Przekierowania youradexchange - strony same się otwierają

[Yavien]

Witam, 

wczoraj wieczorem zaczęły się "same" otwierać strony. Najczęściej dwie karty, z jakimiś grami online czy bukmacherami.

 

z historii chrome zanotowałam adresy:

22/12 22:53
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549892e8a246c1584738.2422622&h=f6668adcc5b59281fde0cb7cc32323139622acdf&id=0&ban=1584738&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DgP&pkr=%3D%3DQM4RTN4RDP&psr=%3DEzN80jN3oCd&scr=xoCN
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549892e8d422e1584738.2422622&h=6348f01d8843399a87834742fa9cf50c51245d72&id=0&ban=1584738&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DgP&pkr=%3D%3DQM4RTN4RDP&psr=%3DEzN80jN3oCd&scr=xoCN
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549892e8a246c1584738.2422622&h=f6668adcc5b59281fde0cb7cc32323139622acdf&id=0&ban=1584738&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DgP&pkr=%3D%3DQM4RTN4RDP&psr=%3DEzN80jN3oCd&scr=xoCN&stage2=1
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549892e8d422e1584738.2422622&h=6348f01d8843399a87834742fa9cf50c51245d72&id=0&ban=1584738&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DgP&pkr=%3D%3DQM4RTN4RDP&psr=%3DEzN80jN3oCd&scr=xoCN&stage2=1
hxxp://t2.junbi-tracker.com/meta.py?cam=21091&cat=687492&subid=98dc9-
hxxp://lp.stargames.com/?page=v07&lang=pl&curr=eur&lang=pl&cid=23841&pid=5386&afid=21091_687492_98dc9-




23/12 0:53
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498af08a22612293742.838818&h=d163ef5ce454dfa39afdf2e8efde7131fb0cda8b&id=0&ban=2293742&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3DsUTCx0QCRlS
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498af08d49842293742.838818&h=6f0671f688e0e8096dfaaa9e0232ec1d1cb46136&id=0&ban=2293742&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3DsUTCx0QCRlS
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498af08a22612293742.838818&h=d163ef5ce454dfa39afdf2e8efde7131fb0cda8b&id=0&ban=2293742&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3DsUTCx0QCRlS&stage2=1
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498af08d49842293742.838818&h=6f0671f688e0e8096dfaaa9e0232ec1d1cb46136&id=0&ban=2293742&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3DsUTCx0QCRlS&stage2=1




23/12 2:53
hxxps://www.starstable.com/pl/register?affiliate=adcash&utm_source=adcash&utm_medium=cpl&referrer=register-page&utm_term=site-under&utm_content=329835&AffId=329835&utm_campaign=PL-Adcash-Star-Stable
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498cb3273f9a2378648.838818&h=97830cb836e96fbbe5bab9a8526cf424e0dba3cf&id=0&ban=2378648&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3D%3DwSM90QMRlS
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498cb32a45f22378648.838818&h=45888950080ee570c6597f262dc90e6834af0ea8&id=0&ban=2378648&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3D%3DwSM90QMRlS
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498cb3273f9a2378648.838818&h=97830cb836e96fbbe5bab9a8526cf424e0dba3cf&id=0&ban=2378648&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3D%3DwSM90QMRlS&stage2=1
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498cb32a45f22378648.838818&h=45888950080ee570c6597f262dc90e6834af0ea8&id=0&ban=2378648&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3D%3DwSM90QMRlS&stage2=1


23/12 4:17
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498dec1177d71388785.2237202&h=e03ddbdb8549a15af61e4942f3d9d52a99e9fc81&id=0&ban=1388785&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498dec14a7352522274.883884&h=ce765d2abda86aca8fead6309140487a216f0d94&id=0&ban=2522274&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3Dw0QDN0QLR1S
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498dec1177d71388785.2237202&h=e03ddbdb8549a15af61e4942f3d9d52a99e9fc81&id=0&ban=1388785&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=&stage2=1
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=5498dec14a7352522274.883884&h=ce765d2abda86aca8fead6309140487a216f0d94&id=0&ban=2522274&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAQ&pkr=%3D%3DwTGo0SGokQ&psr=%3D8USCNESJRlC&scr=%3Dw0QDN0QLR1S&stage2=1
hxxp://pp.funhub.pl/api/click/20644?cid=14976024191419304641&aff_id=14976024191419304641
hxxps://www.bet-at-home.com/pl/landingpagetest/2
hxxp://funhub.pl/?cid=14976024191419304641&aff_id=14976024191419304641&tsrc=ppfunhub&chp_id=26134&click_id=48570471


