Log z HijackThis
Oto log. Jeśli ktoś moźe, to niech napiszę co mam usunąć
Logfile of HijackThis v1.99.0
Scan saved at 17:58:12, on 2005–01–04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1NORTON~1 avapw32.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:Program FileseDonkey2000eDonkey2000.exe
C:WINDOWSsystem32ctfmon.exe
D:ProgramyggGadu–Gadugg.exe
C:Program FilesNorton AntiVirus avapsvc.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wuauclt.exe
D:InstalkihijackthisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://minisearch.startnow.com/
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.pl/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://minisearch.startnow.com/
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://minisearch.startnow.com/
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://minisearch.startnow.com/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: HyperSearchHook – {E55B686C–F56D–480A–804D–220289B66C5D} – C:Program FilesCommon FilesHyperbarHyperbarSS3.dll
O2 – BHO: (no name) – {336FD78C–A7D7–2253–DB52–46321F5330B3} – C:DOCUME~1DudzikDANEAP~1UPTICK~1Active64.exe
O2 – BHO: HyperBHO – {4B2F5308–2CB0–40E2–8030–59936ED5D22C} – C:Program FilesCommon FilesHyperbarHyperbar.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~1 avapw32.exe
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 – HKLM..Run: [eDonkey2000] "C:Program FileseDonkey2000eDonkey2000.exe" –t
O4 – HKLM..Run: [Plan Sect Owns Upload] C:Documents and SettingsAll UsersDane aplikacjiCakeBalmPlanSectpop tick.exe
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [Gadu–Gadu] "D:ProgramyggGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [antilogo] C:DOCUME~1DudzikDANEAP~1STORET~1Amenloud.exe
O4 – Global Startup: Reboot.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O23 – Service: Norton AntiVirus Auto Protect Service – Symantec Corporation – C:Program FilesNorton AntiVirus avapsvc.exe
O23 – Service: ScriptBlocking Service – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
Logfile of HijackThis v1.99.0
Scan saved at 17:58:12, on 2005–01–04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
C:PROGRA~1NORTON~1 avapw32.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:Program FileseDonkey2000eDonkey2000.exe
C:WINDOWSsystem32ctfmon.exe
D:ProgramyggGadu–Gadugg.exe
C:Program FilesNorton AntiVirus avapsvc.exe
C:WINDOWSsystem32wscntfy.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32wuauclt.exe
D:InstalkihijackthisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://minisearch.startnow.com/
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.pl/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://minisearch.startnow.com/
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://minisearch.startnow.com/
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://minisearch.startnow.com/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: HyperSearchHook – {E55B686C–F56D–480A–804D–220289B66C5D} – C:Program FilesCommon FilesHyperbarHyperbarSS3.dll
O2 – BHO: (no name) – {336FD78C–A7D7–2253–DB52–46321F5330B3} – C:DOCUME~1DudzikDANEAP~1UPTICK~1Active64.exe
O2 – BHO: HyperBHO – {4B2F5308–2CB0–40E2–8030–59936ED5D22C} – C:Program FilesCommon FilesHyperbarHyperbar.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton AntiVirusNavShExt.dll
O4 – HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~1 avapw32.exe
O4 – HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 – HKLM..Run: [eDonkey2000] "C:Program FileseDonkey2000eDonkey2000.exe" –t
O4 – HKLM..Run: [Plan Sect Owns Upload] C:Documents and SettingsAll UsersDane aplikacjiCakeBalmPlanSectpop tick.exe
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [Gadu–Gadu] "D:ProgramyggGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [antilogo] C:DOCUME~1DudzikDANEAP~1STORET~1Amenloud.exe
O4 – Global Startup: Reboot.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOfficeOSA9.EXE
O9 – Extra button: Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – {FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O23 – Service: Norton AntiVirus Auto Protect Service – Symantec Corporation – C:Program FilesNorton AntiVirus avapsvc.exe
O23 – Service: ScriptBlocking Service – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
Odpowiedzi: 4
Dzięki za pomoc...
ldmarion:
nie mogę wyjerestrować, bo pisze "nie moźna odnaleść określonego modułu". Chyba źe robię to źle (przez start > uruchom...). I nie wiem jak usunąć pliki w rejestrze, albo czym?? Z góry dzięki za odpowiedz.
A istnieja jeszcze wogole te pliki :?: Dzialasz dobrze poprzez start>uruchom. Jesli nie da sie normalnie to sprobuj w trybie awaryjnym (F8 podczas startu systemu). A co do tych kluczy (w uruchom wpisz regedit, wejdziesz wtedy do edytora rejestru) to szukasz identyfikatorow (tylko sie nie pomyl) ktore maja ciag cyfr w takich {} nawiasach i wystepuja po ukosniku ()
nie mogę wyjerestrować, bo pisze "nie moźna odnaleść określonego modułu". Chyba źe robię to źle (przez start > uruchom...). I nie wiem jak usunąć pliki w rejestrze, albo czym?? Z góry dzięki za odpowiedz.
Wylacz przywracanie. Wyrejestrowac biblioteki dll HyperbarSS3.dll i Hyperbar.dll (w taki sposob: regsvr32 /u C:Program FilesCommon FilesHyperbarHyperbarSS3.dll i usunac je razem z katalogami). Usun nastepujace klucze w rejestrze:
Na koniec fixnij (przycisk "fix chcecked) ponizsze pozycje
HKEY_CLASSES_ROOTclsid{1bc1fc4b–b0d2–4d8d–9307–2e40e2a8c257}
HKEY_CLASSES_ROOTclsid{4b2f5308–2cb0–40e2–8030–59936ed5d22c}
HKEY_CLASSES_ROOTsoftwaremicrosoftwindowscurrentversionexplorerrowser helper objects{4b2f5308–2cb0–40e2–8030–59936ed5d22c}
HKEY_LOCAL_MACHINEsoftwareclassesclsid{1bc1fc4b–b0d2–4d8d–9307–2e40e2a8c257}
HKEY_LOCAL_MACHINEsoftwareclassesclsid{4b2f5308–2cb0–40e2–8030–59936ed5d22c}
HKEY_LOCAL_MACHINEsoftwaremicrosoftinternet explorer oolbar{1bc1fc4b–b0d2–4d8d–9307–2e40e2a8c257}
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorerrowser helper objects{4b2f5308–2cb0–40e2–8030–59936ed5d22c}
Na koniec fixnij (przycisk "fix chcecked) ponizsze pozycje
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://minisearch.startnow.com/
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.pl/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://minisearch.startnow.com/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://minisearch.startnow.com/
R1 – HKLMSoftwareMicrosoftInternet ExplorerSearch,Default_Search_URL = http://minisearch.startnow.com/
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://minisearch.startnow.com/
R0 – HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch = http://minisearch.startnow.com/
R3 – URLSearchHook: HyperSearchHook – {E55B686C–F56D–480A–804D–220289B66C5D} – C:Program FilesCommon FilesHyperbarHyperbarSS3.dll
O2 – BHO: HyperBHO – {4B2F5308–2CB0–40E2–8030–59936ED5D22C} – C:Program FilesCommon FilesHyperbarHyperbar.dll
O4 – Global Startup: Reboot.exe
Strona 1 / 1