HijackThis / ComboFix
Ova tema je vezana za HijackThis / ComboFix pod forumom Domaći Tutorijali, i deo je foruma Kompjuteri
-
- Član od
- Oct 2009
- Postova
- 1.598
#1
HijackThis / ComboFix
16-01-2010 23:09 HijackThis / ComboFix
Preuzmite HijackThis i sacuvajte ga negde u zasebnom folderu (npr. C:\HiJackThis\HiJackThis.exe, ili u novom folderu na desktopu). Zaseban folder je bitan zbog cuvanja rezervnih kopija svih ispravki koje napravite pomocu programa HiJackThis, a u njemu se cuva i log fajl od poslednjeg skeniranja, pa ga tu uvek sa lakocom mozete pronaci ako zatreba.
Mnogi savremeni virusi prepoznaju antivirusne programe po imenu, i ometaju ili u potpunosti blokiraju njihov rad, pa je pozeljno da "HiJackThis.exe" preimenujete u bilo sta drugo, npr. "vase_ime.exe", "abc123.exe", "blabla.exe" i sl. Pokrenite tako priemenovani fajl, i pojavice se sledeci prozor:
Odaberite Do a system scan and save a logfile. Posle kratkog skeniranja pojavljuje Vam se sledeci prozor:
Iskopirajte sadrzaj fajla koji se pojavio (iz Notepad-a) pomocu Edit > Select All i Edit > Copy (ili CTRL+A i CTRL+C sa tastature) u novu poruku na ovom Forumu. Vazno je da ceo izvestaj bude iskopiran, a ne samo deo koji Vama zbog neceg deluje sumnjivo.
Obuka za pravilno koriscenje programa HiJackThis traje nekoliko meseci, i svaka izmena, ma koliko trivijalno ona izgledala, moze dovesti do problema u radu sa nekim Vama vaznim programom ili celim racunarom.
-
-
-
Uz moderatorku Anu...
- Član od
- May 1971
- Lokacija
- Centar sveta
- Postova
- 43.454
#2
17-01-2010 17:30 O svemu tome....... malo detaljnija objasnjenja,korak po korak imaju i ovde.......
Antivirusi ,alati,saveti za zastitu....
-
Zahvalili se:
-
- Član od
- Aug 2009
- Postova
- 2
#3
30-01-2010 14:19 Evo sta je HijackThis nasao kod mene:
Sta kazete?Kod:Samo registrovani članovi mogu vidjeti sadržaj ;)
- Uz moderatorku Anu...
- Član od
- May 1971
- Lokacija
- Centar sveta
- Postova
- 43.454
#4
31-01-2010 13:56 Sistem ti je Ok........imas samo jednu spornu tacku u njemu.......
Uostalom imas hijackthis.log fail pa pogledaj sam......uploaduj ga na adresi......ako nemas ga,kompletan rezultat iskopiraj u Notepad i usnimi ga sa imenom hijackthis.log
ako neznas kako.......obidji ovaj deo foruma.......post 7Kod:Samo registrovani članovi mogu vidjeti sadržaj ;)
Antivirusi ,alati,saveti za zastitu....
Pozdrav.......
-
- Član od
- Oct 2009
- Lokacija
- u svom svetu
- Postova
- 187
#5
05-02-2010 21:45 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:53 PM, on 2/5/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerServi ce.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper. exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.ex e
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
E:\opera.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\end user\Desktop\esculap.exe\majce.exe.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Bing:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo!
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Yahoo!
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Yahoo! SearchBar Home Page
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = Bing:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersio n\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim. dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\PROGRA~1\TEXTware\QUICKF~1\PlugIns\IEHelp. dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingle Instance.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RTHDCPL] "RTHDCPL.EXE"
O4 - HKLM\..\Run: [Alcmtr] "ALCMTR.EXE"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper. exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\WINDOWS\system32\NeroCheck.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe" -osboot
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.ex e" /startintray
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [QuickPhrase] "C:\Program Files\TypingMaster\quickphrase\quickphrase.ex e"
O4 - HKCU\..\Run: [YUHunt] "C:\Program Files\Your Uninstaller 2010\urmain.exe" -hunter
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Update Service (gupdate1c9bb30dac12e4c) (gupdate1c9bb30dac12e4c) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (Anti Virus & Anti Spyware Security Software for Home & Business | Webroot) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerServi ce.exe
--
End of file - 9305 bytes
Ovo je nasao kod mene.Ako imate savet kazite.Poslednji izmenio majale; 05-02-2010 u 21:49.
- Uz moderatorku Anu...
- Član od
- May 1971
- Lokacija
- Centar sveta
- Postova
- 43.454
#6
05-02-2010 22:23 Dve sporne tacke u sistemu.......pa izvoli pogledaj......ostalo je OK....
-
- Član od
- Apr 2009
- Postova
- 846
#7
05-02-2010 22:33 Koji te problem muci?
Prvobitno napisao majale 
See Ya In Anotha Life, Brotha !
-
- Član od
- Oct 2009
- Lokacija
- u svom svetu
- Postova
- 187
#8
rezultat
05-02-2010 22:51 BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKLM\..\Run: [Alcmtr] "ALCMTR.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O23 - Service: Office Source Engine (ose) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (file missing)
Meni je ovo obelezio crvenim ali ne znam kako se skenira
- Uz moderatorku Anu...
- Član od
- May 1971
- Lokacija
- Centar sveta
- Postova
- 43.454
#9
05-02-2010 23:40 Ovako.....ispisacu sta sta znaci ali evo za sada......
O3 - Internet Explorer toolbars...(imas neku gresku u njemu i treba popraviti)....
O4 - Autoloading program u Registry..Koristi Startup Popis, pronadji i vidi o cemu se radi....
BHO- imas neki ostecen kljuc u registru.....verovatno ovaj sto je napisan.....
Ovo zadnje neznam ni sam......u pitanju je neki fajl zabaceni koji neznam ni sam sta predstavlja....Microsoft shared...kakvo sarovanje???
Hm.......obidji ovde da nije neki spuware ili proces task???
nisam siguran.....Kod:Samo registrovani članovi mogu vidjeti sadržaj ;)
-
- Član od
- Oct 2009
- Lokacija
- u svom svetu
- Postova
- 187
#10
08-02-2010 22:08 Malo da popricam sa vama:
Skenirala sa Regestri Mechanic i cini mi se da brze otvara stranice,pre neki dan sa ad Aware nasao on search hijack i yieldmenager cookie a danas nista,kad skeniram sa SpybotSearch and Destroy uvek nadje DSO Exploit,Double Click i Avenue A.Ja sam imala problema,reinstaliran je i imam Back up. Takodje imam precice na tastaturi kojima sam stavila drugo ime kako ste rekli i ne znam sta sad predstavljaju a promenile su izgled.
Koristim Avast i sta znaci kada se pojavi plavi kvadrat jel se on to sam updatuje?
Odgovor sa citatom 
Pravila postovanja
- Vi ne možete da započinjete nove teme
- Vi ne možete da odgovarate na postove
- Vi ne možete da kačite priloge
- Vi ne možete da menjate svoje postove