spyware, adware i chyba jeszcze troche :(
oj chyba jednak musze coś z tym zrobić :( proszę o pomoc ...
zrobiłam skanowanie pandą on–line (załączam raport)
zrobiłam takźe skanowanie programem Ad–Aware SE Personal (załączam obrazki)
a oto log z hijacka:
Logfile of HijackThis v1.97.7
Scan saved at 13:16:05, on 2005–02–19
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
D:ProgramyNorton Antivirus 2004 PL avapsvc.exe
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSMixer.exe
C:Program FilesPERFECT SERIESOptical Mouse3.0MOUSE32A.EXE
C:WINDOWSSystem32 undll32.exe
C:Program FilesGtdlsqCkrgb.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
D:Programykazaakazaalite.kpp
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSSystem32ctfmon.exe
D:ProgramyGadu–Gadugg.exe
C:Program FilesMultimedia Easy Keyboard NTeasykey.exe
D:ProgramyNorton Antivirus 2004 PLSAVScan.exe
D:ProgramyLavasoftAd–Aware SE PersonalAd–Aware.exe
C:WINDOWSexplorer.exe
C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE
D:ProgramyHiJackThisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wp.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.wp.pl/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O1 – Hosts: 217.96.35.130 auto.search.msn.com
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em220.dll (file missing)
O2 – BHO: (no name) – {00320615–B6C2–40A6–8F99–F1C52D674FAD} – C:WINDOWSlocalNRD.dll (file missing)
O2 – BHO: C:WINDOWSlbbho.dll – {0182F4ED–D55A–45C7–A93F–EA3718CCBE8C} – C:WINDOWSlbbho.dll
O2 – BHO: (no name) – {4A2AACF3–ADF6–11D5–98A9–00E018981B9E} – C:Program FilesNewDotNet ewdotnet4_85.dll
O2 – BHO: (no name) – {AEECBFDA–12FA–4881–BDCE–8C3E1CE4B344} – C:WINDOWSSystem32 vms.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – D:ProgramyNorton Antivirus 2004 PLNavShExt.dll
O2 – BHO: (no name) – {CE188402–6EE7–4022–8868–AB25173A3E14} – C:WINDOWSSystem32mscb.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – D:ProgramyNorton Antivirus 2004 PLNavShExt.dll
O4 – HKLM..Run: [C–Media Mixer] Mixer.exe /startup
O4 – HKLM..Run: [LWBMOUSE] C:Program FilesPERFECT SERIESOptical Mouse3.0MOUSE32A.EXE
O4 – HKLM..Run: [System32] "user32.exe" –user
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 – HKLM..Run: [BullsEye Network] C:Program FilesBullsEye Networkinargains.exe
O4 – HKLM..Run: [Internet Optimizer] "C:Program FilesInternet Optimizeroptimize.exe"
O4 – HKLM..Run: [kbgkbapye] C:WINDOWSSystem32zwzrxy.exe
O4 – HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 – HKLM..Run: [Amte] C:WINDOWSaduadx.exe
O4 – HKLM..Run: [Ucxsur] C:Program FilesGtdlsqCkrgb.exe
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [KAZAA] "D:Programykazaakpp.exe" "D:Programykazaakazaalite.kpp" /SYSTRAY
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe
O4 – HKCU..Run: [iIWiper] C:Program FilesiISystem WiperSystemWiper.exe m
O4 – HKCU..Run: [Gadu–Gadu] "D:ProgramyGadu–GaduPowergg.exe" /tray
O4 – Global Startup: Multimedia Easy Keyboard.lnk = C:Program FilesMultimedia Easy Keyboard NTeasykey.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://D:ProgramyMSOFFI~1OFFICE11EXCEL.EXE/3000
O9 – Extra button: Badanie (HKLM)
O9 – Extra button: Related (HKLM)
