prosba o sprawdzenie loga

**Posty:** 115 · przez **jodzet** 11 Gru 2005, 19:18

witam wszystkich. bardzo prosze o sprawdzenie loga:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:03:10, on 2005-12-11 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\logonui.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe C:\WINDOWS\System32\keyhook.exe D:\Daemon Tools\daemon.exe D:\aparat\qttask.exe C:\WINDOWS\System32\RunDll32.exe D:\Gadu-Gadu\Powergg\gg.exe D:\eMule\emule.exe C:\WINDOWS\System32\svchost.exe D:\Opera\Opera.exe D:\totalcmd\TOTALCMD.EXE C:\WINDOWS\System32\svchost.exe D:\Winamp\winamp.exe C:\Documents and Settings\Pasztet\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe O4 - HKLM\..\Run: [KeyBoard] C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [QuickTime Task] "D:\aparat\qttask.exe" -atboottime O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\Powergg\gg.exe" /tray O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe O4 - HKCU\..\Run: [SpyEmergency] "D:\Spy Emergency 2005\SpyEmergency.exe" O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe Reader\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll

nie wiem skad mi sie cos w kompie wzielo,ale staralem sie SPY Emergency 2005 to usunac i nie wiem czy mi sie udalo czy nie...
dalej jak wlaczam IE to strona startowa to secure32 (czy cos takiego) i nie da sie tegoz mienic..., bardzo prosze o pomoc
pozdrawuam
PS prosiilbym kogos o pomoc i dokladan rozpiske co amm robic, vbo jestem laikiem... dzieki wielkie

przez **Tom@szek** 11 Gru 2005, 19:26

Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach)
Start do awaryjnego ( F8 ) przy starcie komputera.

Pogrubione pliki usuwasz ręcznie z systemu.
Odpalasz hijackthis w awaryjnym i zaznaczasz ptaszkami poniższe wpisy i dajesz Fix checked.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"

O4 - HKLM\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe

O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"

O4 - HKCU\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Przydałoby Ci się SP2 zainstalować.

przez **jeff** 11 Gru 2005, 19:30

dodatkowo kasujesz

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll

najpierw wpisy w Hijacku, potem ręcznie pogrubiony plik

BTW. -> zmien nazwe tematu bo bedzie kreska

**Posty:** 115 · przez **jodzet** 11 Gru 2005, 20:09

kurde... po pierwsze... nie moge4 przelaczyc na tryb awaryjny(Klawiatura nie dziala w menu wyboru trybu)
po drugie... nie da sie recznie skasowac tych plikow, wiec prosze jeszcze o chwilke wyrozumialosci moj log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:57:21, on 2005-12-11 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe D:\Winamp\winampa.exe C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe C:\WINDOWS\System32\keyhook.exe D:\Daemon Tools\daemon.exe D:\aparat\qttask.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Messenger\msmsgs.exe D:\Gadu-Gadu\Powergg\gg.exe D:\Spy Emergency 2005\SpyEmergency.exe D:\eMule\emule.exe D:\Adobe Reader\Reader\reader_sl.exe C:\WINDOWS\System32\svchost.exe D:\totalcmd\TOTALCMD.EXE D:\Winamp\winamp.exe D:\Opera\Opera.exe C:\Documents and Settings\Pasztet\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe O4 - HKLM\..\Run: [KeyBoard] C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [QuickTime Task] "D:\aparat\qttask.exe" -atboottime O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\Powergg\gg.exe" /tray O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe O4 - HKCU\..\Run: [SpyEmergency] "D:\Spy Emergency 2005\SpyEmergency.exe" O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe Reader\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab

przez **jeff** 11 Gru 2005, 20:15

Ściągnij KillBoxa
http://www.downloads.subratam.org/KillBox.zip

Zaznaczasz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :
c:\secure32.html
następnie program będzie pytał o restart - zgadzasz się

