hijackthis
jezeli ktoa sie zna na tych wpisach to niech podpowie co jest nie tak
Logfile of HijackThis v1.99.0
Scan saved at 17:19:03, on 2004–12–21
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
E:odtwarzaczeWinampwinampa.exe
C:PROGRA~1AQUATI~1AQ3HEL~1.EXE
C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004APVXDWIN.EXE
C:Program FilesJavaj2re1.4.2_06injusched.exe
C:WINDOWSSystem32 undll32.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSSystem32ctfmon.exe
D: adekGadu–Gadugg.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004pavsrv51.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004PsImSvc.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004AVENGINE.EXE
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004WebProxy.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesAzureusAzureus.exe
C:Program FilesJavaj2re1.4.2_06injavaw.exe
D:DVDodkodowanie plyt DVDHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://results.dashbar.com/search?c=27440&b=17862&t=0&ce=DI&m=NDc5NTQ3MDE4&ver=2.1.0.0
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 – BHO: (no name) – {02478D38–C3F9–4efb–9B51–7695ECA05670} – (no file)
O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – C:Program FilesSpybot – Search & DestroySDHelper.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: My &Search Bar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: (no name) – {EF99BD32–C1FB–11D2–892F–0090271D4F88} – (no file)
O4 – HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [WinampAgent] E:odtwarzaczeWinampwinampa.exe
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [AQ3HelperStartUp] C:PROGRA~1AQUATI~1AQ3HEL~1.EXE /partner AQ3
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
O4 – HKLM..Run: [APVXDWIN] "C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004APVXDWIN.EXE" /s
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_06injusched.exe
O4 – HKLM..Run: [New.net Startup] rundll32 C:WINDOWSNEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 – HKCU..Run: [Skype] "D: adekPhoneSkype.exe" /nosplash /minimized
O4 – HKCU..Run: [Gadu–Gadu] "D: adekGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 – Extra context menu item: Pobierz uźywając Download &Express'a – C:Program FilesDownload ExpressAdd_Url.htm
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O10 – Hijacked Internet access by New.Net
O16 – DPF: komentator – http://sport.onet.pl/komentator.cab
O16 – DPF: {00000000–7777–0704–0B53–2C8830E9FAEC} – http://gn.one2bill.de/soft/axload.cab
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=7fd1b1487ea24557e81cb1f266ef2780947d11d735d3f73d567bbcc1cd65aeb860d24e26488494fe11db2684f9909f72dc77fd77a214:2e5848e0a9d3ad577e6a6478c1291781
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099644152175
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O17 – HKLMSystemCCSServicesTcpip..{5ED607E6–1445–422C–8BF5–9AB04BA49227}: NameServer = 194.204.159.1,194.204.152.34
O23 – Service: Ati HotKey Poller – Unknown – C:WINDOWSSystem32Ati2evxx.exe
O23 – Service: ATI Smart – Unknown – C:WINDOWSsystem32ati2sgag.exe
O23 – Service: Panda Process Protection Service – Unknown – C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe
O23 – Service: Panda anti–virus service – Unknown – C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004pavsrv51.exe
O23 – Service: Panda IManager Service – Panda Software Internacional – C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004PsImSvc.exe
Logfile of HijackThis v1.99.0
Scan saved at 17:19:03, on 2004–12–21
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
E:odtwarzaczeWinampwinampa.exe
C:PROGRA~1AQUATI~1AQ3HEL~1.EXE
C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004APVXDWIN.EXE
C:Program FilesJavaj2re1.4.2_06injusched.exe
C:WINDOWSSystem32 undll32.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:WINDOWSSystem32ctfmon.exe
D: adekGadu–Gadugg.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004pavsrv51.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004PsImSvc.exe
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004AVENGINE.EXE
C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004WebProxy.exe
C:WINDOWSSystem32wuauclt.exe
C:Program FilesAzureusAzureus.exe
C:Program FilesJavaj2re1.4.2_06injavaw.exe
D:DVDodkodowanie plyt DVDHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://results.dashbar.com/search?c=27440&b=17862&t=0&ce=DI&m=NDc5NTQ3MDE4&ver=2.1.0.0
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 – BHO: (no name) – {02478D38–C3F9–4efb–9B51–7695ECA05670} – (no file)
