POMOCY

[MOLU]

Logfile of HijackThis v1.99.1
Scan saved at 21:35:04, on 2006-11-22
Platform: Windows XP(WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
Crogram FilesAheadInCDInCDsrv.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32wdfmgr.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
CROGRA~1NEOSTR~1CnxMon.exe
Crogram FilesThomsonSpeedTouch USBDragdiag.exe
Crogram FilesATI TechnologiesATI.ACEcli.exe
Crogram FilesCyberLinkPowerDVDPDVDServ.exe
C:program fileszangozango.exe
Crogram FilesAheadInCDInCD.exe
Crogram FilesDAEMON Toolsdaemon.exe
C:WINDOWSSystem32svcchost.exe
C:WINDOWSsystem32winsrcv.exe
C:WINDOWSsystem32lssrvc.exe
C:WINDOWSSystem32wuauclt.exe
Crogram FilesNeostrada TPNeostradaTP.exe
Crogram FilesNeostrada TPComComp.exe
Crogram FilesNeostrada TPWatch.exe
Crogram FilesInternet ExplorerIEXPLORE.EXE
Crogram FilesOutlook Expressmsimn.exe
Crogram FilesGadu-Gadugg.exe
Cocuments and SettingsMolikPulpithijackthis.com

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - CROGRA~1NEOSTR~1SEARCH~1.DLL
F2 - REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSSystem32ntos.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - Crogram FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - Crogram FilesMyGlobalSearchbar1.binMGSBAR.DLL
O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5E315789FA575760EA83FA5EF80752B94E2DF79597C462A36CE - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:program fileszangozangohook.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - Crogram FilesMyGlobalSearchbar1.binMGSBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O4 - HKLM..Run: [WooCnxMon]CROGRA~1NEOSTR~1CnxMon.exe
O4 - HKLM..Run: [SpeedTouch USB Diagnostics]"Crogram FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 - HKLM..Run: [WOOWATCH]CROGRA~1NEOSTR~1Watch.exe
O4 - HKLM..Run: [ATIPTA]Crogram FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..Run: [ATICCC]"Crogram FilesATI TechnologiesATI.ACEcli.exe" runtime
O4 - HKLM..Run: [RemoteControl]"Crogram FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [zango]"c:program fileszangozango.exe"
O4 - HKLM..Run: [Cmaudio]RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM..Run: [InCD]Crogram FilesAheadInCDInCD.exe
O4 - HKLM..Run: [NeroFilterCheck]C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [DAEMON Tools]"Crogram FilesDAEMON Toolsdaemon.exe" -lang 1033
O4 - HKLM..Run: [msvcc25]svcchost.exe
O4 - HKLM..RunServices: [mysvcig38]mysvcc.exe
O4 - HKLM..RunServices: [msvcc25]svcchost.exe
O4 - HKCU..Run: [Gadu-Gadu]"Crogram FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [Skype]"Crogram FilesSkypePhoneSkype.exe" /nosplash /minimized
O4 - HKCU..Run: [vssl2]C:WINDOWSsystem32winsrcv.exe
O4 - HKCU..Run: [chsr]C:WINDOWSsystem32lssrvc.exe
O4 - Global Startup: Microsoft Office.lnk = Crogram FilesMicrosoft OfficeOfficeOSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra ''Tools'' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} (MainControl Class) -

[Aby zobaczyć linki, zarejestruj się tutaj]

O17 - HKLMSystemCCSServicesTcpip..{3AA4117B-0F03-40EA-9E82-39D51A09291D}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: rpcc - C:WINDOWSSystem32rpcc.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - Crogram FilesAheadInCDInCDsrv.exe
O23 - Service: License Management Service ESD - element5 - Crogram FilesCommon Fileselement5 SharedServiceLicence Manager ESD.exe

[Serafin]

Startujesz do trybu awaryjnego, wyłączasz przywracanie systemu,
kasujesz pogrubionepliki/foldery ręcznie z dysku, wpisy usuwasz Hijackiem

F2 - REG:system.ini: UserInit=C:WINDOWSsystem32userinit.exe,C:WINDOWSSystem32 ntos.exe ,
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - Crogram Files MyGlobalSearch bar1.binMGSBAR.DLL
O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5E315789FA575760EA83FA5EF80752B94E2DF79597C462A36CE - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:program fileszangozangohook.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - Crogram FilesMyGlobalSearchbar1.binMGSBAR.DLL
O4 - HKLM..Run: [zango]"c:program files zango zango.exe"
O4 - HKLM..Run: [msvcc25] svcchost.exe
O4 - HKLM..RunServices: [mysvcig38] mysvcc.exe
O4 - HKLM..RunServices: [msvcc25]svcchost.exe
O4 - HKCU..Run: [vssl2]C:WINDOWSsystem32 winsrcv.exe
O4 - HKCU..Run: [chsr]C:WINDOWSsystem32 lssrvc.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra ''Tools'' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O20 - Winlogon Notify: rpcc - C:WINDOWSSystem32rpcc.dll

Otwórz notatnik i wklej w nim to:

CD C:WINDOWSsystem32
DEL rpcc.dll

Zmień rozszerzenie na: wszystkie pliki i zapisz pod nazwą FIX.BAT


Jeszcze raz otwórz notatnik i wklej w nim to:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinlogonNotifyrpcc]

Zmień rozszerzenie na: wszystkie pliki i zapisz pod nazwą FIX.REG


Odpalasz pliki FIX.REG i FIX.BAT w trybie awaryjnym i wyłączonym przywracaniem systemu

Potem dajesz nowy log z hijacka.