problem z systemem... wirus?

**Posty:** 318 · przez **cinek2006** 06 Lis 2006, 20:31

Przyszłem dzisiaj ze szkoły, włączyłem komputer i wyskoczył błąd, że system nie może znależć profilu użytkownika, na komputerze mam tylko jedno konto, Administratora. System się uruchomił, ale żaden program nie działa, ustawienia się poresetowały, na pulpicie nie ma ikonek, wszytsko pogineło. Tak jakby ktoś usunął konto administratora. Nie wiem co się mogło stać, wczraj jeszcze było wszystko dobrze, a dzisiaj uruchamiam i klapa. Internet jedynie działa... Prosze o pomoc.
Log z hijacka:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:59:09, on 2006-11-06 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5296.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe C:\WINDOWS\system32\CTFMON.EXE C:\WINDOWS\system32\RaConfig.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe E:\Marcin\Skróty\Do usowania szkodnikow z systemu\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=54729 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?linkid=54834&clcid=0x409 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O10 - Broken Internet access because of LSP provider 'avsda.dll' missing O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Engine Service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Bell & Howell Monitor Service (BHMonitorService) - Unknown owner - C:\Program Files\EPC\BHROOT\BIN\monitor.exe (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: DirectX Service (DirectJikp) - Unknown owner - c:\windows\system32\directx.exe (file missing) O23 - Service: GEARSecurity - Unknown owner - C:\WINDOWS\System32\GEARSec.exe (file missing) O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing) O23 - Service: ONC/RPC Portmapper (portmapper) - Unknown owner - C:\Program Files\EPC\BHROOT\BIN\PORTMAP.EXE (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

[ Dodano: Dzisiaj o 19:22 ]
Ustawienia się nie zapisują, za każdym uruchomieniem komputera tworzy się w Document and Settings nowy folder:
TEMP
TEMP.MARCIN
TEMP.MARCIN.000
TEMP.MARCIN.001
Czemu tak się dzieje?

[ Dodano: Dzisiaj o 19:26 ]
Zauważyłem jeszcze jedą rzecz, w Document and Settings\Administrator\
zniknął folder ustawienia lokalne...

**Posty:** 935 · przez **Aqui** 06 Lis 2006, 23:09

O17 - HKLM\System\CCS\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1

Twoje dnsy??
=========================================
Noi oczywsice mamy syf..
w trybie awaryjnym z wyłączonym przywracaniem systemu
Start==>uruchom==>cmd i wklep

sc stop DirectJikp
sc delete DirectJikp

Przechodzmi do hijacka

O23 - Service: DirectX Service (DirectJikp) - Unknown owner - c:\windows\system32\directx.exe (file missing)

Wpis fixujesz pogrubiony plik usuwasz recznie z dysku,po zabiegach nowe log plus silentrunners :wink:

**Posty:** 318 · przez **cinek2006** 07 Lis 2006, 17:30

Aqui napisał(a):Twoje dnsy??