O9 – Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O16 – DPF: {02BCC737–B171–4746–94C9–0D8A0B2C0089} (Microsoft Office Template and Media Control) – http://office.microsoft.com/templates/ieawsdc.cab
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://fpdownload.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 – DPF: {31B7EB4E–8B4B–11D1–A789–00A0CC6651A8} (Cult3D ActiveX Player) – http://www.cult3d.com/download/cult.cab
O16 – DPF: {33564D57–0000–0010–8000–00AA00389B71} – http://download.microsoft.com/download/F/6/E/F6E491A6–77E1–4E20–9F5F–94901338C922/wmv9VCM.CAB
O16 – DPF: {9A9307A0–7DA4–4DAF–B042–5009F29E09E1} (ActiveScan Installer Class) – http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 – DPF: {9F1C11AA–197B–4942–BA54–47A8489BB47F} – http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38049.2264236111
O16 – DPF: {A9ED6AA2–D9D4–4D71–9586–E293E2E3580B} (GameDesire Marbies&Diamonds) – http://67.15.101.3/g_bin/pl/marbles_2_0_0_21.cab
O16 – DPF: {AE609930–A6EB–4A78–B7DA–B3200705FEBD} (Mophun Control) – http://www.mophun.com/codebase/mophun.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {F0BC061F–DAF9–4533–8011–53BCB4C10307} (Installations Assistent) – http://install.premiumzone.de/InstallationsAssistent.ocx
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C5} (GameDesire Snooker) – http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
jak to wszystko zobaczyłam to prawie spadłam z krzesła :? kompletnie nie wiem co mam teraz z tym wszystkim zrobić :( :( pomóźcie ... :(
zrobiłam skanowanie pandą on–line (załączam raport)
zrobiłam takźe skanowanie programem Ad–Aware SE Personal (załączam obrazki)
a oto log z hijacka:
Logfile of HijackThis v1.97.7
Scan saved at 13:16:05, on 2005–02–19
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
D:ProgramyNorton Antivirus 2004 PL avapsvc.exe
C:WINDOWSSystem32 vsvc32.exe
C:WINDOWSMixer.exe
C:Program FilesPERFECT SERIESOptical Mouse3.0MOUSE32A.EXE
C:WINDOWSSystem32 undll32.exe
C:Program FilesGtdlsqCkrgb.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
D:Programykazaakazaalite.kpp
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSSystem32ctfmon.exe
D:ProgramyGadu–Gadugg.exe
C:Program FilesMultimedia Easy Keyboard NTeasykey.exe
D:ProgramyNorton Antivirus 2004 PLSAVScan.exe
D:ProgramyLavasoftAd–Aware SE PersonalAd–Aware.exe
C:WINDOWSexplorer.exe
C:Program FilesCommon FilesMicrosoft SharedSource EngineOSE.EXE
D:ProgramyHiJackThisHijackThis.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wp.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.wp.pl/
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O1 – Hosts: 217.96.35.130 auto.search.msn.com
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em220.dll (file missing)
O2 – BHO: (no name) – {00320615–B6C2–40A6–8F99–F1C52D674FAD} – C:WINDOWSlocalNRD.dll (file missing)
O2 – BHO: C:WINDOWSlbbho.dll – {0182F4ED–D55A–45C7–A93F–EA3718CCBE8C} – C:WINDOWSlbbho.dll
O2 – BHO: (no name) – {4A2AACF3–ADF6–11D5–98A9–00E018981B9E} – C:Program FilesNewDotNet ewdotnet4_85.dll
O2 – BHO: (no name) – {AEECBFDA–12FA–4881–BDCE–8C3E1CE4B344} – C:WINDOWSSystem32 vms.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – D:ProgramyNorton Antivirus 2004 PLNavShExt.dll
O2 – BHO: (no name) – {CE188402–6EE7–4022–8868–AB25173A3E14} – C:WINDOWSSystem32mscb.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – D:ProgramyNorton Antivirus 2004 PLNavShExt.dll
