.125.27.61]
15 159 ms 123 ms 124 ms xe-0-0-0.er2.lga5.us.above.net [64.125.26.158]
16 238 ms 232 ms 249 ms 64.124.44.213.interserver.com [64.124.44.213]
17 245 ms 239 ms 211 ms edge.hnlv.net [69.10.52.74]


Po koraku 17 je bil odziv request timeout.
Kaj točno bi to bilo in ali je imel že kdo podobno zadevo. Mi je pa superantispyware odkril neke hijack prašiče in nekaj nesnage, ki sem jo odstranil. Vsaj upam da uspešno.

Opomba: na drugem pcju(na katerem trenutno agresivno izvajam razne scane) vse strani odpira normalno in tracert za isto stran vrne to:



2 14 ms 13 ms 12 ms 89-212-0-1.gw.t-2.net [89.212.0.1]
3 13 ms 12 ms 13 ms 84-255-209-221.core.t-2.net [84.255.209.221]
4 14 ms 14 ms 14 ms 84-255-250-9.core.t-2.net [84.255.250.9]
5 17 ms 16 ms 15 ms 84-255-250-46.core.t-2.net [84.255.250.46]
6 20 ms 20 ms 20 ms win-b2-link.telia.net [213.248.79.229]
7 26 ms 25 ms 26 ms prag-bb1-link.telia.net [80.91.246.200]
8 70 ms 43 ms 43 ms ffm-bb1-link.telia.net [80.91.246.12]
9 39 ms 44 ms 43 ms ffm-b7-link.telia.net [80.91.251.230]
10 48 ms 39 ms 46 ms google-118152-ffm-b7.c.telia.net [213.248.102.23
4]
11 42 ms 39 ms 39 ms 209.85.255.176
12 51 ms 52 ms 51 ms 216.239.48.11
13 55 ms 55 ms 61 ms 216.239.48.5
14 67 ms 62 ms 55 ms 209.85.254.29
15 56 ms 56 ms 56 ms ber01s02-in-f147.1e100.net [209.85.149.147]

Trace complete.
  • spremenil: mr1two ()

techfreak :) ::

Uporabljaš kakšen VPN ali proxy? Ker pri prvem računalniku imaš očitno vse routano preko strežnika nekje na Frankfurt1.Level3.net.

mr1two ::

Zgodilo se mi je, da se mi je naflikal nek "proxy", ki ga nisem dodal sam. Takrat ni delala nobena stvar ampak ko gledam nastavitve, ni trenutno speljano nič čez noben proxy. Vsaj vidno ne.
Sem dal zadevo ponovno skenirat, bom malo raziskal, kaj točno počne ta zadeva: "Hijacker Internet explorer settings Hijack" , ki mi jo je ponovno zaznalo.

mr1two ::

Sijajno, celotna datoteka hosts (C:\Windows\System32\drivers\etc) je bila polna nesnage...poleg vsega ostalega seveda. Sem pobrisal, oz preimenoval to packarijo, hosts file pa vsebuje samo localhost ip in nič druzga.
Stvar dela. Majkice jim, presneti packi programerski. Ba, fuj to moj pc

Edit:
če koga zanima kake IPje je naflikalo noter:

