proszę o sprawdzenie loga

**Posty:** 385 · przez **Mathi00** 17 Lip 2007, 13:29

Gdy naciskam ctr+alt+del wyskakuje mi komunikat, że "Menadżer zadań został wyłączony przez administratora." Wiem, że ten temat był wałkowany kilkukrotnie, ale po skorzystaniu z podanych na forum sposobów działał tylko ten:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EServiceMain"=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoRun"=- "NoClose"=- [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=dword:00000000 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=dword:00000000 "**del.DisableTaskMgr"=" " [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "DisableTaskMgr"=dword:00000000 w notatniku >>Plik – Zapisz jako..., zapisz jako typ: wszystkie pliki, nazwa koniecznie z rozszerzeniem REG np. Fix.reg.Klikasz dwa razy na powstały plik dodajesz do rejestru i restart kompa

Problem w tym, że mogę ruchomić "Menadżera zadań" tylko wtedy, jeśli za każdym razem będę klikał na powstały plik, ponieważ gdy tylko wyłączę "Menadżera zadań" - problem się powtarza.

Log:

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:18:24, on 2007-07-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe E:\RÓŻNE\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Microsoft Security Adviser\mssadv.exe E:\RÓŻNE\DAEMON Tools\daemon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\taskmgr.exe E:\RÓŻNE\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\RNE~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Microsoft security adviser] C:\Program Files\Microsoft Security Adviser\mssadv.exe O4 - HKLM\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe O4 - HKLM\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe O4 - HKLM\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe O4 - HKLM\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe O4 - HKLM\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKCU\..\Run: [Gadu-Gadu] "E:\RÓŻNE\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [DAEMON Tools] "E:\RÓŻNE\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Microsoft security adviser] C:\Program Files\Microsoft Security Adviser\mssadv.exe O4 - HKCU\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe O4 - HKCU\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe O4 - HKCU\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe O4 - HKCU\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe O4 - HKCU\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Converter... - E:\RÓŻNE\MP3 Player Utilities 4.13\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\RÓŻNE\MP3 Player Utilities 4.13\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181809142655 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\RÓŻNE\Alcohol 120\StarWind\StarWindServiceAE.exe

**Posty:** 18165 · przez **wojtas** 17 Lip 2007, 13:44

zastosuj:

smitfraudfix z opcji 2:

http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

**Posty:** 385 · przez **Mathi00** 17 Lip 2007, 13:57

Kod: Zaznacz wszystko: SmitFraudFix v2.200 Scan done at 13:46:45,24, 2007-07-17 Run from C:\Documents and Settings\Dream Theater\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Karta Fast Ethernet zgodna z VIA - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 194.204.152.34 DNS Server Search Order: 193.110.121.20 HKLM\SYSTEM\CCS\Services\Tcpip\..\{8451E186-BCEC-4F09-B361-7B13A4011643}: DhcpNameServer=85.255.114.4,85.255.112.137 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F6AEC62F-0129-45A7-A48C-995B0F6E38FD}: DhcpNameServer=194.204.152.34 193.110.121.20 HKLM\SYSTEM\CS1\Services\Tcpip\..\{8451E186-BCEC-4F09-B361-7B13A4011643}: DhcpNameServer=85.255.114.4,85.255.112.137 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F6AEC62F-0129-45A7-A48C-995B0F6E38FD}: DhcpNameServer=194.204.152.34 193.110.121.20 HKLM\SYSTEM\CS2\Services\Tcpip\..\{8451E186-BCEC-4F09-B361-7B13A4011643}: DhcpNameServer=85.255.114.4,85.255.112.137 HKLM\SYSTEM\CS2\Services\Tcpip\..\{F6AEC62F-0129-45A7-A48C-995B0F6E38FD}: DhcpNameServer=194.204.152.34 193.110.121.20 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=194.204.152.34 193.110.121.20 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=194.204.152.34 193.110.121.20 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=194.204.152.34 193.110.121.20 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="cswvz.exe" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 18165 · przez **wojtas** 17 Lip 2007, 13:59

Mathi00 teraz daj nowe logi z hijacka oraz combofixa

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 385 · przez **Mathi00** 17 Lip 2007, 14:05