O4 – HKLM..Run: [C–Media Mixer] Mixer.exe /startup
O4 – HKLM..Run: [LWBMOUSE] C:Program FilesPERFECT SERIESOptical Mouse3.0MOUSE32A.EXE
O4 – HKLM..Run: [System32] "user32.exe" –user
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 – HKLM..Run: [BullsEye Network] C:Program FilesBullsEye Networkinargains.exe
O4 – HKLM..Run: [Internet Optimizer] "C:Program FilesInternet Optimizeroptimize.exe"
O4 – HKLM..Run: [kbgkbapye] C:WINDOWSSystem32zwzrxy.exe
O4 – HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 – HKLM..Run: [Amte] C:WINDOWSaduadx.exe
O4 – HKLM..Run: [Ucxsur] C:Program FilesGtdlsqCkrgb.exe
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [KAZAA] "D:Programykazaakpp.exe" "D:Programykazaakazaalite.kpp" /SYSTRAY
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe
O4 – HKCU..Run: [iIWiper] C:Program FilesiISystem WiperSystemWiper.exe m
O4 – HKCU..Run: [Gadu–Gadu] "D:ProgramyGadu–GaduPowergg.exe" /tray
O4 – Global Startup: Multimedia Easy Keyboard.lnk = C:Program FilesMultimedia Easy Keyboard NTeasykey.exe
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://D:ProgramyMSOFFI~1OFFICE11EXCEL.EXE/3000
O9 – Extra button: Badanie (HKLM)
O9 – Extra button: Related (HKLM)
O9 – Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 – Extra button: Messenger (HKLM)
O9 – Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O16 – DPF: {02BCC737–B171–4746–94C9–0D8A0B2C0089} (Microsoft Office Template and Media Control) – http://office.microsoft.com/templates/ieawsdc.cab
O16 – DPF: {166B1BCA–3F9C–11CF–8075–444553540000} (Shockwave ActiveX Control) – http://fpdownload.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 – DPF: {31B7EB4E–8B4B–11D1–A789–00A0CC6651A8} (Cult3D ActiveX Player) – http://www.cult3d.com/download/cult.cab
O16 – DPF: {33564D57–0000–0010–8000–00AA00389B71} – http://download.microsoft.com/download/F/6/E/F6E491A6–77E1–4E20–9F5F–94901338C922/wmv9VCM.CAB
O16 – DPF: {9A9307A0–7DA4–4DAF–B042–5009F29E09E1} (ActiveScan Installer Class) – http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 – DPF: {9F1C11AA–197B–4942–BA54–47A8489BB47F} – http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38049.2264236111
O16 – DPF: {A9ED6AA2–D9D4–4D71–9586–E293E2E3580B} (GameDesire Marbies&Diamonds) – http://67.15.101.3/g_bin/pl/marbles_2_0_0_21.cab
O16 – DPF: {AE609930–A6EB–4A78–B7DA–B3200705FEBD} (Mophun Control) – http://www.mophun.com/codebase/mophun.cab
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 – DPF: {F0BC061F–DAF9–4533–8011–53BCB4C10307} (Installations Assistent) – http://install.premiumzone.de/InstallationsAssistent.ocx
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C5} (GameDesire Snooker) – http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
jak to wszystko zobaczyłam to prawie spadłam z krzesła :? kompletnie nie wiem co mam teraz z tym wszystkim zrobić :( :( pomóźcie ... :(
Odpowiedzi: 12
jeszcze jedno piszesz by "wyłączyć przywracanie systemu" a kiedy je moźna włączyć czy teź lepiej tego nie robić?
Pozdrówko
Mirek
Pozdrówko
Mirek
Nie "wylaczyc" a "wlaczyc". Czasami pliki ktore trzeba usunac maja atrybut "hidden" i explorer ich nie pokazuje.Wróblewski:
dlaczego trzeba wyłączyć "Pokazywanie przez system ukrytych plikow i folderow".
