Wylaczasz przywracanie

Wywalasz:
C:Program FilesQuickSearch
C:Program FilesNavExcel

FIX:

O2 – BHO: QuickSearch Search Bar – {82315A18–6CFB–44a7–BDFD–90E36537C252} – C:Program FilesQuickSearchQuickSearchBar1_27.dll
O2 – BHO: NavHelper Class – {C1E58A84–95B3–4630–B8C2–D06B77B7A0FC} – C:Program FilesNavExcelNavHelperv2.0.4cNHelper.dll
O3 – Toolbar: QuickSearch Search Bar – {82315A18–6CFB–44a7–BDFD–90E36537C252} – C:Program FilesQuickSearchQuickSearchBar1_27.dll

inetinfo.exe zostaw jesli uzywasz IIS

Zrobiłem wszystko jak pisałeś.Niestety nie mogę wyłączyćprocesu inietinfo, próbuje go wyłączyć w menedźerze zadań i nie pomaga. Folder NavExel tolbar usunąłem.
Po ponownym przeskanowaniu hijackiem jest taki log:


Logfile of HijackThis v1.99.0
Scan saved at 23:39:12, on 2005–02–04
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32CTsvcCDA.EXE
C:WINDOWSExplorer.EXE
C:Program FilesNorton SystemWorksNorton AntiVirus avapsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:WINDOWSsystem32 vsvc32.exe
C:WINDOWSSystem32snmp.exe
C:PROGRA~1NORTON~1SPEEDD~1 opdb.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
D:dexaAmoumain.exe
C:Program FilesJavajre1.5.0_01injusched.exe
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesNeostrada TPNeostradaTP.exe
C:Program FilesNeostrada TPComComp.exe
C:Program FilesNeostrada TPWatch.exe
C:Program FilesMessengermsmsgs.exe
C:Documents and SettingszbychPulpithijackthisHijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – D:Acrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: QuickSearch Search Bar – {82315A18–6CFB–44a7–BDFD–90E36537C252} – C:Program FilesQuickSearchQuickSearchBar1_27.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O2 – BHO: NavHelper Class – {C1E58A84–95B3–4630–B8C2–D06B77B7A0FC} – C:Program FilesNavExcelNavHelperv2.0.4cNHelper.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – D:DAPDAPIEBar.dll
O3 – Toolbar: QuickSearch Search Bar – {82315A18–6CFB–44a7–BDFD–90E36537C252} – C:Program FilesQuickSearchQuickSearchBar1_27.dll
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [ccRegVfy] "C:Program FilesCommon FilesSymantec SharedccRegVfy.exe"
O4 – HKLM..Run: [WheelMouse] d:dexaAmoumain.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_01injusched.exe
O4 – HKLM..Run: [Synchronization Manager] %SystemRoot%system32mobsync.exe /logon
O4 – HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe
O4 – HKLM..Run: [AudioHQ] D:soundblastAudioHQAHQTB.EXE
O4 – Global Startup: Dexxa Wireless Keyboard.lnk = D:dexaHotKeyEx.exe
O8 – Extra context menu item: &Download with &DAP – D:DAPdapextie.htm
O8 – Extra context menu item: Download &all with DAP – D:DAPdapextie2.htm
O9 – Extra button: Messenger – –{FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – –{FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavajre1.5.0_01in pjpi150_01.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavajre1.5.0_01in pjpi150_01.dll
O9 – Extra button: Run DAP – {669695BC–A811–4A9D–8CDF–BA8C795F261C} – D:DAPDAP.EXE
O16 – DPF: ING Bank Online – https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O17 – HKLMSystemCCSServicesTcpip..{38BFCDC5–9354–407C–8C3D–3B87BD7BEBA2}: NameServer = 194.204.152.34 217.98.63.164
O23 – Service: Symantec Event Manager – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 – Service: Symantec Password Validation Service – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 – Service: Creative Service for CDROM Access – Creative Technology Ltd – C:WINDOWSsystem32CTsvcCDA.EXE
O23 – Service: Usługa Auto–Protect w programie Norton AntiVirus – Symantec Corporation – C:Program FilesNorton SystemWorksNorton AntiVirus avapsvc.exe
O23 – Service: Norton Unerase Protection – Symantec Corporation – C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 – Service: NVIDIA Display Driver Service – NVIDIA Corporation – C:WINDOWSsystem32 vsvc32.exe
O23 – Service: ScriptBlocking Service – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 – Service: Symantec Network Drivers Service – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 – Service: Speed Disk service – Symantec Corporation – C:PROGRA~1NORTON~1SPEEDD~1 opdb.exe
O23 – Service: SymWMI Service – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe

A IE w dalszym ciągu nie moźe wyświetlić strony. Chyba jednak będę musiał na nowo zainstalować xp–ka.

Pozdrawiam

Wylaczasz proces inetinfo.exe, zaznaczasz w HJ to co nizej, naciskasz FIX..., usuwasz pliki z dysku jesli jeszcze beda, usuwasz folder NavExcel Search Toolbar z Program files.

