Proxy skript 127.0.0.1:86
Napsal: 05 kvě 2021 20:26
Dobry den.
Potreboval by som od vas pomoct s mensim nesvarom.
Po skumani problemu s nacitavanim Youtube (broken sidepanel, nenacitanie videi atd.) som zistil, ze sa mi v Proxy settings OSka objavil proxy setup skript, so script address http://127.0.0.1:86/
Proxy som smaznul z nasledujucich registrov:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\ProxyMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies
Odmazanie obnovilo funkcionalitu YT (a predpokladam i inych webov), bohuzel proxy skript sa po restarte neustale vracia.
ProcMon pri boote mi ukazal len to, ze proxy do AutoConfigURL vzdy pri startupu zpatky nahodi svchost
(C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc)
a to do lokaci:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKLM\System\CurrentControlSet\Services\iphlpsvc\Parameters\ProxyMgr\{FA83B550-CF6A-4B62-9170-FB7B04B1BF75}\AutoConfigUrl
HKLM\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ManualProxies\(Default)
Uprimne nevim jak dlho to tak uz takto pretrvava, problemy sa objavili par tyzdnov dozadu, prvykrat odmazanie proxy skriptu pomohlo, teraz za to neustale vracia.
Spybot S&D mi nieco malo precistil, Malwarebytes nic nenasiel (ten naposledy odmazaval PUP.Optional.Privoxy z %ProgramFiles(x86)%\SystemWin ale to este v 2017), ESET tiez nenasiel nic podstatne.
Bohuzial issue s proxy skriptom po restarte stale pretrvava.
Zaroven je divne, ze inetcpl.cpl mi neumozni editovat LAN settings (managed by admin, i kdyz jsem admin), moze to suvisiet s IE Restriction co nasiel FSRT?
FSRT a Addition logy prikladam do prilohy. Budem vdacny za akukolvek pomoc.
Diky mockrat.
[EDIT] - skusil som schvalne ist na IP port co ziskam, vratil sa mi application/x-ns-proxy-autoconfig subor, otvoril som ho v notepade, ma nasledujuci obsah (na IP s portom 83 sa mi uz nevratilo nic.) :
function FindProxyForURL(url, host) {
//Ver:1.0.0.4
if (shExpMatch(url, "*/recaptcha/*")) return "DIRECT";
if (shExpMatch(host, "cse.google.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.google.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "*search.yahoo.com")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.bing.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.amazon.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.youtube.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.ebay.*")) return "PROXY 127.0.0.1:83";
return "DIRECT";}
[EDIT 2] - resource monitor mi ukazal, ze na portoch 83 a 86 naslucha C:\Program Files (x86)\Common Files\InstallShield\Engine\8\intel 32\iKernel.exe - ten ale scany ESET atd. presiel bez viru. VirusTotal zdetekoval len 2/69, tie 2 nalezy su Generic.mg.10624ff080820515 / TScope.Trojan.MSIL - mozno to bude hlavnym vinnikom? Fake InstallShield assembly?
Potreboval by som od vas pomoct s mensim nesvarom.
Po skumani problemu s nacitavanim Youtube (broken sidepanel, nenacitanie videi atd.) som zistil, ze sa mi v Proxy settings OSka objavil proxy setup skript, so script address http://127.0.0.1:86/
Proxy som smaznul z nasledujucich registrov:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\ProxyMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies
Odmazanie obnovilo funkcionalitu YT (a predpokladam i inych webov), bohuzel proxy skript sa po restarte neustale vracia.
ProcMon pri boote mi ukazal len to, ze proxy do AutoConfigURL vzdy pri startupu zpatky nahodi svchost
(C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc)
a to do lokaci:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
HKLM\System\CurrentControlSet\Services\iphlpsvc\Parameters\ProxyMgr\{FA83B550-CF6A-4B62-9170-FB7B04B1BF75}\AutoConfigUrl
HKLM\System\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ManualProxies\(Default)
Uprimne nevim jak dlho to tak uz takto pretrvava, problemy sa objavili par tyzdnov dozadu, prvykrat odmazanie proxy skriptu pomohlo, teraz za to neustale vracia.
Spybot S&D mi nieco malo precistil, Malwarebytes nic nenasiel (ten naposledy odmazaval PUP.Optional.Privoxy z %ProgramFiles(x86)%\SystemWin ale to este v 2017), ESET tiez nenasiel nic podstatne.
Bohuzial issue s proxy skriptom po restarte stale pretrvava.
Zaroven je divne, ze inetcpl.cpl mi neumozni editovat LAN settings (managed by admin, i kdyz jsem admin), moze to suvisiet s IE Restriction co nasiel FSRT?
FSRT a Addition logy prikladam do prilohy. Budem vdacny za akukolvek pomoc.
Diky mockrat.
[EDIT] - skusil som schvalne ist na IP port co ziskam, vratil sa mi application/x-ns-proxy-autoconfig subor, otvoril som ho v notepade, ma nasledujuci obsah (na IP s portom 83 sa mi uz nevratilo nic.) :
function FindProxyForURL(url, host) {
//Ver:1.0.0.4
if (shExpMatch(url, "*/recaptcha/*")) return "DIRECT";
if (shExpMatch(host, "cse.google.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.google.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "*search.yahoo.com")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.bing.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.amazon.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.youtube.*")) return "PROXY 127.0.0.1:83";
if (shExpMatch(host, "www.ebay.*")) return "PROXY 127.0.0.1:83";
return "DIRECT";}
[EDIT 2] - resource monitor mi ukazal, ze na portoch 83 a 86 naslucha C:\Program Files (x86)\Common Files\InstallShield\Engine\8\intel 32\iKernel.exe - ten ale scany ESET atd. presiel bez viru. VirusTotal zdetekoval len 2/69, tie 2 nalezy su Generic.mg.10624ff080820515 / TScope.Trojan.MSIL - mozno to bude hlavnym vinnikom? Fake InstallShield assembly?
+ hajzel si k tomu jeste nahodil fake "Digicert Global Root G1A" medzi RootCA... Takze nuke CAcka a zmazanie vsetkych personal certificates co boli issued tou CA..