Tak, mam połączone 2 kompy ze sobą.
Zrobiłem tak jak napisałeś.
Logi:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:02:14, on 2006-11-07 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5296.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\explorer.exe C:\Program Files\AntiVir PersonalEdition Premium\sched.exe C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\NetMeter\NetMeter.exe C:\WINDOWS\system32\RaConfig.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE E:\Marcin\Skróty\Do usowania szkodnikow z systemu\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?linkid=54834&clcid=0x409 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: RaConfig.lnk = C:\WINDOWS\system32\RaConfig.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O10 - Broken Internet access because of LSP provider 'avsda.dll' missing O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O17 - HKLM\System\CS3\Services\Tcpip\..\{2C941676-C580-4B7D-9AEA-DBCF8326676F}: NameServer = 172.17.1.1 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Mail Security Service (AntiVirMailService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Service (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Engine Service (AVEService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: Bell & Howell Monitor Service (BHMonitorService) - Unknown owner - C:\Program Files\EPC\BHROOT\BIN\monitor.exe (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: GEARSecurity - Unknown owner - C:\WINDOWS\System32\GEARSec.exe (file missing) O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing) O23 - Service: ONC/RPC Portmapper (portmapper) - Unknown owner - C:\Program Files\EPC\BHROOT\BIN\PORTMAP.EXE (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 44, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu Sp. z oo"] "C:\Program Files\NetMeter\NetMeter.exe" = "C:\Program Files\NetMeter\NetMeter.exe" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "avgnt" = ""C:\Program Files\AntiVir PersonalEdition Premium\avgnt.exe" /min" ["Avira GmbH"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {A5366673-E8CA-11D3-9CD9-0090271D075B}\(Default) = (no title provided) -> {HKLM...CLSID} = "IeCatch2 Class" \InProcServer32\(Default) = "C:\PROGRA~1\FlashGet\jccatch.dll" ["Amaze Soft"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{30D02401-6A81-11d0-8274-00C04FD5AE38}" = "IE Search Band" -> {HKLM...CLSID} = "IE Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}" = "Shell DocObject Viewer" -> {HKLM...CLSID} = "Shell DocObject Viewer" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" = "InternetShortcut" -> {HKLM...CLSID} = "Internet Shortcut" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}" = "Microsoft Url History Service" -> {HKLM...CLSID} = "Microsoft Url History Service" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{FF393560-C2A7-11CF-BFF4-444553540000}" = "History" -> {HKLM...CLSID} = "History" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}" = "Temporary Internet Files" -> {HKLM...CLSID} = "Temporary Internet Files" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}" = "Temporary Internet Files" -> {HKLM...CLSID} = "Temporary Internet Files" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}" = "Microsoft Url Search Hook" -> {HKLM...CLSID} = "Microsoft Url Search Hook" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}" = "The Internet" -> {HKLM...CLSID} = "The Internet" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{871C5380-42A0-1069-A2EA-08002B30309D}" = "Internet Name Space" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Premium\shlext.dll" ["H+BEDV Datentechnik GmbH"] "{0D6D4F41-2994-4ba0-8FEF-620E43CD2812}" = "IE Microsoft Internet Toolbar" -> {HKLM...CLSID} = "IE Microsoft Internet Toolbar" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{73CFD649-CD48-4fd8-A272-2070EA56526B}" = "IE BandProxy" -> {HKLM...CLSID} = "IE BandProxy" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{07C45BB1-4A8C-4642-A1F5-237E7215FF66}" = "IE Microsoft BrowserBand" -> {HKLM...CLSID} = "IE Microsoft BrowserBand" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{43886CD5-6529-41c4-A707-7B3C92C05E68}" = "IE Navigation Bar" -> {HKLM...CLSID} = "IE Navigation Bar" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{C4EC38BD-4E9E-4b5e-935A-D1BFF237D980}" = "Explorer Travel Band" -> {HKLM...CLSID} = "Explorer Travel Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{6D8BB3D3-9D87-4a91-AB56-4F30CFFEFE9F}" = "Explorer Search Band" -> {HKLM...CLSID} = "Explorer Search Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{F83DAC1C-9BB9-4f2b-B619-09819DA81B0E}" = "IE Registry Tree Options Utility" -> {HKLM...CLSID} = "IE Registry Tree Options Utility" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{DE011590-0531-4804-9C9C-3FEDC7E6E5C8}" = "IE &Address" -> {HKLM...CLSID} = "IE &Address" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{7E48925F-FF5C-47fa-A99A-F5912A10623B}" = "IE