74.125.45.100 4-open-davinci.com
74.125.45.100 securitysoftwarepayments.com
74.125.45.100 privatesecuredpayments.com
74.125.45.100 secure.privatesecuredpayments.com
74.125.45.100 getantivirusplusnow.com
74.125.45.100 secure-plus-payments.com
74.125.45.100 www.getantivirusplusnow.com
74.125.45.100 www.secure-plus-payments.com
74.125.45.100 www.getavplusnow.com
74.125.45.100 safebrowsing-cache.google.com
74.125.45.100 urs.microsoft.com
74.125.45.100 www.securesoftwarebill.com
74.125.45.100 secure.paysecuresystem.com
74.125.45.100 paysoftbillsolution.com
74.125.45.100 protected.maxisoftwaremart.com
68.168.222.226 www.google.com
68.168.222.226 google.com
68.168.222.226 google.com.au
68.168.222.226 www.google.com.au
68.168.222.226 google.be
68.168.222.226 www.google.be
68.168.222.226 google.com.br
68.168.222.226 www.google.com.br
68.168.222.226 google.ca
68.168.222.226 www.google.ca
68.168.222.226 google.ch
68.168.222.226 www.google.ch
68.168.222.226 google.de
68.168.222.226 www.google.de
68.168.222.226 google.dk
68.168.222.226 www.google.dk
68.168.222.226 google.fr
68.168.222.226 www.google.fr
68.168.222.226 google.ie
68.168.222.226 www.google.ie
68.168.222.226 google.it
68.168.222.226 www.google.it
68.168.222.226 google.co.jp
68.168.222.226 www.google.co.jp
68.168.222.226 google.nl
68.168.222.226 www.google.nl
68.168.222.226 google.no
68.168.222.226 www.google.no
68.168.222.226 google.co.nz
68.168.222.226 www.google.co.nz
68.168.222.226 google.pl
68.168.222.226 www.google.pl
68.168.222.226 google.se
68.168.222.226 www.google.se
68.168.222.226 google.co.uk
68.168.222.226 www.google.co.uk
68.168.222.226 google.co.za
68.168.222.226 www.google.co.za
68.168.222.226 www.google-analytics.com
68.168.222.226 www.bing.com
68.168.222.226 search.yahoo.com
68.168.222.226 www.search.yahoo.com
68.168.222.226 uk.search.yahoo.com
68.168.222.226 ca.search.yahoo.com
68.168.222.226 de.search.yahoo.com
68.168.222.226 fr.search.yahoo.com
68.168.222.226 au.search.yahoo.com

Zgodovina sprememb…

  • spremenil: mr1two ()

racprodaja ::

Kaj vse to ti je v hoste nametalo? :)

mr1two ::

Jap, pa še zamaskiralo mi ga je(tko da mi ga explorer sploh prikazal ni), ampak s totalcommanderjem se vse najde.
Bom malo povprašal, kdo vse je šaril po računalniku, ko me ni blo doma, hehe. Zanimivo, da se na mojem primarnem kaj takega nikoli ne zgodi:D

Duhec ::

Hehe, omladina ....:D
S HijackThis lahko elegantno vidiš kakšna packarija se zabubi v sistem in hosts datoteko. Moraš pa mičkeno poznat programje kaj je in kaj ni del sistema.
http://free.antivirus.com/hijackthis/

Daš "Scan", počakaš, da izpiše vso solato, spodaj klikneš "Save Log" in shraniš nekam na disk .
Nato odpreš tole stran:
http://www.hijackthis.de/index.php?lang...
spodaj izbereš "or you can choose a logfile from your computer" in pejstaš hijackthis.log datotekco, stisneš Analyze, ki ti vrne rezultate, ki jih pregledaš in v HijackThis programu označiš tiste kvadratke, ki so glede na vrnjen rezultat z razlago sumljivi, ter stisneš spodaj Fix checked.

mr1two ::

Vidiš, to mi je všeč!
Hvala Duhec. Zadeva mi je našla še prej omenjeno napako(on proxy, ki se mi je sam nastavil). Drugo pa je zeleno.
LP


Vredno ogleda ...

TemaSporočilaOglediZadnje sporočilo
TemaSporočilaOglediZadnje sporočilo
»

Optimizacija linije do igralnih strežnikov - what can you do?

Oddelek: Omrežja in internet
304315 (3283) Pesimist
»

Misteriozni IP

Oddelek: Omrežja in internet
82070 (1870) Brane22
»

VMware Player - DNS server zmešan

Oddelek: Programska oprema
225363 (4932) AndrejO
»

Youtube zelo počasen (strani: 1 2 )

Oddelek: Omrežja in internet
8810910 (7953) HeMan
»

Telemach: Počasno delovanje interneta

Oddelek: Omrežja in internet
132691 (2400) floyd1

Več podobnih tem