C:WINDOWSsystem32inetsrvinetinfo.exe
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = NOT USED (OK)
O1 – Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 – BHO: (no name) – {00000EF1–0786–4633–87C6–1AA7A44296DA} – (no file)
O2 – BHO: NavErrRedir Class – {5D60FF48–95BE–4956–B4C6–6BB168A70310} – (no file)
O2 – BHO: Helper Class – {D80C4E21–C346–4E21–8E64–20746AA20AEB} – C:Program FilesNavExcel Search ToolbarNavExcelBar.dll
O3 – Toolbar: NavExcel Toolbar – {5AA06644–BC46–4220–A460–47A6EB47C96D} – C:Program FilesNavExcel Search ToolbarNavExcelBar.dll
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present

witam.Oto pełny log, przyznaję źe nie wiem o co w tym chodzi.Korzystam z komputera i co nieco umiem zrobić ale z większym problemem sobie nie radze:

Logfile of HijackThis v1.99.0
Scan saved at 07:53:34, on 2005–02–03
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32CTsvcCDA.EXE
C:WINDOWSsystem32inetsrvinetinfo.exe
C:Program FilesNorton SystemWorksNorton AntiVirus avapsvc.exe
C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
C:WINDOWSsystem32 vsvc32.exe
C:WINDOWSSystem32snmp.exe
C:PROGRA~1NORTON~1SPEEDD~1 opdb.exe
C:WINDOWSsystem32MsPMSPSv.exe
C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesSymantec SharedccApp.exe
D:dexaAmoumain.exe
C:PROGRA~1NEOSTR~1CnxMon.exe
C:Program FilesJavajre1.5.0_01injusched.exe
C:Program FilesNeostrada TPNeostradaTP.exe
C:Program FilesNeostrada TPComComp.exe
C:Program FilesNeostrada TPWatch.exe
C:WinampWinamp.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesMessengermsmsgs.exe
C:DOCUME~1zbychUSTAWI~1TempRar$EX00.109HijackThis.exe

R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = NOT USED (OK)
R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O1 – Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 – BHO: (no name) – {00000EF1–0786–4633–87C6–1AA7A44296DA} – (no file)
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – D:Acrobat 6.0 CEReaderActiveXAcroIEHelper.dll
O2 – BHO: NavErrRedir Class – {5D60FF48–95BE–4956–B4C6–6BB168A70310} – (no file)
O2 – BHO: QuickSearch Search Bar – {82315A18–6CFB–44a7–BDFD–90E36537C252} – C:Program FilesQuickSearchQuickSearchBar1_27.dll
O2 – BHO: NAV Helper – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O2 – BHO: NavHelper Class – {C1E58A84–95B3–4630–B8C2–D06B77B7A0FC} – C:Program FilesNavExcelNavHelperv2.0.4cNHelper.dll
O2 – BHO: Helper Class – {D80C4E21–C346–4E21–8E64–20746AA20AEB} – C:Program FilesNavExcel Search ToolbarNavExcelBar.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF–3FFB–4238–8AD1–7859DF00B1D6} – C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O3 – Toolbar: NavExcel Toolbar – {5AA06644–BC46–4220–A460–47A6EB47C96D} – C:Program FilesNavExcel Search ToolbarNavExcelBar.dll
O3 – Toolbar: DAP Bar – {62999427–33FC–4baf–9C9C–BCE6BD127F08} – D:DAPDAPIEBar.dll
O3 – Toolbar: QuickSearch Search Bar – {82315A18–6CFB–44a7–BDFD–90E36537C252} – C:Program FilesQuickSearchQuickSearchBar1_27.dll
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [ccApp] "C:Program FilesCommon FilesSymantec SharedccApp.exe"
O4 – HKLM..Run: [ccRegVfy] "C:Program FilesCommon FilesSymantec SharedccRegVfy.exe"
O4 – HKLM..Run: [WheelMouse] d:dexaAmoumain.exe
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_01injusched.exe
O4 – HKLM..Run: [Synchronization Manager] %SystemRoot%system32mobsync.exe /logon
O4 – Global Startup: Dexxa Wireless Keyboard.lnk = D:dexaHotKeyEx.exe
O6 – HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O8 – Extra context menu item: &Download with &DAP – D:DAPdapextie.htm
O8 – Extra context menu item: Download &all with DAP – D:DAPdapextie2.htm
O9 – Extra button: Messenger – –{FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra 'Tools' menuitem: Windows Messenger – –{FB5F1910–F110–11d2–BB9E–00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavajre1.5.0_01in pjpi150_01.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:Program FilesJavajre1.5.0_01in pjpi150_01.dll
O9 – Extra button: Run DAP – {669695BC–A811–4A9D–8CDF–BA8C795F261C} – D:DAPDAP.EXE
O16 – DPF: ING Bank Online – https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab
O17 – HKLMSystemCCSServicesTcpip..{38BFCDC5–9354–407C–8C3D–3B87BD7BEBA2}: NameServer = 194.204.152.34 217.98.63.164
O23 – Service: Symantec Event Manager – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 – Service: Symantec Password Validation Service – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 – Service: Creative Service for CDROM Access – Creative Technology Ltd – C:WINDOWSsystem32CTsvcCDA.EXE
O23 – Service: Usługa Auto–Protect w programie Norton AntiVirus – Symantec Corporation – C:Program FilesNorton SystemWorksNorton AntiVirus avapsvc.exe
O23 – Service: Norton Unerase Protection – Symantec Corporation – C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O23 – Service: NVIDIA Display Driver Service – NVIDIA Corporation – C:WINDOWSsystem32 vsvc32.exe
O23 – Service: ScriptBlocking Service – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 – Service: Speed Disk service – Symantec Corporation – C:PROGRA~1NORTON~1SPEEDD~1 opdb.exe
O23 – Service: SymWMI Service – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedSecurity CenterSymWSC.exe


Będę wdzięczny za pomoc.
pozdrawiam


p.s.
Mój adres email: zbychbed@wp.pl
mój numer gg 4145244

Po prostu zlapales jakies dziadostwo ktore zablokowalo Ci internet i mozliwosc dokonania jakichkolwiek zmian.
W dziale Bezpieczenstwo przyklejony temat o HiJacku. Zapoznaj sie, zastosuj. Mozesz, jesli sam nie bedziesz potrafil naprawic, skopiowac pelny log do posta.