CentrumXP Forum Tematyka portalu CentrumXP.pl Bezpieczeństwo Hijack This

Hijack This

siemka wiecie skad moge ściągnąć Hijack This :?: i czy on jest darmowy :?:

Odpowiedzi: 20

Udało sie usunołem ten syf tera mój log to:
Logfile of HijackThis v1.97.7
Scan saved at 19:58:26, on 2004–10–24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32CTHELPER.EXE
C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
C:PROGRA~1NokiaNOKIAP~1TRAYAP~1.EXE
C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:Program FilesGadu–Gadugg.exe
C:PROGRA~1COMMON~1PCSuiteServicesSERVIC~1.EXE
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSSystem32 vsvc32.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsOSKAR1PulpitHijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://wp.pl/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 – BHO: (no name) – {0000CC75–ACF3–4cac–A0A9–DD3868E06852} – C:Program FilesDAPDAPBHO.dll
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {AA58ED58–01DD–4d91–8333–CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – C:Program FilesDAPDAPIEBar.dll
O3 – Toolbar: (no name) – {ACB1E670–3217–45C4–A021–6B829A8A27CB} – (no file)
O3 – Toolbar: &Google – {2318C2B1–4965–11d4–9B18–009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [CloneCDTray] "C:Program FilesSlySoftCloneCDCloneCDTray.exe" /s
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 – HKLM..Run: [Jet Detection] "C:Program FilesCreativeSBLivePROGRAMADGJDet.exe"
O4 – HKLM..Run: [DataLayer] C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
O4 – HKLM..Run: [PCSuiteTrayApplication] C:PROGRA~1NokiaNOKIAP~1TRAYAP~1.EXE
O4 – HKLM..Run: [MKS_MENU] C:Program FilesMKSBinmks_menu.exe
O4 – HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O8 – Extra context menu item: &Download with &DAP – C:PROGRA~1DAPdapextie.htm
O8 – Extra context menu item: &Google Search – res://C:Program FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 – Extra context menu item: Backward &Links – res://C:Program FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 – Extra context menu item: Cac&hed Snapshot of Page – res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html
O8 – Extra context menu item: Download &all with DAP – C:PROGRA~1DAPdapextie2.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 – Extra context menu item: Si&milar Pages – res://C:Program FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 – Extra context menu item: Translate into English – res://C:Program FilesGoogleGoogleToolbar1.dll/cmtrans.html
O9 – Extra button: Run DAP (HKLM)
O9 – Extra button: Badanie (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 – DPF: {31B7EB4E–8B4B–11D1–A789–00A0CC6651A8} (Cult3D ActiveX Player) – http://www.cult3d.com/download/cult.cab
O16 – DPF: {5F874A6F–8B34–433D–BA4B–47AC91C0567F} (MailCfg Control) – https://poczta.wp.pl/autoryzacja/mailcfg2.ocx
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093118733125
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C1} (GameDesire Pool 8) – http://67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab
Darks
Dodano
24.10.2004 21:59:47
Darks:
jak
Przeczytales to co jest za linkiem podanym przez Marcina ? Obejrzales obrazki ? Jest tam taki jeden – Jak naprawić–Usunąć pozycję.jpg

Zaznacz wszystko co podalem i usun FIXem. Jesli nie mozna usunac pliku, uruchom system w trybie awaryjnym. Pozniej usun caly folder MyWay z Program Files
EL NINO
Dodano
24.10.2004 21:59:09
jak El nino
:?: :?: :?: i czy to jest trojan albo co,próbowałem usunąc recznie My bar i sie nieda co to jest?
Darks
Dodano
24.10.2004 21:49:35
W takim razie rowniez usun HiJackiem.
EL NINO
Dodano
24.10.2004 21:47:23
nic nie instalowałem jak http://www.actuality.fr.tc
Darks
Dodano
24.10.2004 21:46:19
Czy rzeczywiscie masz ustawiona ta strone wyszukiwania ?
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.actuality.fr.tc

Pozbadz sie tego:

O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O2 – BHO: (no name) – {AA58ED58–01DD–4d91–8333–CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: (no name) – {ACB1E670–3217–45C4–A021–6B829A8A27CB} – (no file)
O3 – Toolbar: My &Search Bar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: &Google – {2318C2B1–4965–11d4–9B18–009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O8 – Extra context menu item: &Google Search – res://C:Program FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 – Extra context menu item: Backward &Links – res://C:Program FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 – Extra context menu item: Cac&hed Snapshot of Page – res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html
O8 – Extra context menu item: Si&milar Pages – res://C:Program FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 – Extra context menu item: Translate into English – res://C:Program FilesGoogleGoogleToolbar1.dll/cmtrans.html
EL NINO
Dodano
24.10.2004 21:39:40
czy mam tu cos nie tak :?: Logfile of HijackThis v1.97.7
Scan saved at 19:15:43, on 2004–10–24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32CTHELPER.EXE
C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
C:PROGRA~1NokiaNOKIAP~1TRAYAP~1.EXE
C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:Program FilesGadu–Gadugg.exe
C:PROGRA~1COMMON~1PCSuiteServicesSERVIC~1.EXE
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSSystem32 vsvc32.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesInternet Exploreriexplore.exe
C:Documents and SettingsOSKAR1PulpitHijackThis.exe