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 13:59:28, on 2007-07-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Microsoft Security Adviser\mssadv.exe D:\Program Files\BearShare\BearShare.exe E:\RÓŻNE\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe E:\RÓŻNE\Gadu-Gadu\gg.exe E:\RÓŻNE\DAEMON Tools\daemon.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe E:\RÓŻNE\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\RNE~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Microsoft security adviser] C:\Program Files\Microsoft Security Adviser\mssadv.exe O4 - HKLM\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe O4 - HKLM\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe O4 - HKLM\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe O4 - HKLM\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe O4 - HKLM\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKCU\..\Run: [Gadu-Gadu] "E:\RÓŻNE\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [DAEMON Tools] "E:\RÓŻNE\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [Microsoft security adviser] C:\Program Files\Microsoft Security Adviser\mssadv.exe O4 - HKCU\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe O4 - HKCU\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe O4 - HKCU\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe O4 - HKCU\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe O4 - HKCU\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Converter... - E:\RÓŻNE\MP3 Player Utilities 4.13\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\RÓŻNE\MP3 Player Utilities 4.13\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181809142655 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\RÓŻNE\Alcohol 120\StarWind\StarWindServiceAE.exe

Kod: Zaznacz wszystko: "Dream Theater" - 2007-07-17 14:00:25 - ComboFix 07-07-14.6 NTFS ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\DREAMT~1\Pulpit.\internet explorer.lnk C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL C:\Program Files\myglobalsearch\bar\Cache\00031704 C:\Program Files\myglobalsearch\bar\Cache\00031B3A C:\Program Files\myglobalsearch\bar\Cache\00031E66.bin C:\Program Files\myglobalsearch\bar\Cache\0003204B.bin C:\Program Files\myglobalsearch\bar\Cache\000324B0.bin C:\Program Files\myglobalsearch\bar\Cache\files.ini C:\Program Files\myglobalsearch\bar\History\search C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm C:\svchost.exe C:\WINDOWS\system32\kernel32.exe ((((((((((((((((((((((((( Files Created from 2007-06-17 to 2007-07-17 ))))))))))))))))))))))))))))))) 2007-07-17 14:00 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-17 13:47 1,950 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-17 13:46 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-07-17 13:46 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-17 13:46 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-07-16 14:43 <DIR> d-------- C:\Program Files\Foxit Software 2007-07-16 10:31 <DIR> d-------- C:\Program Files\SkanerOnline 2007-07-16 10:17 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-15 18:09 <DIR> d-------- C:\Program Files\SpyVampire 2007-07-15 18:06 42,776 --a------ C:\WINDOWS\mssadv.dll 2007-07-15 18:06 11,776 --a------ C:\svchost2.exe 2007-07-15 18:06 <DIR> d-------- C:\Program Files\Microsoft Security Adviser 2007-07-15 18:05 3,383,848 --a------ C:\WINDOWS\system32\{D6BA901E-CF5C-4175-A139-12A21B742812}.exe 2007-07-14 19:03 25 --a------ C:\WINDOWS\SW_Win2000X32.DLL 2007-07-14 18:53 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\AdobeUM 2007-07-11 15:53 <DIR> d-------- C:\Program Files\Last.fm 2007-07-07 19:55 23 --ahs---- C:\WINDOWS\system32\afcdddad_r.dll 2007-07-07 19:37 <DIR> d-------- C:\WINDOWS\pss 2007-07-07 15:50 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-07-07 15:40 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 2007-07-07 15:25 729,088 --a------ C:\WINDOWS\iun6002.exe 2007-07-06 12:34 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2007-07-05 17:05 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll 2007-07-05 17:05 <DIR> d-------- C:\Program Files\VST 2007-07-05 17:05 <DIR> d-------- C:\Program Files\Acoustica Shared Effects 2007-07-05 17:05 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\Acoustica 2007-07-05 17:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Acoustica 2007-07-05 16:45 299 --ah----- C:\WINDOWS\wininf.dat 2007-07-04 13:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2007-07-04 11:10 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-07-03 22:02 <DIR> d-------- C:\Program Files\BitTorrent 2007-07-03 18:58 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\Sports Interactive 2007-06-29 20:29 <DIR> d-------- C:\Program Files\Windows Media Components 2007-06-29 20:24 <DIR> d--h----- C:\WINDOWS\msdownld.tmp 2007-06-29 20:23 97,280 --a------ C:\WINDOWS\system32\ccrpbds5.dll 2007-06-29 20:23 77,824 --a------ C:\WINDOWS\system32\eJ_Enumerator.dll 2007-06-29 20:23 401,462 --a------ C:\WINDOWS\system32\MSVCP60.DLL 2007-06-29 20:23 36,864 --a------ C:\WINDOWS\system32\eJayWMExport.dll 2007-06-29 20:23 29,696 --a------ C:\WINDOWS\system32\pthread.dll 2007-06-29 20:23 236,032 --a------ C:\WINDOWS\system32\devil.dll 2007-06-29 20:23 159,744 --a------ C:\WINDOWS\system32\DartSock.dll 2007-06-29 20:23 106,496 --a------ C:\WINDOWS\system32\DartWeb.dll 2007-06-29 20:23 1,386,496 --a------ C:\WINDOWS\system32\msvbvm60.dll 2007-06-29 20:14 <DIR> d-------- C:\WINDOWS\speech 2007-06-29 10:13 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-06-29 10:13 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-06-29 10:13 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-06-29 10:13 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-06-27 10:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-06-27 08:56 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys 2007-06-27 08:44 <DIR> d-------- C:\DOCUME~1\DREAMT~1\.housecall6.6 2007-06-27 08:38 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-06-21 16:59 <DIR> d-------- C:\Program Files\Techland 2007-06-21 07:42 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-06-20 10:05 <DIR> d-------- C:\Program Files\Odkurzacz 2007-06-18 08:58 977,920 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-06-18 08:58 97,280 --a------ C:\WINDOWS\system32\txflog.dll 2007-06-18 08:58 82,432 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-06-18 08:58 64,512 --a------ C:\WINDOWS\system32\mtxclu.dll 2007-06-18 08:58 64,512 --a------ C:\WINDOWS\system32\colbact.dll 2007-06-18 08:58 596,480 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-06-18 08:58 499,200 --a------ C:\WINDOWS\system32\comuid.dll 2007-06-18 08:58 442,880 --a------ C:\WINDOWS\system32\rpcrt4.dll 2007-06-18 08:58 365,568 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-06-18 08:58 226,816 --a------ C:\WINDOWS\system32\es.dll 2007-06-18 08:58 225,280 --a------ C:\WINDOWS\system32\catsrv.dll 2007-06-18 08:58 214,528 --a------ C:\WINDOWS\system32\rpcss.dll 2007-06-18 08:58 150,528 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-06-18 08:58 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-06-18 08:58 1,177,088 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-06-18 08:58 1,105,408 --a------ C:\WINDOWS\system32\ole32.dll 2007-06-18 08:57 593,408 --a------ C:\WINDOWS\system32\h323msp.dll 2007-06-18 08:57 552,448 --a------ C:\WINDOWS\system32\rtcdll.dll 2007-06-18 08:57 48,640 --a------ C:\WINDOWS\system32\browser.dll 2007-06-18 08:57 454,144 --a------ C:\WINDOWS\system32\ipnathlp.dll 2007-06-18 08:57 36,864 --a------ C:\WINDOWS\system32\mf3216.dll 2007-06-17 21:18 <DIR> d-------- C:\Program Files\Skype 2007-06-17 21:18 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\Skype 2007-06-17 21:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-15 11:58:11 34 ----a-w C:\WINDOWS\hare.dat 2007-07-14 17:14:45 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-10 16:31:34 1,656 ----a-w C:\WINDOWS\mozver.dat 2007-07-03 16:47:50 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-06-29 18:12:26 980 ----a-w C:\WINDOWS\unins000.dat 2007-06-29 08:14:15 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-06-20 08:08:08 -------- d-----w C:\Program Files\Movie Maker 2007-06-15 15:29:27 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-06-14 18:59:05 4 ----a-w C:\WINDOWS\system32\proc-1333593830.bin 2007-06-14 18:59:05 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\GanymedeNet 2007-06-14 16:23:34 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Media Player Classic 2007-06-14 14:44:06 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Gadu-Gadu 2007-06-14 14:13:38 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-06-14 13:24:12 -------- d-----w C:\Program Files\Winamp 2007-06-14 12:31:33 0 ----a-w C:\WINDOWS\nsreg.dat 2007-06-14 08:37:24 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Tlen.pl 2007-06-14 