Bibliotek ktore sie usuwa, nalezy szukac w logach czy to HiJack, czy innych programow. Wyrejestrowuje sie po to, aby system ich juz nie uzywal i pozwolil je usunac.Proszę o wytłumaczenie o co chodzi z "Wyrejestrowywanie bibliotek
(...)
gdzie je szukać?
W DLLCACHE znajduja sie kopie plikow systemowych. Mozna go usunac, ale wtedy przy skanowaniu "sfc", instalacji programow, czy innych czynnosciach, system bedzie prosil o plyte XP.I jeszcze jedno pewnie teź naiwne pytanie ale trudno, katalog WINDOWSSYSTEM32DLLCACHE ma 397MB i zawiera 2340 folderów prawie wszystkie te same co w SYSTEM32 czy to normalne?
Bobi_robert zawsze zwraca uwagę by wyłączyć przywracanie systemu lecz nie wiem dlaczego trzeba wyłączyć "Pokazywanie przez system ukrytych plikow i folderow".
Proszę o wytłumaczenie o co chodzi z "Wyrejestrowywanie bibliotek
W Start/Uruchom wpisujemy:
Kod:
regsvr32 /u ...
W miejsce kropek (...) podajemy nazwe biblioteki
np: regsvr32 /u kgrwvgdk.dll " gdzie je szukać?
I jeszcze jedno pewnie teź naiwne pytanie ale trudno, katalog WINDOWSSYSTEM32DLLCACHE ma 397MB i zawiera 2340 folderów prawie wszystkie te same co w SYSTEM32 czy to normalne?
Pozdrówko
Mirek
Proszę o wytłumaczenie o co chodzi z "Wyrejestrowywanie bibliotek
W Start/Uruchom wpisujemy:
Kod:
regsvr32 /u ...
W miejsce kropek (...) podajemy nazwe biblioteki
np: regsvr32 /u kgrwvgdk.dll " gdzie je szukać?
I jeszcze jedno pewnie teź naiwne pytanie ale trudno, katalog WINDOWSSYSTEM32DLLCACHE ma 397MB i zawiera 2340 folderów prawie wszystkie te same co w SYSTEM32 czy to normalne?
Pozdrówko
Mirek
Dobra link do programu usuwajacego New.Net
http://www.new.net/support/uninstall6_38.exe
cooooo !!!!!!! boźe tylko nie to !!! w sobote jak tylko odpisaliście na mojego posta ściągnęłam właśnie ten program i do dzisiaj nie miałam netu !! nie wiedziałam co sie stało, dzisiaj dopiero dzwoniłam do administracji i po kilku godzinach czekania jakiś miły pan oddzwonił, powiedział co mam zrobić: ściągnąć program z tej strony www.spychecker.com/program/winsockxpfix.html i na szczęście wszystko juź działa.
więc do czego ten program New.Net wogóle słuźy ??????
Dobra link do programu usuwajacego New.Net
http://www.new.net/support/uninstall6_38.exe
Ad1: Usuwasz całe obydwa katalogi
Ad2: Pozbywasz sie plikow/katalogow tam wymienionych recznie a nastepnie w HJT zaznaczasz ptaszkiem te pozycje i fix checked
http://www.new.net/support/uninstall6_38.exe
Ad1: Usuwasz całe obydwa katalogi
Ad2: Pozbywasz sie plikow/katalogow tam wymienionych recznie a nastepnie w HJT zaznaczasz ptaszkiem te pozycje i fix checked
Sciagnij sobie programik do usuwania NEW NET, link podawany byl wielokrotnie w starszych postach.
szukałam tego programu i nic ...
czy te pliki :
C:Program FilesGtdlsqCkrgb.exe
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesInternet Optimizeractalert.exe
mam "tak po prostu" usunąć ? nie trzeba ich nigdzie wyrejestrowywać czy coś takiego ?? :?
i JAK to usunąć ??