O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – C:Program FilesSpybot – Search & DestroySDHelper.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: My &Search Bar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: (no name) – {EF99BD32–C1FB–11D2–892F–0090271D4F88} – (no file)
O4 – HKLM..Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [WinampAgent] E:odtwarzaczeWinampwinampa.exe
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [AQ3HelperStartUp] C:PROGRA~1AQUATI~1AQ3HEL~1.EXE /partner AQ3
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSSystem32spooldriversw32x863hpztsb05.exe
O4 – HKLM..Run: [APVXDWIN] "C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004APVXDWIN.EXE" /s
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_06injusched.exe
O4 – HKLM..Run: [New.net Startup] rundll32 C:WINDOWSNEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 – HKCU..Run: [Skype] "D: adekPhoneSkype.exe" /nosplash /minimized
O4 – HKCU..Run: [Gadu–Gadu] "D: adekGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O8 – Extra context menu item: Pobierz uźywając Download &Express'a – C:Program FilesDownload ExpressAdd_Url.htm
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O10 – Hijacked Internet access by New.Net
O16 – DPF: komentator – http://sport.onet.pl/komentator.cab
O16 – DPF: {00000000–7777–0704–0B53–2C8830E9FAEC} – http://gn.one2bill.de/soft/axload.cab
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=7fd1b1487ea24557e81cb1f266ef2780947d11d735d3f73d567bbcc1cd65aeb860d24e26488494fe11db2684f9909f72dc77fd77a214:2e5848e0a9d3ad577e6a6478c1291781
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099644152175
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab
O17 – HKLMSystemCCSServicesTcpip..{5ED607E6–1445–422C–8BF5–9AB04BA49227}: NameServer = 194.204.159.1,194.204.152.34
O23 – Service: Ati HotKey Poller – Unknown – C:WINDOWSSystem32Ati2evxx.exe
O23 – Service: ATI Smart – Unknown – C:WINDOWSsystem32ati2sgag.exe
O23 – Service: Panda Process Protection Service – Unknown – C:Program FilesCommon FilesPanda SoftwarePavShldpavprsrv.exe
O23 – Service: Panda anti–virus service – Unknown – C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004pavsrv51.exe
O23 – Service: Panda IManager Service – Panda Software Internacional – C:Program FilesPanda SoftwarePanda Titanium Antivirus 2004PsImSvc.exe
Odpowiedzi: 4
Po pierwsze zareczam Ci, ze odpowiedz dostalbys rowniez i w tym dziale gdzie Twoj post lezy od wczoraj. Po drugie, nie dla kaprysu ale zeby zachowac jakis porzadek, forum zostalo podzielone na odpowiednie dzialy a gadanie o "czesciej odwiedzanym" mija sie z prawda. Po trzecie, jesli w dalszym ciagu bedziesz sie trzymal tego blednego rozumowania, to obiecuje Ci, ze nie bedzie zadnej odpowiedzi z bardzo prozaicznego powodu – post umieszczony w nieodpowiednim dziale nie zostanie przeniesiony, lecz wyleci w kosmos. Mam nadzieje, ze zasady sa jasne i przyjmiesz je do wiadomosci i stosowania.
el nino odpowiedz jest bardzo prosta ten dzial jest odwiedzany najczesciej i jak sam zauwazyles odpowiedz nastapila w pare minut a o to mi wlasnie chodzilo i nie wiem w czym to ci przeszkadza???
Teraz skoro udzielono mi pomocy mozesz spokojnie moj post albo przeniesc do odpowiedniego dzialu albo skasowac jest to juz mi obojetne
Teraz skoro udzielono mi pomocy mozesz spokojnie moj post albo przeniesc do odpowiedniego dzialu albo skasowac jest to juz mi obojetne
tadzik, mozesz wytlumaczyc dlaczego ten temat wrzuciles do dzialu XP ? Nie przyjmuje odpowiedzi w rodzaju: "bo XP–ka uzywam".
Wylacz przywracanie
Pozbadz sie z loga i dysku:
Pozbadz sie New.Net'a
Urzyj uninstallera, link w archiwum
Pozbadz sie z loga i dysku:
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://results.dashbar.com/search?c=27440&b=17862&t=0&ce=DI&m=NDc5NTQ3MDE4&ver=2.1.0.0
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
O2 – BHO: (no name) – {02478D38–C3F9–4efb–9B51–7695ECA05670} – (no file)
O2 – BHO: myBar BHO – {0494D0D1–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: My &Search Bar – {0494D0D9–F8E0–41ad–92A3–14154ECE70AC} – C:Program FilesMyWaymyBar1.binMYBAR.DLL
O3 – Toolbar: (no name) – {EF99BD32–C1FB–11D2–892F–0090271D4F88} – (no file)
O4 – HKLM..Run: [New.net Startup] rundll32
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O10 – Hijacked Internet access by New.Net
O16 – DPF: {00000000–7777–0704–0B53–2C8830E9FAEC} – http://gn.one2bill.de/soft/axload.cab
O16 – DPF: {15AD4789–CDB4–47E1–A9DA–992EE8E6BAD6} – http://public.windupdates.com/get_file.php?bt=ie&p=7fd1b1487ea24557e81cb1f266ef2780947d11d735d3f73d567bbcc1cd65aeb860d24e26488494fe11db2684f9909f72dc77fd77a214:2e5848e0a9d3ad577e6a6478c1291781
Pozbadz sie New.Net'a
Urzyj uninstallera, link w archiwum
Strona 1 / 1