|
|||||||||||
08.08.2004., 15:56
|
#1 |
|
Registered User
Datum registracije: Jul 2004
Lokacija: Rijeka
Postovi: 5
|
hijackthis
Please can you tell me what I should fix from this log made with Hijack This? Thanks for your help. Logfile of HijackThis v1.98.1 Scan saved at 13:29:42, on 8.8.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Winamp\Winampa.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\WINDOWS\System32\carpserv.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\iexplore.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Spyware Doctor\spydoctor.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\COMPA\Local Settings\Temp\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = c:\searchpage.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COMPA\LOCALS~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe O4 - HKCU\..\Run: [PopUpStopperProfessional] C:\PROGRA~1\PANICW~1\POP-UP~2\PopUpStopperProfessional.exe O4 - HKCU\..\Run: [DesertSetup.exe] C:\PROGRA~1\DESERT~1.EXE /r O4 - HKCU\..\Run: [iexplore] C:\WINDOWS\System32\iexplore.exe O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q O4 - Global Startup: Microsoft Office.lnk = C:\Office\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://hr.trendmicro-europe.com/ente...secall_pre.php (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O13 - DefaultPrefix: c:\searchpage.html?page= O13 - WWW Prefix: c:\searchpage.html?page= O13 - Home Prefix: c:\searchpage.html?page= O13 - Mosaic Prefix: c:\searchpage.html?page= O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho.../yinst0401.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {7ED7005B-4AF6-4CFF-9AE0-F243C4B8260F} (HouseCallButton.setup) - http://de.trendmicro-europe.com/file...CallButton.CAB O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...54/mcfscan.cab |
|
|
|
10.08.2004., 09:19
|
#2 |
|
Ekspert iz sjene ...
Datum registracije: Nov 2001
Lokacija: New Eden
Postovi: 3,801
|
Well .... Im no expert on Hijack this - BUT. Nastavimo na hrvatskom - obzirom da si iz Rijeke, a ovo je HR forum i site, samo na .com domeni  Anyway .... Ove ljepote lagano natjeraju IE da koriste cool web search isl. sranja... R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = c:\searchpage.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html O13 - DefaultPrefix: c:\searchpage.html?page= O13 - WWW Prefix: c:\searchpage.html?page= O13 - Home Prefix: c:\searchpage.html?page= O13 - Mosaic Prefix: c:\searchpage.html?page= Za ove sam 100% siguran da su hijackeri i slični malaware, pop upovi isl. Sumnjam na još par, ali ima pametnijih od mene u tom dijelu - pa nek se muće  Ali ova .... searchpage..... sranja slobodno makni. Usput - skini Adaware na ovoj adresi Napravi update i skeniraj za razna sranja  |
|
|
|
|
|
|
|
Oglas
|
|
|
11.08.2004., 12:30
|
#3 |
|
Moderator
Datum registracije: Aug 2003
Lokacija: Zagreb
Postovi: 3,193
|
Vidim da si pokrenuo Hijacka iz privremenog direktorija pa prije nego pocnes sredjivati stvari kopiraj ga u neki stalni direktorij tipa C:\Program files\HijackThis kako bi mogao napraviti backup Izgasi Proces (stisnes CTRL+ALT+DEL pa u TaskManageru stisnes "Processes", desni klik na proces koji treba izgasiti i izaberes "End Process"): C:\WINDOWS\System32\iexplore.exe ^^ Ako ti je Internet explorer upaljen (a je) onda ces imati dva filea koji se tako zovu pa izgasi onog koji koristi manje memorije (pise ti sa strane u TaskManageru). Sredi: R1 - HKCU\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer,Search = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = c:\searchpage.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = c:\searchpage.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\COMPA\LOCALS~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = c:\searchpage.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = c:\searchpage.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank O4 - HKCU\..\Run: [DesertSetup.exe] C:\PROGRA~1\DESERT~1.EXE /r O4 - HKCU\..\Run: [iexplore] C:\WINDOWS\System32\iexplore.exe O9 - Extra button: TREND MICRO HouseCall - {2B5EA4F8-620A-4A8B-B003-4C8C5EBEA826} - http://hr.trendmicro-europe.com/ent...usecall_pre.php (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) Izbrisi: C:\WINDOWS\System32\iexplore.exe C:\PROGRA~1\DESERT~1.EXE
__________________
|
|
|
|
|
|
|
|
Oglas
|
|
 |
|
|