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.wp.pl/
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O1 – Hosts: 217.96.35.130 auto.search.msn.com
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em220.dll (file missing)
O2 – BHO: (no name) – {00320615–B6C2–40A6–8F99–F1C52D674FAD} – C:WINDOWSlocalNRD.dll (file missing)
O2 – BHO: C:WINDOWSlbbho.dll – {0182F4ED–D55A–45C7–A93F–EA3718CCBE8C} – C:WINDOWSlbbho.dll
O2 – BHO: (no name) – {4A2AACF3–ADF6–11D5–98A9–00E018981B9E} – C:Program FilesNewDotNet ewdotnet4_85.dll
O2 – BHO: (no name) – {AEECBFDA–12FA–4881–BDCE–8C3E1CE4B344} – C:WINDOWSSystem32 vms.dll
O2 – BHO: (no name) – {CE188402–6EE7–4022–8868–AB25173A3E14} – C:WINDOWSSystem32mscb.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O4 – HKLM..Run: [System32] "user32.exe" –user
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [BullsEye Network] C:Program FilesBullsEye Networkinargains.exe
O4 – HKLM..Run: [Internet Optimizer] "C:Program FilesInternet Optimizeroptimize.exe"
O4 – HKLM..Run: [kbgkbapye] C:WINDOWSSystem32zwzrxy.exe
O4 – HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 – HKLM..Run: [Amte] C:WINDOWSaduadx.exe
O4 – HKLM..Run: [Ucxsur] C:Program FilesGtdlsqCkrgb.exe
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 – DPF: {A9ED6AA2–D9D4–4D71–9586–E293E2E3580B} (GameDesire Marbies&Diamonds) – http://67.15.101.3/g_bin/pl/marbles_2_0_0_21.cab
O16 – DPF: {AE609930–A6EB–4A78–B7DA–B3200705FEBD} (Mophun Control) – http://www.mophun.com/codebase/mophun.cab
O16 – DPF: {F0BC061F–DAF9–4533–8011–53BCB4C10307} (Installations Assistent) – http://install.premiumzone.de/InstallationsAssistent.ocx
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C5} (GameDesire Snooker) – http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
przeglądałam juź forum źeby dowiedzieć sie czegoś więcej, ale wszędzie jest tylko "usuń to i to" i juź, a ja kompletnie nic z tego nie wiem .. :?
Tia. Kregoslup masz sztywny ? :mrgreen:Ale takie cos jest zarezerwowae tylko dla płci pieknej poczawszy od wczoraj :mrgreen:
E tam, Ty o moje zdrowie sie nie boj :wink:
Zem zdrow jak ryba
Tia. Kregoslup masz sztywny ? :mrgreen:Ale takie cos jest zarezerwowae tylko dla płci pieknej poczawszy od wczoraj :mrgreen:
Zawsze jestem szybszy, bo sie kurna w tancu nie pierdziele :P .Update: EL był szybszy :wink:
Ale zawsze logi od dziewczyn sprawdza błyskawicznie :mrgreen:
Eee tam pitolisz :P gdybym nie powypisywał plikow/katalogow do usuniecia to zostałbys daleko z tyłu :wink:
Ale takie cos jest zarezerwowae tylko dla płci pieknej poczawszy od wczoraj :mrgreen:
Dla panow nie ma juz tak łatwo :lol:
Zawsze jestem szybszy, bo sie kurna w tancu nie pierdziele :P .Update: EL był szybszy :wink:
Ale zawsze logi od dziewczyn sprawdza błyskawicznie :mrgreen:
Wylacz przytwracanie systemu
Zakoncz procesy:
Ckrgb.exe
actalert.exe – 2 razy
Usun z dysku:
lbbho.dll
C:Program FilesNewDotNet
nvms.dll
mscb.dll
user32.exe
C:Program FilesBullsEye Network
C:Program FilesInternet Optimizer
zwzrxy.exe
conscorr.exe
aduadx.exe
C:Program FilesGtdlsq
FIX:
Zostaja jeszcze kontolki ActiveX (016) jesli ktoras nie jest twoja to usun