ponownie odpalasz Killboxa z tym że teraz zmieniasz ścieżkę

C:\WINDOWS\bxproxy.exe

i tak samo robisz ze ścieżką

C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe

po zabiegach nowy log

**Posty:** 115 · przez **jodzet** 11 Gru 2005, 20:28

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:18:16, on 2005-12-11 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe C:\WINDOWS\System32\keyhook.exe D:\Daemon Tools\daemon.exe D:\aparat\qttask.exe C:\WINDOWS\System32\RunDll32.exe D:\eMule\emule.exe D:\Adobe Reader\Reader\reader_sl.exe C:\WINDOWS\System32\svchost.exe D:\Opera\Opera.exe D:\totalcmd\TOTALCMD.EXE C:\Documents and Settings\Pasztet\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe O4 - HKLM\..\Run: [KeyBoard] C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [QuickTime Task] "D:\aparat\qttask.exe" -atboottime O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\Powergg\PowerGG.exe" O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O4 - HKCU\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe O4 - HKCU\..\Run: [SpyEmergency] "D:\Spy Emergency 2005\SpyEmergency.exe" O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe Reader\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab

prosze nowy log... alez to skomplikowane...
przepraszam z gory za klopot
pozdrawiam

przez **jeff** 11 Gru 2005, 20:31

syf jaki był taki jest - zastosowałeś moje wskazówki dot. Killboxa ? ?

**Posty:** 115 · przez **jodzet** 11 Gru 2005, 20:34

tak.. zastosowalem.. zrobilem wszystko co kazales...

przez **jeff** 11 Gru 2005, 20:44

zrób tak..

skasuj najpierw wpisy w Hijacku

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKLM\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [bxproxy] C:\WINDOWS\bxproxy.exe

i potem odpalasz Killboxa i kasujesz sciezki tak jak napisałem (Delete on reboot)

c:\secure32.html
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\WINDOWS\bxproxy.exe

i ubijasz do skutku.. po kilka razy - tak długo jak nie znikną te pliki. Innej metody nie ma

**Posty:** 115 · przez **jodzet** 11 Gru 2005, 21:15

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 20:03:00, on 2005-12-11 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe D:\Winamp\winampa.exe C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe C:\WINDOWS\System32\keyhook.exe D:\Daemon Tools\daemon.exe D:\aparat\qttask.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Messenger\msmsgs.exe D:\Adobe Reader\Reader\reader_sl.exe D:\Gadu-Gadu\Powergg\gg.exe C:\WINDOWS\System32\svchost.exe D:\Opera\Opera.exe D:\totalcmd\TOTALCMD.EXE C:\Documents and Settings\Pasztet\Pulpit\hijackthis\HijackThis.exe F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe O4 - HKLM\..\Run: [KeyBoard] C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [QuickTime Task] "D:\aparat\qttask.exe" -atboottime O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\Powergg\gg.exe" /tray O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe Reader\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab

ten plik "F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"" na raporcie, ktory wyskakuje w notatniku widnieje chyba pod nazwa "F2 - REG:system.ini: Shell=explorer.exe " kasowac go??

przez **jeff** 11 Gru 2005, 21:20

jodzet napisał(a):ten plik "F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"" na raporcie, ktory wyskakuje w notatniku widnieje chyba pod nazwa "F2 - REG:system.ini: Shell=explorer.exe " kasowac go??

skasuj ten wpis w Hijacku a potem uzywasz Killboxa i kasuejsz scieżkę

C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe

**Posty:** 115 · przez **jodzet** 11 Gru 2005, 21:28

skasowalem w Hijacku i w Killboxie wyskakuje wpis
"PendingFileRenameOperations Registry Data as been Removed by External Process"

**Posty:** 8694 · przez **Red** 12 Gru 2005, 12:19

daj log z http://www.silentrunners.org/

http://www.silentrunners.org/Silent%20Runners.vbs >>>otwierasz link >zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