08:21:12 -------- d--h--w C:\Program Files\WindowsUpdate 2007-06-14 07:59:35 -------- d-----w C:\Program Files\CDex 2007-06-14 07:56:09 -------- d-----w C:\Program Files\Alwil Software 2007-06-14 07:36:45 -------- d-----w C:\Program Files\Common Files\ODBC 2007-06-14 07:36:41 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-06-14 07:33:09 -------- d-----w C:\Program Files\XP Codec Pack 2007-06-14 07:25:09 -------- d-----w C:\Program Files\ToniArts 2007-06-14 07:22:17 -------- d-----w C:\Program Files\CyberLink DVD Solution 2007-06-14 07:20:04 -------- d-----w C:\Program Files\Ahead 2007-06-14 07:19:48 -------- d-----w C:\Program Files\Common Files\Ahead 2007-06-14 07:10:06 -------- d-----w C:\Program Files\C-Media 3D Audio 2007-06-14 07:07:44 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Help 2007-06-14 07:05:21 73,532 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-06-14 07:05:21 495,436 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-06-14 07:01:49 -------- d-----w C:\Program Files\ATI Technologies 2007-06-14 06:59:01 -------- d-----w C:\Program Files\Messenger 2007-06-14 06:51:09 -------- d-----w C:\Program Files\microsoft frontpage 2007-06-14 06:50:31 0 --sha-r C:\MSDOS.SYS 2007-06-14 06:50:31 0 --sha-r C:\IO.SYS 2007-06-14 06:50:31 0 ----a-w C:\CONFIG.SYS 2007-06-14 06:50:31 0 ----a-w C:\AUTOEXEC.BAT 2007-06-14 06:48:17 -------- d-----w C:\Program Files\Usługi online 2007-06-14 06:46:34 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-06-14 06:45:49 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-06-14 06:44:33 -------- d-----w C:\Program Files\Windows NT 2007-06-14 06:44:33 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-06-03 12:31:28 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-05-31 06:44:56 740,442 ----a-w C:\WINDOWS\system32\divx.dll 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-28 12:54:36 593,920 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-04-23 00:15:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:02:36 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2004-10-01 13:00:16 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ E:\RNE~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05] "Cmaudio"="cmicnfg.cpl" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "Microsoft security adviser"="C:\Program Files\Microsoft Security Adviser\mssadv.exe" [2007-07-15 18:06] "msctrl.exe"="C:\Program Files\Microsoft Security Adviser\msctrl.exe" [] "msavsc.exe"="C:\Program Files\Microsoft Security Adviser\msavsc.exe" [] "msscan.exe"="C:\Program Files\Microsoft Security Adviser\msscan.exe" [] "msiemon.exe"="C:\Program Files\Microsoft Security Adviser\msiemon.exe" [] "msfw.exe"="C:\Program Files\Microsoft Security Adviser\msfw.exe" [] "mssadv.exe"="" [] "BearShare"="D:\Program Files\BearShare\BearShare.exe" [2006-08-01 17:04] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="E:\RÓŻNE\Gadu-Gadu\gg.exe" [] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02] "DAEMON Tools"="E:\RÓŻNE\DAEMON Tools\daemon.exe" [] "Microsoft security adviser"="C:\Program Files\Microsoft Security Adviser\mssadv.exe" [2007-07-15 18:06] "msctrl.exe"="C:\Program Files\Microsoft Security Adviser\msctrl.exe" [] "msavsc.exe"="C:\Program Files\Microsoft Security Adviser\msavsc.exe" [] "msscan.exe"="C:\Program Files\Microsoft Security Adviser\msscan.exe" [] "msiemon.exe"="C:\Program Files\Microsoft Security Adviser\msiemon.exe" [] "msfw.exe"="C:\Program Files\Microsoft Security Adviser\msfw.exe" [] "mssadv.exe"="" [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dream Theater^Menu Start^Programy^Autostart^Hare.lnk] path=C:\Documents and Settings\Dream Theater\Menu Start\Programy\Autostart\Hare.lnk backup=C:\WINDOWS\pss\Hare.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "D:\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-17 14:01:46 Windows 5.1.2600 NTFS detected NTDLL code modification: ZwEnumerateKey, ZwEnumerateValueKey, ZwQueryValueKey, ZwQueryDirectoryFile, ZwQuerySystemInformation scanning hidden processes ... scanning hidden autostart entries ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon System = cswvz.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINDOWS\system32\userinit.exe, scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan ************************************************************************** Completion time: 2007-07-17 14:02:57 C:\ComboFix-quarantined-files.txt ... 2007-07-17 14:02 --- E O F ---