Update: EL był szybszy :wink:
Ale zawsze logi od dziewczyn sprawdza błyskawicznie :mrgreen:
Zakoncz procesy:
Ckrgb.exe
actalert.exe – 2 razy
Usun z dysku:
lbbho.dll
C:Program FilesNewDotNet
nvms.dll
mscb.dll
user32.exe
C:Program FilesBullsEye Network
C:Program FilesInternet Optimizer
zwzrxy.exe
conscorr.exe
aduadx.exe
C:Program FilesGtdlsq
FIX:
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.wp.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.wp.pl/
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O1 – Hosts: 217.96.35.130 auto.search.msn.com
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em220.dll (file missing)
O2 – BHO: (no name) – {00320615–B6C2–40A6–8F99–F1C52D674FAD} – C:WINDOWSlocalNRD.dll (file missing)
O2 – BHO: C:WINDOWSlbbho.dll – {0182F4ED–D55A–45C7–A93F–EA3718CCBE8C} – C:WINDOWSlbbho.dll
O2 – BHO: (no name) – {4A2AACF3–ADF6–11D5–98A9–00E018981B9E} – C:Program
FilesNewDotNet ewdotnet4_85.dll
O2 – BHO: (no name) – {AEECBFDA–12FA–4881–BDCE–8C3E1CE4B344} – C:WINDOWSSystem32 vms.dll
O2 – BHO: (no name) – {CE188402–6EE7–4022–8868–AB25173A3E14} – C:WINDOWSSystem32mscb.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O4 – HKLM..Run: [System32] "user32.exe" –user
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~1.DLL,NewDotNetStartup
e
O4 – HKLM..Run: [BullsEye Network] C:Program FilesBullsEye Networkinargains.exe
O4 – HKLM..Run: [Internet Optimizer] "C:Program FilesInternet Optimizeroptimize.exe"
O4 – HKLM..Run: [kbgkbapye] C:WINDOWSSystem32zwzrxy.exe
O4 – HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 – HKLM..Run: [Amte] C:WINDOWSaduadx.exe
O4 – HKLM..Run: [Ucxsur] C:Program FilesGtdlsqCkrgb.exe
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
Zostaja jeszcze kontolki ActiveX (016) jesli ktoras nie jest twoja to usun
Update: EL był szybszy :wink:
Ale zawsze logi od dziewczyn sprawdza błyskawicznie :mrgreen:
Sciagnij sobie programik do usuwania NEW NET, link podawany byl wielokrotnie w starszych postach.
Usun poniej toto:
C:Program FilesGtdlsqCkrgb.exe
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesInternet Optimizeractalert.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.wp.pl/
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O1 – Hosts: 217.96.35.130 auto.search.msn.com
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em220.dll (file missing)
O2 – BHO: (no name) – {00320615–B6C2–40A6–8F99–F1C52D674FAD} – C:WINDOWSlocalNRD.dll (file missing)
O2 – BHO: C:WINDOWSlbbho.dll – {0182F4ED–D55A–45C7–A93F–EA3718CCBE8C} – C:WINDOWSlbbho.dll
O2 – BHO: (no name) – {4A2AACF3–ADF6–11D5–98A9–00E018981B9E} – C:Program FilesNewDotNet ewdotnet4_85.dll
O2 – BHO: (no name) – {AEECBFDA–12FA–4881–BDCE–8C3E1CE4B344} – C:WINDOWSSystem32 vms.dll
O2 – BHO: (no name) – {CE188402–6EE7–4022–8868–AB25173A3E14} – C:WINDOWSSystem32mscb.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O4 – HKLM..Run: [System32] "user32.exe" –user
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [BullsEye Network] C:Program FilesBullsEye Networkinargains.exe
O4 – HKLM..Run: [Internet Optimizer] "C:Program FilesInternet Optimizeroptimize.exe"
