PROSZE!! LOG!!

[Gość: login_niedostepny]

sciagnelam cos z muła i komp i zamula;> nie da sie prawie nic zrobic, juz
widze ze cos jest nie tak, ale nie mam pewnosci i nie chce sama wywalac,
niech ktos zerknie...

Logfile of HijackThis v1.99.1
Scan saved at 22:21:59, on 2005-11-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
D:\Install\Avant Browser\avant.exe
D:\Install\TLEN\tlen.exe
C:\Documents and Settings\KACHA\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program
Files\NewDotNet\newdotnet6_98.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-
716BA50C19C7} - C:\Program Files\Google\Web
Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-
C89982D87CBF} - C:\Program Files\Google\Web
Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1
\NEWDOT~2.DLL,ClientStartup -s
O4 - Startup: TClock.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box -
D:\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera -
D:\Install\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam -
D:\Install\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Otwórz w nowym Avant Browser - D:\Install\Avant
Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... -
D:\Install\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - D:\Install\Avant
Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - D:\Install\Avant Browser\Search.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} -
skaner.mks.com.pl/SkanerOnline.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY
Shared\Service\Boonty.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program
Files\TGTSoft\StyleXP\StyleXPService.exe

[login_niedostepny]

wyrzucilam pare wpisow ktore wydaly mi sie niewlasciwe, ale 10-tki nie chcialy
sie usunac ani z hijacka, ani spybotem ani adawarem (mimo sugestii hijacka zeby
uzyc spybota)
teraz log wyglada tak:

Logfile of HijackThis v1.99.1
Scan saved at 22:57:39, on 2005-11-08
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\wuauclt.exe
D:\Install\Avant Browser\avant.exe
C:\Documents and Settings\KACHA\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program
Files\NewDotNet\newdotnet6_98.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program
Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-
716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} -
C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1
\NEWDOT~2.DLL,ClientStartup -s
O4 - Startup: TClock.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box -
D:\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Blokuj wszystkie obrazy z tego serwera -
D:\Install\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Dodaj do listy blokowanych reklam -
D:\Install\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: E&ksport do programu Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Otwórz w nowym Avant Browser - D:\Install\Avant
Browser\OpenInNewBrowser.htm
O8 - Extra context menu item: Otwórz wszystkie adresy z tej strony... -
D:\Install\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Podświetl - D:\Install\Avant Browser\Highlight.htm
O8 - Extra context menu item: Szukaj - D:\Install\Avant Browser\Search.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH -
C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany -
C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: StyleXPService - Unknown owner - C:\Program
Files\TGTSoft\StyleXP\StyleXPService.exe


czy ktos sie zlituje?

[neder]

odinstaluj ten program (z 010) poprzez dodaj/usuń programy
pzdr

[neder]

no i wpisy 010+
> O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program
> Files\NewDotNet\newdotnet6_98.dll

[Gość: login]

dzieki, juz śmiga:))

ps. w "dodaj/usun" mialam info, ze hijack zajmuje po 3-4 skanowaniach dzis
ponad 300MB, czy to mozliwe??

[Gość: k]

O2 - BHO: URLLink - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program
Files\NewDotNet\newdotnet6_98.dll
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1
\NEWDOT~2.DLL,ClientStartup -s <- to tez do kasacji o ile jeszcze jest.