**Posty:** 18165 · przez **wojtas** 17 Lip 2007, 14:11

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Files to delete:

C:\WINDOWS\mssadv.dll
C:\svchost2.exe
C:\WINDOWS\system32\{D6BA901E-CF5C-4175-A139-12A21B742812}.exe

Folders to delete:

C:\Program Files\Microsoft Security Adviser

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [Microsoft security adviser] C:\Program Files\Microsoft Security Adviser\mssadv.exe
O4 - HKLM\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKLM\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKLM\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKLM\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKLM\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe
O4 - HKCU\..\Run: [Microsoft security adviser] C:\Program Files\Microsoft Security Adviser\mssadv.exe
O4 - HKCU\..\Run: [msctrl.exe] C:\Program Files\Microsoft Security Adviser\msctrl.exe
O4 - HKCU\..\Run: [msavsc.exe] C:\Program Files\Microsoft Security Adviser\msavsc.exe
O4 - HKCU\..\Run: [msscan.exe] C:\Program Files\Microsoft Security Adviser\msscan.exe
O4 - HKCU\..\Run: [msiemon.exe] C:\Program Files\Microsoft Security Adviser\msiemon.exe
O4 - HKCU\..\Run: [msfw.exe] C:\Program Files\Microsoft Security Adviser\msfw.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa + hijack