O4 – HKLM..Run: [kbgkbapye] C:WINDOWSSystem32zwzrxy.exe
O4 – HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 – HKLM..Run: [Amte] C:WINDOWSaduadx.exe
O4 – HKLM..Run: [Ucxsur] C:Program FilesGtdlsqCkrgb.exe
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 – DPF: {A9ED6AA2–D9D4–4D71–9586–E293E2E3580B} (GameDesire Marbies&Diamonds) – http://67.15.101.3/g_bin/pl/marbles_2_0_0_21.cab
O16 – DPF: {AE609930–A6EB–4A78–B7DA–B3200705FEBD} (Mophun Control) – http://www.mophun.com/codebase/mophun.cab
O16 – DPF: {F0BC061F–DAF9–4533–8011–53BCB4C10307} (Installations Assistent) – http://install.premiumzone.de/InstallationsAssistent.ocx
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C5} (GameDesire Snooker) – http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab
Usun poniej toto:
C:Program FilesGtdlsqCkrgb.exe
C:Program FilesInternet Optimizeractalert.exe
C:Program FilesInternet Optimizeractalert.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.couldnotfind.com/search_page.html?&account_id=153472
R1 – HKCUSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=153472
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 – HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.wp.pl/
R3 – URLSearchHook: (no name) – _{CFBFAE00–17A6–11D0–99CB–00C04FD64497} – (no file)
O1 – Hosts: 217.96.35.130 auto.search.msn.com
O2 – BHO: (no name) – {00000010–6F7D–442C–93E3–4A4827C2E4C8} – C:WINDOWS em220.dll (file missing)
O2 – BHO: (no name) – {00320615–B6C2–40A6–8F99–F1C52D674FAD} – C:WINDOWSlocalNRD.dll (file missing)
O2 – BHO: C:WINDOWSlbbho.dll – {0182F4ED–D55A–45C7–A93F–EA3718CCBE8C} – C:WINDOWSlbbho.dll
O2 – BHO: (no name) – {4A2AACF3–ADF6–11D5–98A9–00E018981B9E} – C:Program FilesNewDotNet ewdotnet4_85.dll
O2 – BHO: (no name) – {AEECBFDA–12FA–4881–BDCE–8C3E1CE4B344} – C:WINDOWSSystem32 vms.dll
O2 – BHO: (no name) – {CE188402–6EE7–4022–8868–AB25173A3E14} – C:WINDOWSSystem32mscb.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O4 – HKLM..Run: [System32] "user32.exe" –user
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~1.DLL,NewDotNetStartup
O4 – HKLM..Run: [BullsEye Network] C:Program FilesBullsEye Networkinargains.exe
O4 – HKLM..Run: [Internet Optimizer] "C:Program FilesInternet Optimizeroptimize.exe"
O4 – HKLM..Run: [kbgkbapye] C:WINDOWSSystem32zwzrxy.exe
O4 – HKLM..Run: [conscorr] C:WINDOWSconscorr.exe
O4 – HKLM..Run: [Amte] C:WINDOWSaduadx.exe
O4 – HKLM..Run: [Ucxsur] C:Program FilesGtdlsqCkrgb.exe
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O16 – DPF: {1D4DB7D2–6EC9–47A3–BD87–1E41684E07BB} – http://imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 – DPF: {A9ED6AA2–D9D4–4D71–9586–E293E2E3580B} (GameDesire Marbies&Diamonds) – http://67.15.101.3/g_bin/pl/marbles_2_0_0_21.cab
O16 – DPF: {AE609930–A6EB–4A78–B7DA–B3200705FEBD} (Mophun Control) – http://www.mophun.com/codebase/mophun.cab
O16 – DPF: {F0BC061F–DAF9–4533–8011–53BCB4C10307} (Installations Assistent) – http://install.premiumzone.de/InstallationsAssistent.ocx
O16 – DPF: {FDDBE2B8–6602–4AD8–946D–94C5A32FA6C5} (GameDesire Snooker) – http://67.15.101.3/g_bin/pl/snooker_2_0_0_21.cab