prosze o sprawdzenie loga

[Nintendo]

Witam!! Mam problem , poniewaz gdy wejde w normalny tryb to wszystko sie zacina nic nie mozna zrobic tylko reset kompa , teraz do was pisze w trybie awaryjnym z obsluga sieci..Nie wiem dlazcego tak sie dzieje o to log z HJ.Teraz wogole ic nie ma jak sie loguje w normalnym trybie wogole nie ma ikon i po chwili znowu mnie wylogowuje!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:35:42, on 2008-01-27
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\cmd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\cscript.exe
C:\WINDOWS\System32\cmd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Microsoft Windows TCP Protocol - Unknown owner - C:\WINDOWS\System32\dllcache\wintcps.exe

--
End of file - 3199 bytes

[code][/code]

[Avenger]

Do wykonania w trybie awaryjnym i wyłącznym przywracaniem systemu

Pobierz Combofix

Otwórz notatnik i wklej w nim to

file::
C:\WINDOWS\System32\dllcache\wintcps.exe

driver::
Microsoft Windows TCP Protocol

plik>zapisz jako... CFScript
Przenosisz plik CFScript na ikonkę Combofixa i rozpocznie się proces usuwania podczas którego może wystąpić reset komputera

W hijacku skasuj

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Microsoft Windows TCP Protocol - Unknown owner - C:\WINDOWS\System32\dllcache\wintcps.exe

Po zabiegach dajesz nowy log z hijacka i log z Combofix

[Nintendo]

Nadal nic nie pomoglo jak loguje sie normalne do windowsa to podaje haslo i tylko jest tapeta i po chwili mnie wylogowuje i zonu musze sie zalogowac.Prosze pomozcie mi :

HJ:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:09, on 2008-01-27
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\cmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\RunOnce: [combofix] C:\WINDOWS\system32\cmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Microsoft Dir32 - Unknown owner - C:\WINDOWS\System32\dllcache\Dirhost.com
O23 - Service: Instalator Windows (MSIServer) - Unknown owner - cmd.exe (file missing)

--
End of file - 3737 bytes

Kod: Zaznacz wszystko

z combo:

ComboFix 08-01-23.1C - Gucio 2008-01-27 17:16:40.2 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.1.1250.1.1045.18.845 [GMT 1:00]
Running from: C:\Documents and Settings\Gucio\Pulpit\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\System32\dllcache\wintcps.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_MICROSOFT_WINDOWS_TCP_PROTOCOL
-------\Microsoft Windows TCP Protocol


-------\LEGACY_MICROSOFT_WINDOWS_TCP_PROTOCOL
-------\Microsoft Windows TCP Protocol