Autor postu otrzymał pochwałę

**Posty:** 385 · przez **Mathi00** 17 Lip 2007, 14:37

Kod: Zaznacz wszystko: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\sfrnsrdm ******************* Script file located at: \??\C:\WINDOWS\ixqfxsfg.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\mssadv.dll deleted successfully. File C:\svchost2.exe deleted successfully. File C:\WINDOWS\system32\{D6BA901E-CF5C-4175-A139-12A21B742812}.exe deleted successfully. Folder C:\Program Files\Microsoft Security Adviser deleted successfully. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: "Dream Theater" - 2007-07-17 14:30:09 - ComboFix 07-07-14.6 NTFS ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\myglobalsearch C:\Program Files\myglobalsearch\bar\History\search ((((((((((((((((((((((((( Files Created from 2007-06-17 to 2007-07-17 ))))))))))))))))))))))))))))))) 2007-07-17 14:00 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-17 13:47 1,950 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-17 13:46 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-07-17 13:46 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-17 13:46 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-07-16 14:43 <DIR> d-------- C:\Program Files\Foxit Software 2007-07-16 10:31 <DIR> d-------- C:\Program Files\SkanerOnline 2007-07-16 10:17 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-15 18:09 <DIR> d-------- C:\Program Files\SpyVampire 2007-07-14 19:03 25 --a------ C:\WINDOWS\SW_Win2000X32.DLL 2007-07-14 18:53 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\AdobeUM 2007-07-11 15:53 <DIR> d-------- C:\Program Files\Last.fm 2007-07-07 19:55 23 --ahs---- C:\WINDOWS\system32\afcdddad_r.dll 2007-07-07 19:37 <DIR> d-------- C:\WINDOWS\pss 2007-07-07 15:50 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\DANEAP~1\TEMP 2007-07-07 15:40 <DIR> d-------- C:\WINDOWS\Easy CD-DA Extractor 2007-07-07 15:25 729,088 --a------ C:\WINDOWS\iun6002.exe 2007-07-06 12:34 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2007-07-05 17:05 57,344 --a------ C:\WINDOWS\system32\Wnaspint.dll 2007-07-05 17:05 <DIR> d-------- C:\Program Files\VST 2007-07-05 17:05 <DIR> d-------- C:\Program Files\Acoustica Shared Effects 2007-07-05 17:05 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\Acoustica 2007-07-05 17:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Acoustica 2007-07-05 16:45 299 --ah----- C:\WINDOWS\wininf.dat 2007-07-04 13:46 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2007-07-04 11:10 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll 2007-07-03 22:02 <DIR> d-------- C:\Program Files\BitTorrent 2007-07-03 18:58 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\Sports Interactive 2007-06-29 20:29 <DIR> d-------- C:\Program Files\Windows Media Components 2007-06-29 20:24 <DIR> d--h----- C:\WINDOWS\msdownld.tmp 2007-06-29 20:23 97,280 --a------ C:\WINDOWS\system32\ccrpbds5.dll 2007-06-29 20:23 77,824 --a------ C:\WINDOWS\system32\eJ_Enumerator.dll 2007-06-29 20:23 401,462 --a------ C:\WINDOWS\system32\MSVCP60.DLL 2007-06-29 20:23 36,864 --a------ C:\WINDOWS\system32\eJayWMExport.dll 2007-06-29 20:23 29,696 --a------ C:\WINDOWS\system32\pthread.dll 2007-06-29 20:23 236,032 --a------ C:\WINDOWS\system32\devil.dll 2007-06-29 20:23 159,744 --a------ C:\WINDOWS\system32\DartSock.dll 2007-06-29 20:23 106,496 --a------ C:\WINDOWS\system32\DartWeb.dll 2007-06-29 20:23 1,386,496 --a------ C:\WINDOWS\system32\msvbvm60.dll 2007-06-29 20:14 <DIR> d-------- C:\WINDOWS\speech 2007-06-29 10:13 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-06-29 10:13 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-06-29 10:13 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-06-29 10:13 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-06-27 10:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-06-27 08:56 28,672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys 2007-06-27 08:44 <DIR> d-------- C:\DOCUME~1\DREAMT~1\.housecall6.6 2007-06-27 08:38 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-06-21 16:59 <DIR> d-------- C:\Program Files\Techland 2007-06-21 07:42 <DIR> d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-06-20 10:05 <DIR> d-------- C:\Program Files\Odkurzacz 2007-06-18 08:58 977,920 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-06-18 08:58 97,280 --a------ C:\WINDOWS\system32\txflog.dll 2007-06-18 08:58 82,432 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-06-18 08:58 64,512 --a------ C:\WINDOWS\system32\mtxclu.dll 2007-06-18 08:58 64,512 --a------ C:\WINDOWS\system32\colbact.dll 2007-06-18 08:58 596,480 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-06-18 08:58 499,200 --a------ C:\WINDOWS\system32\comuid.dll 2007-06-18 08:58 442,880 --a------ C:\WINDOWS\system32\rpcrt4.dll 2007-06-18 08:58 365,568 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-06-18 08:58 226,816 --a------ C:\WINDOWS\system32\es.dll 2007-06-18 08:58 225,280 --a------ C:\WINDOWS\system32\catsrv.dll 2007-06-18 08:58 214,528 --a------ C:\WINDOWS\system32\rpcss.dll 2007-06-18 08:58 150,528 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-06-18 08:58 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-06-18 08:58 1,177,088 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-06-18 08:58 1,105,408 --a------ C:\WINDOWS\system32\ole32.dll 2007-06-18 08:57 593,408 --a------ C:\WINDOWS\system32\h323msp.dll 2007-06-18 08:57 552,448 --a------ C:\WINDOWS\system32\rtcdll.dll 2007-06-18 08:57 48,640 --a------ C:\WINDOWS\system32\browser.dll 2007-06-18 08:57 454,144 --a------ C:\WINDOWS\system32\ipnathlp.dll 2007-06-18 08:57 36,864 --a------ C:\WINDOWS\system32\mf3216.dll 2007-06-17 21:18 <DIR> d-------- C:\Program Files\Skype 2007-06-17 21:18 <DIR> d-------- C:\DOCUME~1\DREAMT~1\DANEAP~1\Skype 2007-06-17 21:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Skype (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-17 12:16:25 67,078 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-07-17 12:16:25 435,978 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-07-15 11:58:11 34 ----a-w C:\WINDOWS\hare.dat 2007-07-14 17:14:45 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-07-10 16:31:34 1,656 ----a-w C:\WINDOWS\mozver.dat 2007-07-03 16:47:50 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-06-29 18:12:26 980 ----a-w C:\WINDOWS\unins000.dat 2007-06-29 08:14:15 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-06-20 08:08:08 -------- d-----w C:\Program Files\Movie Maker 2007-06-15 15:29:27 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2007-06-14 18:59:05 4 ----a-w C:\WINDOWS\system32\proc-1333593830.bin 2007-06-14 18:59:05 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\GanymedeNet 2007-06-14 16:23:34 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Media Player Classic 2007-06-14 14:44:06 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Gadu-Gadu 2007-06-14 14:13:38 -------- d-----w C:\Program Files\K-Lite Codec Pack 2007-06-14 13:24:12 -------- d-----w C:\Program Files\Winamp 2007-06-14 12:31:33 0 ----a-w C:\WINDOWS\nsreg.dat 2007-06-14 08:37:24 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Tlen.pl 2007-06-14 08:21:12 -------- d--h--w C:\Program Files\WindowsUpdate 2007-06-14 07:59:35 -------- d-----w C:\Program Files\CDex 2007-06-14 07:56:09 -------- d-----w C:\Program Files\Alwil Software 2007-06-14 07:36:45 -------- d-----w C:\Program Files\Common Files\ODBC 2007-06-14 07:36:41 -------- d-----w C:\Program Files\Common Files\SpeechEngines 2007-06-14 07:33:09 -------- d-----w C:\Program Files\XP Codec Pack 2007-06-14 07:25:09 -------- d-----w C:\Program Files\ToniArts 2007-06-14 07:22:17 -------- d-----w C:\Program Files\CyberLink DVD Solution 2007-06-14 07:20:04 -------- d-----w C:\Program Files\Ahead 2007-06-14 07:19:48 -------- d-----w C:\Program Files\Common Files\Ahead 2007-06-14 07:10:06 -------- d-----w C:\Program Files\C-Media 3D Audio 2007-06-14 07:07:44 -------- d-----w C:\DOCUME~1\DREAMT~1\DANEAP~1\Help 2007-06-14 07:01:49 -------- d-----w C:\Program Files\ATI Technologies 2007-06-14 06:59:01 -------- d-----w C:\Program Files\Messenger 2007-06-14 06:51:09 -------- d-----w C:\Program Files\microsoft frontpage 2007-06-14 06:50:31 0 --sha-r C:\MSDOS.SYS 2007-06-14 06:50:31 0 --sha-r C:\IO.SYS 2007-06-14 06:50:31 0 ----a-w C:\CONFIG.SYS 2007-06-14 06:50:31 0 ----a-w C:\AUTOEXEC.BAT 2007-06-14 06:48:17 -------- d-----w C:\Program Files\Usługi online 2007-06-14 06:46:34 -------- d-----w C:\Program Files\Common Files\MSSoap 2007-06-14 06:45:49 21,856 ----a-w C:\WINDOWS\system32\emptyregdb.dat 2007-06-14 06:44:33 -------- d-----w C:\Program Files\Windows NT 2007-06-14 06:44:33 -------- d-----w C:\Program Files\MSN Gaming Zone 2007-06-03 12:31:28 10,752 ----a-w C:\WINDOWS\system32\ff_vfw.dll 2007-05-31 06:44:56 740,442 ----a-w C:\WINDOWS\system32\divx.dll 2007-04-30 15:46:10 745,600 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-04-30 15:35:28 95,872 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2007-04-28 12:54:36 593,920 ----a-w C:\WINDOWS\system32\xvidcore.dll 2007-04-23 00:15:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2007-04-23 00:02:36 73,728 ----a-w C:\WINDOWS\system32\dpl100.dll 2004-10-01 13:00:16 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2005-05-31 01:04 853672 --a------ E:\RNE~1\SPYBOT~1\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] 2007-03-14 03:43 501400 --a------ C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-02-22 21:05] "Cmaudio"="cmicnfg.cpl" [] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42] "mssadv.exe"="" [] "BearShare"="D:\Program Files\BearShare\BearShare.exe" [2006-08-01 17:04] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="E:\RÓŻNE\Gadu-Gadu\gg.exe" [] "Odkurzacz-MCD"="C:\Program Files\Odkurzacz\odk_mcd.exe" [2007-05-03 10:02] "DAEMON Tools"="E:\RÓŻNE\DAEMON Tools\daemon.exe" [] "mssadv.exe"="" [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Dream Theater^Menu Start^Programy^Autostart^Hare.lnk] path=C:\Documents and Settings\Dream Theater\Menu Start\Programy\Autostart\Hare.lnk backup=C:\WINDOWS\pss\Hare.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] "D:\BearShare\BearShare.exe" /pause [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Komunikator] C:\Program Files\Tlen.pl\tlen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} rundll32 iesetup.dll,IEAccessUserInst ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-17 14:32:32 Windows 5.1.2600 NTFS detected NTDLL code modification: ZwEnumerateKey, ZwEnumerateValueKey, ZwQueryValueKey, ZwQueryDirectoryFile, ZwQuerySystemInformation scanning hidden processes ... scanning hidden autostart entries ... HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon System = csegh.exe HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINDOWS\system32\userinit.exe, scanning hidden files ... disk error: C:\WINDOWS\ please note that you need administrator rights to perform deep scan ************************************************************************** Completion time: 2007-07-17 14:34:17 C:\ComboFix-quarantined-files.txt ... 2007-07-17 14:33 C:\ComboFix2.txt ... 2007-07-17 14:02 --- E O F ---