Address EditBox" -> {HKLM...CLSID} = "IE Address EditBox" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{3028902F-6374-48b2-8DC6-9725E775B926}" = "IE AutoComplete" -> {HKLM...CLSID} = "IE AutoComplete" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8}" = "IE MRU AutoComplete List" -> {HKLM...CLSID} = "IE MRU AutoComplete List" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{FDE7673D-2E19-4145-8376-BBD58C4BC7BA}" = "IE Custom MRU AutoCompleted List" -> {HKLM...CLSID} = "IE Custom MRU AutoCompleted List" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{6038EF75-ABFC-4e59-AB6F-12D397F6568D}" = "IE Microsoft History AutoComplete List" -> {HKLM...CLSID} = "IE Microsoft History AutoComplete List" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{9D958C62-3954-4b44-8FAB-C4670C1DB4C2}" = "IE Microsoft Shell Folder AutoComplete List" -> {HKLM...CLSID} = "IE Microsoft Shell Folder AutoComplete List" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{B31C5FAE-961F-415b-BAF0-E697A5178B94}" = "IE Microsoft Multiple AutoComplete List Container" -> {HKLM...CLSID} = "IE Microsoft Multiple AutoComplete List Container" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{E6EE9AAC-F76B-4947-8260-A9F136138E11}" = "IE Shell Band Site Menu" -> {HKLM...CLSID} = "IE Shell Band Site Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{7EDC7DE1-DD42-457a-8B36-B422F8E94E14}" = "IE Shell DeskBar" -> {HKLM...CLSID} = "IE Shell DeskBar" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{BFAD62EE-9D54-4b2a-BF3B-76F90697BD2A}" = "IE Shell Rebar BandSite" -> {HKLM...CLSID} = "IE Shell Rebar BandSite" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75}" = "IE User Assist" -> {HKLM...CLSID} = "IE User Assist" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{F0353E1D-FEEC-474e-A984-1E5C6865E380}" = "IE Global Folder Settings" -> {HKLM...CLSID} = "IE Global Folder Settings" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{4B78D326-D922-44f9-AF2A-07805C2A3560}" = "IE Menu Band" -> {HKLM...CLSID} = "IE Menu Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{6CF48EF8-44CD-45d2-8832-A16EA016311B}" = "IE IShellFolderBand" -> {HKLM...CLSID} = "IE IShellFolderBand" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{F2CF5485-4E02-4f68-819C-B92DE9277049}" = "&Links" -> {HKLM...CLSID} = "&Links" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{DBC04CF4-BE36-4f53-9C48-2D3625CA7694}" = "IE Thumbnail Image" -> {HKLM...CLSID} = "IE Thumbnail Image" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{1C1EDB47-CE22-4bbb-B608-77B48F83C823}" = "IE Fade Task" -> {HKLM...CLSID} = "IE Fade Task" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{6B4ECC4F-16D1-4474-94AB-5A763F2A54AE}" = "IE Tracking Shell Menu" -> {HKLM...CLSID} = "IE Tracking Shell Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{44C76ECD-F7FA-411c-9929-1B77BA77F524}" = "IE Menu Site" -> {HKLM...CLSID} = "IE Menu Site" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{205D7A97-F16D-4691-86EF-F3075DCCA57D}" = "IE Menu Desk Bar" -> {HKLM...CLSID} = "IE Menu Desk Bar" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{482A7CB3-2EDF-4595-A315-A5244F1E96E6}" = "IE Search Control" -> {HKLM...CLSID} = "IE Search Control" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{0B1818A2-EA07-4a55-AF57-1F410EBD21D3}" = "Favorites Band" -> {HKLM...CLSID} = "Favorites Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{BC476F4C-D9D7-4100-8D4E-E043F6DEC409}" = "Microsoft Browser Architecture" -> {HKLM...CLSID} = "Microsoft Browser Architecture" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player" -> {HKLM...CLSID} = "RealOne Player Context Menu Class" \InProcServer32\(Default) = "C:\Program Files\ACE Mega CoDecS Pack\SystemS\RealMedia\rpshell.dll" ["RealNetworks, Inc."] "{D0FAC080-AE1A-11ce-8016-CE90976DC901}" = "Picture Publisher File Viewer" -> {HKLM...CLSID} = "Picture Publisher File Viewer" \InProcServer32\(Default) = "ppiv30.dll" [null data] "{29e3fb5b-cf62-45b5-b8bf-1ad500385fc7}" = "Shell Context Menu Handler for Application References" -> {HKLM...CLSID} = "Shell Context Menu Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{29e3fb5b-cf62-45b5-b8bf-1ad500385fc6}" = "Shell Context Menu Handler for Application Manifests" -> {HKLM...CLSID} = "Shell Context Menu Handler for Application Manifests" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References" -> {HKLM...CLSID} = "Shell Icon Handler for Application References" \InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS] "{1530F7EE-5128-43BD-9977-84A4B0FAD7DF}" = "PhotoToys" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\phototoys.dll" [MS] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Program Files\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device" -> {HKLM...CLSID} = "Siemens Device" \InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens Device ContextMenuHandler" -> {HKLM...CLSID} = "Siemens Device