R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.actuality.fr.tc
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://wp.pl/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 – BHO: (no name) – {0000CC75–ACF3–4cac–A0A9–DD3868E06852} – C:Program FilesDAPDAPBHO.dll
O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O2 – BHO: (no name) – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0 CEReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {AA58ED58–01DD–4d91–8333–CF10577473F7} – c:program filesgooglegoogletoolbar1.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – C:Program FilesDAPDAPIEBar.dll
O3 – Toolbar: (no name) – {ACB1E670–3217–45C4–A021–6B829A8A27CB} – (no file)
O3 – Toolbar: My &Search Bar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: &Google – {2318C2B1–4965–11d4–9B18–009027A5CD4F} – c:program filesgooglegoogletoolbar1.dll
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [CloneCDTray] "C:Program FilesSlySoftCloneCDCloneCDTray.exe" /s
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 – HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 – HKLM..Run: [Jet Detection] "C:Program FilesCreativeSBLivePROGRAMADGJDet.exe"
O4 – HKLM..Run: [DataLayer] C:PROGRA~1COMMON~1PCSuiteDATALA~1DATALA~1.EXE
O4 – HKLM..Run: [PCSuiteTrayApplication] C:PROGRA~1NokiaNOKIAP~1TRAYAP~1.EXE
O4 – HKLM..Run: [MKS_MENU] C:Program FilesMKSBinmks_menu.exe
O4 – HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O8 – Extra context menu item: &Download with &DAP – C:PROGRA~1DAPdapextie.htm
O8 – Extra context menu item: &Google Search – res://C:Program FilesGoogleGoogleToolbar1.dll/cmsearch.html
O8 – Extra context menu item: Backward &Links – res://C:Program FilesGoogleGoogleToolbar1.dll/cmbacklinks.html
O8 – Extra context menu item: Cac&hed Snapshot of Page – res://C:Program FilesGoogleGoogleToolbar1.dll/cmcache.html
O8 – Extra context menu item: Download &all with DAP – C:PROGRA~1DAPdapextie2.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2OFFICE11EXCEL.EXE/3000
O8 – Extra context menu item: Si&milar Pages – res://C:Program FilesGoogleGoogleToolbar1.dll/cmsimilar.html
O8 – Extra context menu item: Translate into English – res://C:Program FilesGoogleGoogleToolbar1.dll/cmtrans.html
O9 – Extra button: Run DAP (HKLM)
O9 – Extra button: Badanie (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 – DPF: {31B7EB4E–8B4B–11D1–A789–00A0CC6651A8} (Cult3D ActiveX Player) – http://www.cult3d.com/download/cult.cab
O16 – DPF: {5F874A6F–8B34–433D–BA4B–47AC91C0567F} (MailCfg Control) – https://poczta.wp.pl/autoryzacja/mailcfg2.ocx
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093118733125
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C1} (GameDesire Pool 8) – http://67.15.101.3/g_bin/pl/billard8_2_0_0_21.cab
Darks
Dodano
24.10.2004 21:17:21
dzieki,wielkie dzieki
Darks
Dodano
24.10.2004 21:12:34
Nie moze nie dzialac.

Zreszta zalacznik:
EL NINO
Dodano
24.10.2004 21:10:20
Darks

http://www.centrumxp.pl/forum/viewtopic.php?t=19974
MarcinX
Dodano
24.10.2004 21:05:29
ten link nie działa mi: http://www.spywareinfo.com/~merijn/files/hijackthis.zip
Darks
Dodano
24.10.2004 21:03:40
Darks:
Bo nie działa panie EL NINO
W siodmym poscie napisanym przez woytega nie dziala http://www.spywareinfo.com/~merijn/files/hijackthis.zip ?
W przyklejonym temacie napisanym przez McScr@by'ego nie dzialaja linki oznaczone jako Mirror 1, 2 i 3 ?
EL NINO
Dodano
24.10.2004 21:01:49
Ej no sorry naprawde mi nie działa.
Darks
Dodano
24.10.2004 20:57:19
Darks:
Bo nie działa panie EL NINO
hmmmmm.... chyba tylko tobie, bo nam jakos dziala :wink:
gieras
Dodano
24.10.2004 20:44:11
Bo nie działa panie EL NINO
Darks
Dodano
24.10.2004 20:33:02
Darks, tak sobie czytam ten caly temat i zastanawiam sie czy do Ciebie dociera to, co pisza w swoich postach inni.
Czy napisano Ci abys uzyl forumowej wyszukiwarki ?
Czy podano Ci linki do programu ?
Czy w koncu napisano Ci ze wszystko, czy tez moze sporo, znalazbys w pierwszym przyklejonym w tym dziale temacie ?

P.S. I nie pisz bzdur, ze linki nie dzialaja.
EL NINO
Dodano
24.10.2004 20:26:40
A wyślicie mi go na maila :?: :?: :?: oskar–punio@wp.pl
Darks
Dodano
24.10.2004 20:12:30
mefisto_k:
Czyli?? Bo nierozumiem ciebie ???

Backup – kopia zapasowa
Z nich mozesz w razie potrzeby przywrocic usuniete wpisy
Bobi
Dodano
24.10.2004 19:48:08
Czyli?? Bo nierozumiem ciebie ???
mefisto_k
Dodano
24.10.2004 19:25:51
mefisto_k:
A jak ja np. zaznacze wszystkto to co mam w HJT to pojawiają mi sie na pulpicie jakies pliki co one daj co ????

To backup'y
Bobi
Dodano
24.10.2004 18:04:55
Darks
Dodano:
23.10.2004 22:26:48
Komentarzy:
20
Strona 2 / 3