23/12 11:31
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549944723a4181497781.2315180&h=4faf1804d93862777952b8329c3d0da528f29017&id=0&ban=1497781&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DQq&pkr=%3D%3DgpvPqovP6q&psr=%3DYKorqaog274&scr=%3DE6ojOapl27o
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549944726aff51497781.2315180&h=ee994000ed80ffe915f9c09dc80225e48a86df0f&id=0&ban=1497781&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAr&pkr=%3D%3Dwoqb6pqbqr&psr=%3DMapu%2BKplir5&scr=%3DQqpmaKogirp
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549944723a4181497781.2315180&h=4faf1804d93862777952b8329c3d0da528f29017&id=0&ban=1497781&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DQq&pkr=%3D%3DgpvPqovP6q&psr=%3DYKorqaog274&scr=%3DE6ojOapl27o&stage2=1
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549944726aff51497781.2315180&h=ee994000ed80ffe915f9c09dc80225e48a86df0f&id=0&ban=1497781&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3DAr&pkr=%3D%3Dwoqb6pqbqr&psr=%3DMapu%2BKplir5&scr=%3DQqpmaKogirp&stage2=1
hxxps://www.bet-at-home.com/pl/landingpage/sportsfirst


23/12 12:31
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549952adc0f922961617.3551794&h=692ea66594ef6d9e9b8fd3eb4925f8ba919b71ad&id=0&ban=2961617&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3Dge&pkr=%3D%3DQd8AXc8AHe&psr=%3DU3c4lncz5GM&scr=%3DMXdzB3cz5Gc
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549952adf39702961617.3551794&h=f6cbfdb10b7f35137796953dcf14a736b5612267&id=0&ban=2961617&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3Dge&pkr=%3D%3DQd8AXc8AHe&psr=%3DU3c4lncz5GM&scr=%3DMXdzB3cz5Gc
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549952adc0f922961617.3551794&h=692ea66594ef6d9e9b8fd3eb4925f8ba919b71ad&id=0&ban=2961617&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3Dge&pkr=%3D%3DQd8AXc8AHe&psr=%3DU3c4lncz5GM&scr=%3DMXdzB3cz5Gc&stage2=1
hxxp://www.youradexchange.com/script/pop_packcpm.php?k=549952adf39702961617.3551794&h=f6cbfdb10b7f35137796953dcf14a736b5612267&id=0&ban=2961617&r=329835&ref=&data=&subid=&new=1&exp=prpd&dx=%3D%3Dge&pkr=%3D%3DQd8AXc8AHe&psr=%3DU3c4lncz5GM&scr=%3DMXdzB3cz5Gc&stage2=1
hxxps://shared.windofluck.com/register.php?culture=1

przejrzałam zainstalowane programy, wtyczki w przeglądarce, uruchomione procesy i laickim okiem nie widzę niczego podejrzanego, ale może mi coś umykać.

 

Jedyne, co ewentualnie ostatnio zmieniałam, to 21/12 dodałam wtyczkę Silverlight do chrome, gdy chciałam jakiś program tv obejrzeć.

 

Adwcleaner chyba niczego nie zauważył, dodaję też pozostałe logi.

 

gmer_log_201412231230.txt

Extras.Txt

OTL.Txt

Addition.txt

FRST.txt

Shortcut.txt

AdwCleanerR0.txt

[picasso]

W raportach nic nie widzę. Jednakże sądzę, że przekierowania produkuje któreś pozornie poprawne rozszerzenie. W Google Chrome widać następujące ustawienia:

 

Chrome:

=======

CHR DefaultSearchKeyword: Default -> duckduckgo.com

CHR DefaultSearchURL: Default -> https://duckduckgo.com/?q={searchTerms}

CHR DefaultSuggestURL: Default -> https://ac.duckduckgo.com/ac/?q={searchTerms}&type=list

CHR Profile: C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Prezentacje Google) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-01]

CHR Extension: (Dokumenty Google) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-01]

CHR Extension: (Dysk Google) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-01]

CHR Extension: (YouTube) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-01]

CHR Extension: (Adblock Plus) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-11-02]

CHR Extension: (Szukaj w Google) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-01]

CHR Extension: (Silverlight for Chrome) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcfphkecmijelamacdgpllplnlpkeiea [2014-12-21]

CHR Extension: (Arkusze Google) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-01]

CHR Extension: (Avira Browser Safety) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-02]

CHR Extension: (Google Wallet) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-01]

CHR Extension: (Gmail) - C:\Users\Lenovo T500\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-01]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

 

Preintegrowane rozszerzenia, Adblock Plus i Avira są bezpieczne. Jako jedyny podejrzany zostaje więc świeżo doinstalowany dodatek Silverlight for Chrome. Notabene: to nie jest wtyczka Microsoftu tylko rozszerzenie nieoficjalne, które ma jakoby ułatwiać "sprawdzanie i instalację aktualizacji". Proponuję sprawdzić czy przekierowania nadal będą występować po jego wyłączeniu i wyczyszczeniu Historii.

[Yavien]

Tak prosta rzecz nie przyszła mi do głowy. Wyłączam i zobaczymy, co się stanie. Dziękuję