Search Assistant

[marzyci3l]

Chodzi o to, że nie wiem jak usunąć z Windowsa XP coś zwanego "SEARCH ASSISTANT" które wgrane jest do INTERNET EXPLORERA i do PASKA NARZĘDZI (tam gdzie jest QUICK LAUNCH). Zna ktoś czym to mogę usunąć? RegCleaner, RegVac, czy może coś innego??

[Kolobos]

Wklej tutaj log z hijackthis:

http://www.spychecker.com/program/hijackthis.html

 

To Ci powiem co i jak usunac.

[marzyci3l]

Logfile of HijackThis v1.97.7

Scan saved at 10:13:41, on 2005-04-17

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\NORTON~1\navapw32.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\LiveUpdate\LiveUpdate.exe

C:\WINDOWS\System32\rundll32.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe

C:\Program Files\Konnekt\konnekt.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\MYIE2\MyIE.exe

C:\Documents and Settings\Beataa\Pulpit\download\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,

O1 - Hosts: 62.189.6.85 _sip._tls.sip5.phoneserve.com

O1 - Hosts: 62.189.6.85 _sip._ssl.sip5.phoneserve.com

O1 - Hosts: 62.189.6.86 _sip._tls.sip6.phoneserve.com

O1 - Hosts: 62.189.6.86 _sip._ssl.sip6.phoneserve.com

O1 - Hosts: 62.189.6.93 _sip._tls.sip7.phoneserve.com

O1 - Hosts: 62.189.6.93 _sip._ssl.sip7.phoneserve.com

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll

O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - (no file)

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {EB23F789-F17F-4bcc-988B-6B70A3A67E9C} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun

O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Tlumacz z LING... - http://www.ling.pl/ling/def-src.php4

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Personalizuj Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

O8 - Extra context menu item: Web Rebates - file://C:\Program Files\WebRebates\System\Temp\topr1150_script0.htm

O8 - Extra context menu item: Wype³nij Pola &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

O8 - Extra context menu item: Zapisz Pola &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

O9 - Extra button: Wype³nij Pola (HKLM)

O9 - Extra 'Tools' menuitem: Wype³nij Pola &] (HKLM)

O9 - Extra button: Zapisz (HKLM)

O9 - Extra 'Tools' menuitem: Zapisz Pola &[ (HKLM)

O9 - Extra button: RoboForm (HKLM)

O9 - Extra 'Tools' menuitem: RF Pasek Narzêdzi &2 (HKLM)

O9 - Extra button: Related (HKLM)

O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O10 - Hijacked Internet access by New.Net

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php...7642452ea30b3de

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr...etup1.0.0.8.cab

O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab

O16 - DPF: {8F2E4DC6-E858-4EF0-B596-7CD82AA94B0A} (M2AxCtl Class) - http://macikowski707.republika.pl/pliki/st...a_s/m2axsvr.dll

O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GINDARTS Class) - http://66.98.132.156/g_bin_eng/darts_2_0_0_25.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab

O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/eng/billard8_2_0_0_21.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C4} (GINBILLARDT Class) - http://66.98.132.156/g_bin_eng/billardt_2_0_0_17.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GINSNOOKER Class) - http://66.98.132.156/g_bin_eng/snooker_2_0_0_17.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{236C92EC-0F20-4A64-9E33-CE4425F6C80A}: NameServer = 194.204.141.11,194.204.159.1

 

-----------------------------------------

Oby coś dało. :) Dzięki. :)

[Kolobos]

Jak to mozliwe, ze dalem Ci link do najnowszej wersji hijackthis, a Ty sciagnales jakas stara?

 

Odinstaluj New.Net oraz WebRebates o ile bedzie w dodaj-usun, nastepnie uzyj tego:

http://www.cexx.org/LSPFix.exe i wywal to co dotyczy new.net

 

Uruchom hijackthis wybierz tylko scan i zaznacz te wpisy:

 

F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,

O1 - Hosts: 62.189.6.85 _sip._tls.sip5.phoneserve.com

O1 - Hosts: 62.189.6.85 _sip._ssl.sip5.phoneserve.com

O1 - Hosts: 62.189.6.86 _sip._tls.sip6.phoneserve.com

O1 - Hosts: 62.189.6.86 _sip._ssl.sip6.phoneserve.com

O1 - Hosts: 62.189.6.93 _sip._tls.sip7.phoneserve.com

O1 - Hosts: 62.189.6.93 _sip._ssl.sip7.phoneserve.com

O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - (no file)

O2 - BHO: (no name) - {EB23F789-F17F-4bcc-988B-6B70A3A67E9C} - (no file)

O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s

O8 - Extra context menu item: Web Rebates - file://C:\Program Files\WebRebates\System\Temp\topr1150_script0.htm

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr...etup1.0.0.8.cab

O16 - DPF: {8F2E4DC6-E858-4EF0-B596-7CD82AA94B0A} (M2AxCtl Class) - http://macikowski707.republika.pl/pliki/st...a_s/m2axsvr.dll

 

I nacisnij Fix Checked, przeskanuj sie tez tym:

http://www.safer-networking.org/pl/mirrors/index.html <- SpyBot S&D

http://housecall.trendmicro.com/housecall/start_corp.asp

http://www.windowsecurity.com/trojanscan/

http://www.pandasoftware.com/activescan/po...n_principal.htm

Zainstaluj tez:

http://www.javacoolsoftware.com/spywareblaster.html <- SpywareBlaster i wlacz w nim ochrone przegladarki tak samow SpyBot S&D

 

Pozniej reset i wklej nowy log.

[IamWeasel]

Ja proponuje zamiast Internet Explorera uzywac Mozilla Firefox i zaden search assistant ci sie nie zainstaluje. (wiem bo kiedys tez czesto mialem ten syf, od przesiadki na FF jest czysto).