**Posty:** 115 · przez **jodzet** 12 Gru 2005, 12:41

jeszcze raz zamieszczam mojego loga

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 11:30:39, on 2005-12-12 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe C:\WINDOWS\System32\keyhook.exe D:\Daemon Tools\daemon.exe D:\aparat\qttask.exe C:\WINDOWS\System32\RunDll32.exe D:\Gadu-Gadu\Powergg\gg.exe C:\WINDOWS\System32\svchost.exe D:\Opera\Opera.exe D:\totalcmd\TOTALCMD.EXE D:\eMule\emule.exe D:\The Bat!\thebat.exe D:\Winamp\winamp.exe C:\Documents and Settings\Pasztet\Pulpit\hijackthis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe O4 - HKLM\..\Run: [KeyBoard] C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [QuickTime Task] "D:\aparat\qttask.exe" -atboottime O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\Powergg\gg.exe" /tray O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [SpyEmergency] "D:\Spy Emergency 2005\SpyEmergency.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe Reader\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab

pozdrawiam

[ Dodano: Dzisiaj o 12:41 ]
teraz wstawiam nowego loga z tego co mi Red powiedzial

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 41, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""D:\Gadu-Gadu\Powergg\gg.exe" /tray" ["sms-express.com"] "eMuleAutoStart" = "D:\eMule\emule.exe -AutoStart" ["http://www.emule-project.net"] "SpyEmergency" = ""D:\Spy Emergency 2005\SpyEmergency.exe"" ["NETGATE"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinampAgent" = "D:\Winamp\winampa.exe" [null data] "KeyBoard" = "C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "SiS Windows KeyHook" = "C:\WINDOWS\System32\keyhook.exe" ["Silicon Integrated Systems Corporation"] "DAEMON Tools-1033" = ""D:\Daemon Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "QuickTime Task" = ""D:\aparat\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "D:\Adobe Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]

kurde...a lez to skomplikowane

**Posty:** 8694 · przez **Red** 12 Gru 2005, 13:42

jodzet napisał(a):teraz wstawiam nowego loga z tego co mi Red powiedzial

napisalem ci rowniez :

Red napisał(a):i czekasz troszke az wygeneruje sie cały log do konca

ten log nie jest dokonczony ,urwałes go

**Posty:** 115 · przez **jodzet** 12 Gru 2005, 14:36

sorki.. nie znam sie i myslalem,ze jak juz sie pojawil na pulpcie skrot to myslalem,ze wszystko ok.. ale zamieszczam juz nowy....

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 41, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "Gadu-Gadu" = ""D:\Gadu-Gadu\Powergg\gg.exe" /tray" ["sms-express.com"] "eMuleAutoStart" = "D:\eMule\emule.exe -AutoStart" ["http://www.emule-project.net"] "SpyEmergency" = ""D:\Spy Emergency 2005\SpyEmergency.exe"" ["NETGATE"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "WinampAgent" = "D:\Winamp\winampa.exe" [null data] "KeyBoard" = "C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe" [null data] "SiSUSBRG" = "C:\WINDOWS\SiSUSBrg.exe" ["Silicon Integrated Systems Corp."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "SiS Windows KeyHook" = "C:\WINDOWS\System32\keyhook.exe" ["Silicon Integrated Systems Corporation"] "DAEMON Tools-1033" = ""D:\Daemon Tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"] "QuickTime Task" = ""D:\aparat\qttask.exe" -atboottime" ["Apple Computer, Inc."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "D:\Adobe Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{4CCEFB41-18FA-11D3-9EF3-00A0C9E897FD}" = "Skladnik rozszerzenia powloki CorelDRAW" -> {CLSID}\InProcServer32\(Default) = "D:\CorelDraw\DRAW\CDRVIEWER\CrlShell110.dll" [null data] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {CLSID}\InProcServer32\(Default) = "D:\Winrar\rarext.dll" [null data] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {CLSID}\InProcServer32\(Default) = "D:\Office\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {CLSID}\InProcServer32\(Default) = "D:\Office\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {CLSID}\InProcServer32\(Default) = "D:\Office\OFFICE11\msohev.dll" [MS] HKLM\Software\Classes\PROTOCOLS\Filter\ INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {CLSID}\InProcServer32\(Default) = "D:\Winrar\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {CLSID}\InProcServer32\(Default) = "D:\Winrar\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {CLSID}\InProcServer32\(Default) = "D:\Winrar\rarext.dll" [null data] Group Policies [Description] {enabled Group Policy setting}: ------------------------------------------------------------ HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ HIJACK WARNING! "ForceActiveDesktopOn"=dword:00000001 [enables Active Desktop and prevents disabling it] {User Configuration|Administrative Templates|Desktop|Active Desktop| Enable Active Desktop} HIJACK WARNING! "Wallpaper" = "C:\WINDOWS\desktop.html" [disables the Display Properties|Desktop (tab) (except the "Customize Desktop..." button); selects wallpaper if Active Desktop is enabled] {User Configuration|Administrative Templates|Desktop|Active Desktop| Active Desktop Wallpaper|Wallpaper Name:} Active Desktop and Wallpaper: ----------------------------- Active Desktop enabled via Group Policy. Wallpaper selected via Group Policy. Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Pasztet" & "All Users" startup folders: --------------------------------------------------------- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Adobe Gamma Loader" -> shortcut to: "C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "Adobe Reader Speed Launch" -> shortcut to: "D:\Adobe Reader\Reader\reader_sl.exe" ["Adobe Systems Incorporated"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "Yahoo! Toolbar" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = "Yahoo! Toolbar" [from CLSID] -> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll" ["Yahoo! Inc."] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Remote Procedure Call (RPC) Extensions, RpcxSs, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"RpcxSs.Dll" [MS]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS] ---------- + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points and all Registry CLSIDs for dormant Explorer Bars, use the -supp parameter or answer "No" at the first message box. ---------- (total run time: 88 seconds, including 4 seconds for message boxes)