((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-27 17:15 . 2008-01-27 17:15 489 --a------ C:\1.vbs
2008-01-27 17:02 . 2008-01-27 17:02 405,504 -r-hsc--- C:\WINDOWS\system32\dllcache\wintcps.exe
2008-01-27 16:56 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-27 16:31 . 2008-01-25 19:04 149,504 -r-hsc--- C:\WINDOWS\system32\dllcache\Dirhost.com
2008-01-27 16:13 . 2008-01-27 16:13 <DIR> d-------- C:\Program Files\SkanerOnline
2008-01-27 15:59 . 2008-01-27 16:03 <DIR> d-------- C:\Program Files\RegCleaner
2008-01-27 15:29 . 2008-01-27 15:29 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-16 22:45 . 2008-01-16 22:45 69 --a------ C:\WINDOWS\system32\o
2008-01-14 19:24 . 2008-01-24 22:42 <DIR> d-------- C:\Program Files\eMule
2008-01-14 14:58 . 2008-01-14 14:59 <DIR> d-------- C:\Program Files\Winamp Remote
2008-01-14 14:58 . 2008-01-14 14:58 316,640 --a------ C:\WINDOWS\WMSysPr9.prx
2008-01-14 14:54 . 2008-01-14 16:03 <DIR> d-------- C:\Program Files\Winamp
2008-01-13 14:24 . 2008-01-26 11:56 <DIR> d-------- C:\Program Files\Valve
2008-01-12 19:18 . 2008-01-12 19:18 <DIR> d-------- C:\WINDOWS\Sun
2008-01-12 19:17 . 2008-01-12 19:17 <DIR> d-------- C:\Program Files\Java
2008-01-12 19:17 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-12 19:15 . 2008-01-12 19:15 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-11 21:45 . 2008-01-11 21:45 <DIR> d-------- C:\Program Files\Tibia
2008-01-11 21:42 . 2008-01-11 21:42 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-01-11 21:39 . 2008-01-12 19:17 1,397 --a------ C:\WINDOWS\mozver.dat
2008-01-11 21:34 . 2008-01-11 21:34 <DIR> d-------- C:\WINDOWS\system32\bits
2008-01-11 21:34 . 2008-01-11 21:34 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-11 21:33 . 2008-01-11 22:10 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-01-11 21:33 . 2005-02-25 04:36 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-11 21:32 . 2004-07-01 23:10 360,448 --a--c--- C:\WINDOWS\system32\dllcache\qmgr.dll
2008-01-11 21:32 . 2004-07-01 23:10 331,776 --a------ C:\WINDOWS\system32\winhttp.dll
2008-01-11 21:32 . 2004-07-01 23:10 331,776 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll
2008-01-11 21:32 . 2004-07-01 23:10 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2008-01-11 21:32 . 2004-07-01 23:10 17,408 --a--c--- C:\WINDOWS\system32\dllcache\qmgrprxy.dll
2008-01-11 21:32 . 2004-07-01 23:10 7,680 -----c--- C:\WINDOWS\system32\dllcache\bitsprx2.dll
2008-01-11 21:32 . 2004-07-01 23:10 7,680 --------- C:\WINDOWS\system32\bitsprx2.dll
2008-01-11 21:32 . 2004-07-01 23:10 7,168 -----c--- C:\WINDOWS\system32\dllcache\bitsprx3.dll
2008-01-11 21:32 . 2004-07-01 23:10 7,168 --------- C:\WINDOWS\system32\bitsprx3.dll
2008-01-11 21:28 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\system32\wuapi.dll
2008-01-11 21:28 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\system32\wucltui.dll
2008-01-11 21:28 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2008-01-11 21:28 . 2007-07-30 19:19 203,096 --a------ C:\WINDOWS\system32\wuweb.dll
2008-01-11 21:28 . 2004-08-03 14:04 187,160 --a------ C:\WINDOWS\system32\wuaueng1.dll
2008-01-11 21:28 . 2004-08-03 14:03 170,264 --a------ C:\WINDOWS\system32\wuauclt1.exe
2008-01-11 21:28 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\system32\wups.dll
2008-01-11 21:25 . 2008-01-11 21:25 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-01-11 21:25 . 2008-01-11 21:25 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-01-11 21:13 . 2000-09-20 17:55 34,215 -ra------ C:\WINDOWS\system32\drivers\Net4100.sys
2008-01-11 21:12 . 2008-01-11 21:12 <DIR> d-------- C:\WINDOWS\Profiles
2008-01-11 21:12 . 2008-01-11 21:12 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-01-11 21:12 . 1998-10-29 15:45 316,416 --a------ C:\WINDOWS\IsUninst.exe
2008-01-11 15:58 . 2008-01-27 16:12 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2008-01-11 15:58 . 2008-01-11 15:58 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2008-01-11 15:58 . 2008-01-27 16:36 <DIR> d-------- C:\Documents and Settings

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 13:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-13 13:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-11 15:27 --------- d-----w C:\Program Files\ATI Technologies
2008-01-11 15:17 --------- d-----w C:\Program Files\VIA
2008-01-11 15:14 --------- d--h--w C:\Program Files\Uninstall Information
2008-01-11 15:10 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-11 15:09 558,142 ----a-w C:\WINDOWS\java\Packages\BZHNL3TR.ZIP
2008-01-11 15:09 155,995 ----a-w C:\WINDOWS\java\Packages\G20RLZF3.ZIP
2008-01-11 15:06 --------- d-----w C:\Program Files\Usługi online
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe" [2002-09-20 18:05 23040]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 21:02 507904]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-11-11 07:07 102400 C:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 12:52 352256]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-11 21:25 588800]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 16:16 47104]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2001-10-26 18:29 145920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-09-20 18:05 23040]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-11 21:25 228864]

R0 viamraid;viamraid;C:\WINDOWS\System32\DRIVERS\viamraid.sys [2004-07-06 15:45]
S2 Microsoft Dir32;Microsoft Dir32;"C:\WINDOWS\System32\dllcache\Dirhost.com" [2008-01-25 19:04]
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\System32\drivers\GVCplDrv.sys [2004-05-02 09:47]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2002-08-29 01:32]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 17:19:20
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 17:20:19 - machine was rebooted [Gucio]
ComboFix-quarantined-files.txt 2008-01-27 16:20:11
.
2008-01-11 20:34:44 --- E O F ---

Kod: Zaznacz wszystko

[Avenger]

Pobierz program SDFix


* Dwuklik na SDFix.exe następnie program wypakuje się na dysk systemowy (standardowo C:\SDFix)
* Zrestartuj komputer i wejdź do trybu awaryjnego (klawisz F8 przed bootem Windowsa)
* Wejdź do folderu z SDFix kliknij dwa razy na plik RunThis.bat
* Wciśnij Y nastąpi proces usuwania.
* Kiedy usuwanie się ukończy wciśnij dowolny klawisz (Any Key). Nastąpi restart komputera.
* Po restarcie SDFix uruchomi się ponownie, żeby dokończyć proces usuwania kiedy pojawi się w oknie programu Finished, wciśnij dowolny klawisz do zakończenia scryptu i załadowania ikon na pulpicie.
* Pokaż Report.txt znajdujący się w folderze SDFix.

Po zabiegach dajesz nowe logi z hijacka, Combofix oraz raport z SDFix