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 14:35:11, on 2007-07-17 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe D:\Program Files\BearShare\BearShare.exe C:\WINDOWS\System32\alg.exe E:\RÓŻNE\Alcohol 120\StarWind\StarWindServiceAE.exe E:\RÓŻNE\DAEMON Tools\daemon.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe E:\RÓŻNE\hj\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\RNE~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Tłumaczenie - {0D704FAD-66E9-4F0A-BFED-4F665770DDB3} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [BearShare] "D:\Program Files\BearShare\BearShare.exe" /pause O4 - HKCU\..\Run: [Gadu-Gadu] "E:\RÓŻNE\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU\..\Run: [DAEMON Tools] "E:\RÓŻNE\DAEMON Tools\daemon.exe" -lang 1033 O8 - Extra context menu item: &D&ownload &with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://E:\RÓŻNE\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Add to AMV Converter... - E:\RÓŻNE\MP3 Player Utilities 4.13\AMVConverter\grab.html O8 - Extra context menu item: MediaManager tool grab multimedia file - E:\RÓŻNE\MP3 Player Utilities 4.13\MediaManager\grab.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O9 - Extra 'Tools' menuitem: @C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll,-103 - {B46B0919-62BA-4D99-A5C4-916B57A6805C} - C:\Program Files\Techland\Common\InternetTranslator\InternetTranslator.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181809142655 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\RÓŻNE\Alcohol 120\StarWind\StarWindServiceAE.exe

[ Dodano: Dzisiaj o 13:38 ]
Już wszystko działa, dzięki wielkie

**Posty:** 18165 · przez **wojtas** 17 Lip 2007, 19:29

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mssadv.exe"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=-
"Userinit"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

potem te 3 pliki przeskanuj:

C:\WINDOWS\SW_Win2000X32.DLL
C:\WINDOWS\system32\afcdddad_r.dll
C:\WINDOWS\wininf.dat

tu i daj raporty:

http://virusscan.jotti.org/
http://www.virustotal.com/

proszę o sprawdzenie loga

proszę o sprawdzenie loga

Kto jest na forum