**Posty:** 8694 · przez **Red** 12 Gru 2005, 14:46

przy pomocy hijacka usun:

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

jodzet napisał(a):HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
HIJACK WARNING! "ForceActiveDesktopOn"=dword:00000001
[enables Active Desktop and prevents disabling it]
{User Configuration|Administrative Templates|Desktop|Active Desktop|
Enable Active Desktop}

otworz notanik i wklej w nim 1'1

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"ForceActiveDesktopOn"=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"Wallpaper"=-

nastepnie >>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg
Klikasz dwa razy na powstały plik i potwierdzasz.

powinno zadziałac

Autor postu otrzymał pochwałę

**Posty:** 115 · przez **jodzet** 12 Gru 2005, 20:03

zobnilem tak

podaje loga

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:52:28, on 2005-12-12 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe C:\WINDOWS\System32\keyhook.exe D:\Daemon Tools\daemon.exe D:\aparat\qttask.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\svchost.exe D:\eMule\emule.exe D:\The Bat!\thebat.exe D:\totalcmd\TOTALCMD.EXE D:\Opera\Opera.exe D:\Gadu-Gadu\Powergg\gg.exe D:\Winamp\winamp.exe C:\Documents and Settings\Pasztet\Pulpit\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Adobe Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe O4 - HKLM\..\Run: [KeyBoard] C:\PROGRA~1\Labtec\LABTEC~1\Keyboard.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [QuickTime Task] "D:\aparat\qttask.exe" -atboottime O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\Powergg\gg.exe" /tray O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart O4 - HKCU\..\Run: [SpyEmergency] "D:\Spy Emergency 2005\SpyEmergency.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe Reader\Reader\reader_sl.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\Office\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Office\OFFICE11\REFIEBAR.DLL O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_24.cab

cos jeszcze trzeba zrobic?
pozdrawiam

**Posty:** 8694 · przez **Red** 12 Gru 2005, 20:07

cos jeszcze trzeba zrobic?

nie szalec w poszukiwaniu crackow przez jakis czas
pomyslec o aktualnieniu windowsa

poza tym posprzatane

**Posty:** 115 · przez **jodzet** 12 Gru 2005, 21:00

kurde... niby juz wszystko ok a komp dalej jakos wolno chodzi....dlaczego? tego SPY SHERIFFA trza kasowac? badz SPY Emergency?
pomozcie .... sorki,ze truje glowe

prosba o sprawdzenie loga

prosba o sprawdzenie loga

Kto jest na forum