ContextMenuHandler" \InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}" = "Siemens SX1 PropertySheetHandler" -> {HKLM...CLSID} = "Siemens Device PropertySheetHandler" \InProcServer32\(Default) = "C:\Program Files\Mobile Phone Manager\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AB21-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile" -> {HKLM...CLSID} = "Mobile" \InProcServer32\(Default) = "C:\Program Files\Siemens Data Suite\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AB22-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile ContextMenuHandler" -> {HKLM...CLSID} = "Mobile ContextMenuHandler" \InProcServer32\(Default) = "C:\Program Files\Siemens Data Suite\DES\DESShellExt.dll" ["Siemens AG"] "{ED65AB23-B24F-11d3-BA80-00C0CA16AA37}" = "Mobile PropertySheetHandler" -> {HKLM...CLSID} = "Mobile PropertySheetHandler" \InProcServer32\(Default) = "C:\Program Files\Siemens Data Suite\DES\DESShellExt.dll" ["Siemens AG"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ INFECTION WARNING! "{553858A7-4922-4e7e-B1C1-97140C1C16EF}" = "IE Component Categories cache daemon" -> {HKLM...CLSID} = "IE Component Categories cache daemon" \InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Premium\shlext.dll" ["H+BEDV Datentechnik GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" -> {HKLM...CLSID} = "Shell Extension for Malware scanning" \InProcServer32\(Default) = "C:\Program Files\AntiVir PersonalEdition Premium\shlext.dll" ["H+BEDV Datentechnik GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Active Desktop and Wallpaper: ----------------------------- Active Desktop is disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Piotrek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Piotrek" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\Piotrek\Menu Start\Programy\Autostart "Adobe Gamma" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "RaConfig" -> shortcut to: "C:\WINDOWS\system32\RaConfig.exe" ["Ralink Technology, Corp."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: avsda.dll ["H+BEDV Datentechnik GmbH"], 01 - 02, 32 %SystemRoot%\system32\mswsock.dll [MS], 03 - 05, 08 - 31 %SystemRoot%\system32\rsvpsp.dll [MS], 06 - 07 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {85D1F590-48F4-11D9-9669-0800200C9A66}\ "MenuText" = "Uninstall BitDefender Online Scanner v8" "Exec" = "%windir%\bdoscandel.exe" [null data] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" {D6E814A0-E0C5-11D4-8D29-0050BA6940E3}\ "ButtonText" = "FlashGet" "MenuText" = "&FlashGet" "Exec" = "C:\PROGRA~1\FlashGet\flashget.exe" ["Amaze Soft"] Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings") Added lines (compared with English-language version): [Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" [Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" Missing lines (compared with English-language version): [Strings]: 2 lines HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ HIJACK WARNING! "NavigationFailure" = "res://ieframe.dll/navcancl.htm" [MS] HIJACK WARNING! "DesktopItemNavigationFailure" = "res://ieframe.dll/navcancl.htm" [MS] HIJACK WARNING! "NavigationCanceled" = "res://ieframe.dll/navcancl.htm" [MS] HIJACK WARNING! "OfflineInformation" = "res://ieframe.dll/offcancl.htm" [MS] HIJACK WARNING! "PostNotCached" = "res://ieframe.dll/repost.htm" [MS] HIJACK WARNING! "NoAdd-ons" = "res://ieframe.dll/noaddon.htm" [MS] HIJACK WARNING! "NoAdd-onsInfo" = "res://ieframe.dll/noaddoninfo.htm" [MS] HIJACK WARNING! "SecurityRisk" = "res://ieframe.dll/securityatrisk.htm" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir Engine Service, AVEService, "C:\Program Files\AntiVir PersonalEdition Premium\avesvc.exe" ["Avira GmbH"] AntiVir PersonalEdition Premium Service, AntiVirService, "C:\Program Files\AntiVir PersonalEdition Premium\avguard.exe" ["AVIRA GmbH"] AntiVir Scheduler, AntiVirScheduler, "C:\Program Files\AntiVir PersonalEdition Premium\sched.exe" ["Avira GmbH"] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Crypkey License, Crypkey License, "crypserv.exe" ["CrypKey (Canada) Ltd."] HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]} StarWind iSCSI Service, StarWindService, "C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe" ["Rocket Division Software"] StyleXPService, StyleXPService, ""C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"" [empty string] Symantec Core LC, Symantec Core LC, "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"] Usługa Pomocnik IPv6, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = "hpzsnt10.dll" ["HP"] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 53 seconds, including 6 seconds for message boxes)

[ Dodano: Dzisiaj o 16:14 ]
Stworzyłem 2 konto ("Piotrek") i obeznie na nim się loguje, bo jak chcem się zalogować na konto administratora to wyskakuje błąd że nie może znaleść profilu użytkownika i tworzy się konto tymczasowe... Czy da się to jakoś naprawić?

problem z systemem... wirus?

problem z systemem... wirus?

Kto jest na forum