Proszę o sprawdzenie

[taires]

Logfile of HijackThis v1.99.1 Scan saved at 21:40:24, on 2005-09-08 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\inet20081\services.exe C:\Program Files\ISTsvc\istsvc.exe C:\Program Files\Winamp\winampa.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\SurfAccuracy\SAcc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Program Files\BullsEye Network\bin\bargains.exe C:\WINDOWS\System32\atwtusb.exe c:\progra~1\intern~1\iexplore.exe C:\WINDOWS\pcfqts.exe C:\WINDOWS\System32\qwqqihvs.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\System32\ctfmon.exe C:\windows\kcqmxyl.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\taskmgr.exe C:\WINDOWS\explorer.exe C:\Program Files\Neostrada TP\NeostradaTP.exe C:\Program Files\Neostrada TP\ComComp.exe C:\Program Files\Neostrada TP\Watch.exe C:\WINDOWS\mm1.exe C:\totalcmd\TOTALCMD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\DOCUME~1\aga\USTAWI~1\Temp_tc\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://wind-find4u.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://wind-find4u.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://wind-find4u.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL F2 - REG:system.ini: Shell=explorer.exe “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe” F3 - REG:win.ini: run=C:\WINDOWS\inet20081\services.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20081\3.00.08.dll O2 - BHO: (no name) - {87E2D510-6779-2D99-A887-5A8894B6F5F3} - C:\DOCUME~1\aga\DANEAP~1\AMOKMA~1\TYPEAXIS.exe O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll O4 - HKLM…\Run: [iST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM…\Run: [sysMemory manager] c:\windows\system32\mdms.exe O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM…\Run: [upload proc ante iso] C:\Documents and Settings\All Users\Dane aplikacji\BEEPDEADUPLOADPROC\Stopbias.exe O4 - HKLM…\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM…\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKLM…\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM…\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM…\Run: [msresearch] C:\WINDOWS\tool3.exe O4 - HKLM…\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM…\Run: [iMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32 O4 - HKLM…\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM…\Run: [CloneCDTray] “C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe” O4 - HKLM…\Run: [CloneCDElbyCDFL] “C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe” /L ElbyCDFL O4 - HKLM…\Run: [bullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM…\Run: [atwtusb] atwtusb.exe beta O4 - HKLM…\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe O4 - HKLM…\Run: [6eaIVNm] C:\WINDOWS\pcfqts.exe O4 - HKLM…\Run: [6eaIV÷h$ćÄőö/ŘG%)ßC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\pcfqts.exe O4 - HKLM…\Run: [qwqqihvs] C:\WINDOWS\System32\qwqqihvs.exe O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inet20081\services.exe O4 - HKLM…\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe O4 - HKCU…\Run: [Windows installer] msupdate32.exe -run C:\winstall.exe O4 - HKCU…\Run: [shell] “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe” O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Exit Gram] C:\DOCUME~1\aga\DANEAP~1\ERRORS~1\nurbmeal.exe O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [umhubih] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [qwqqihvs] C:\WINDOWS\System32\qwqqihvs.exe O4 - HKCU…\Run: [xp_system] C:\WINDOWS\inet20081\services.exe O4 - HKCU…\Run: [bbdycbg] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [qdvcuhm] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [lbphbbb] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [ousqvpm] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [akqrqcr] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [hgfrvcd] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [aavfgqh] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [mwuaddm] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [tsedwto] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [pksmiuu] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [lkcbnqc] c:\windows\kcqmxyl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Distiller Assistant 3.01.lnk = C:\Acrobat3\Distillr\DISTASST.EXE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O15 - Trusted Zone: http://ny.contentmatch.net (HKLM) O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares … cracks.cab O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.172.102/336//main.chm::/update.exe O17 - HKLM\System\CCS\Services\Tcpip…{D20FFB54-EBF9-4645-A9D6-DA5E1296BD9C}: NameServer = 194.204.152.34 217.98.63.164 O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Usługa Autoochrony w programie Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

:oops:

[Gutek]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://wind-find4u.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://wind-find4u.com/sp.htm R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://wind-find4u.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://195.95.218.172/index.php O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - C:\WINDOWS\inet20081\3.00.08.dll O2 - BHO: (no name) - {87E2D510-6779-2D99-A887-5A8894B6F5F3} - C:\DOCUME~1\aga\DANEAP~1\AMOKMA~1\TYPEAXIS.exe O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\color=red]ISTbar[\istbarcm.dll O4 - HKLM…\Run: [sysMemory manager] c:\windows\system32\mdms.exe O4 - HKLM…\Run: [upload proc ante iso] C:\Documents and Settings\All Users\Dane aplikacji\BEEPDEADUPLOADPROC\Stopbias.exe O4 - HKLM…\Run: [surfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM…\Run: [msresearch] C:\WINDOWS\tool3.exe O4 - HKLM…\Run: [bullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM…\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe O4 - HKLM…\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe O4 - HKLM…\Run: [6eaIVNm] C:\WINDOWS\pcfqts.exe O4 - HKLM…\Run: [6eaIV÷h$ćÄőö/ŘG%)ßC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\ pcfqts.exe O4 - HKLM…\Run: [qwqqihvs] C:\WINDOWS\System32\qwqqihvs.exe O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inet20081\services.exe O4 - HKLM…\Run: [PSGuard] C:\Program Files\PSGuard\PSGuard.exe O4 - HKCU…\Run: [Windows installer] msupdate32.exe -run C:\winstall.exe O4 - HKCU…\Run: [umhubih] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [qwqqihvs] C:\WINDOWS\System32\qwqqihvs.exe O4 - HKCU…\Run: [xp_system] C:\WINDOWS\inet20081 \services.exe O4 - HKCU…\Run: [bbdycbg] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [qdvcuhm] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [lbphbbb] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [ousqvpm] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [akqrqcr] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [hgfrvcd] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [aavfgqh] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [mwuaddm] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [tsedwto] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [pksmiuu] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [lkcbnqc] c:\windows\kcqmxyl.exe O4 - HKCU…\Run: [Exit Gram] C:\DOCUME~1\aga\DANEAP~1\ERRORS~1\nurbmeal.exe O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O15 - Trusted Zone: http://ny.contentmatch.net (HKLM) O16 - DPF: {7C559105-9ECF-42B8-B3F7-832E75EDD959} (Installer Class) - http://www.xxxtoolbar.com/ist/softwares … cracks.cab O16 - DPF: {D8A8A7F1-53EF-41F2-B44D-F3E2E595DC27} - ms-its:mhtml:file://C:\MAIN.MHT!http://69.50.172.102/336//main.chm::/update.exe

1. Wyłączyć Przywracanie systemu w XP TU

2. Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).

3. Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte. Dodatkowo O15 może będzie stawiać opór więc ściągnij KillTrusted 0.7

4. Skasować z dysku pliki i foldery, które podkreśliłem na czerwono

5. Dokończyć skanerami online - Scanery do wyboru

6. Pokazać nowy log

FxIstbar.exe. to naprawiacz do ISTbar , uzyj jego

CWS.Systime Removal 3.5 tez użyj

Ale życie pok