Zamykanie systemu- odliczanie

**Posty:** 388 · przez **banior** 12 Gru 2008, 19:45

witam!

Mam problem. Po zalogowaniu do systemu otrzymuje infromacje o zxamknieciu procesu services.exe( jakoś tak) z informacją, że za minute wyłaczy sie system..

Log z HI.

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 15:43:57, on 2008-12-12 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Winamp\Winampa.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\imapi.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Winamp\winamp.exe C:\WINDOWS\system32\dumprep.exe C:\WINDOWS\system32\dwwin.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\Downloads n\Programy\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: flashget2 urlcatch - {1f364306-aa45-47b5-9f9d-39a8b94e7ef1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (file missing) O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [abjlpdwl] %systemroot%\abjlpdwl.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &download all by flashget - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm O8 - Extra context menu item: &download by flashget - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193c772a-87be-4b19-a7bb-445b226fe9a1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing) O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

**Posty:** 8001 · przez **Okocza** 12 Gru 2008, 19:51

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [abjlpdwl] %systemroot%\abjlpdwl.exe

fix w hj

daj log z combofixa

**Posty:** 388 · przez **banior** 12 Gru 2008, 20:07

Kod: Zaznacz wszystko: ComboFix 08-12-11.06 - Banek 2008-12-12 16:00:10.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.2509 [GMT 1:00] Uruchomiony z: c:\documents and settings\Banek\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Dane aplikacji\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\Banek\Dane aplikacji\BITS c:\documents and settings\Banek\Dane aplikacji\BITS\BITS.ini c:\documents and settings\Banek\Dane aplikacji\BITS\DHTTable.dat c:\documents and settings\Banek\Dane aplikacji\BITS\ProxyList.ini c:\documents and settings\Banek\Dane aplikacji\BITS\UPnP.ini c:\documents and settings\Banek\Dane aplikacji\inst.exe c:\windows\system32\BitCometRes.dll c:\windows\system32\hpvaut32.dll c:\windows\system32\hpvcp70.dll c:\windows\system32\hpvcr70.dll ----- BITS: Możliwe zainfekowane strony ----- hxxp://java.comz@'@-@@@'@Sun Sansjinstall.cfg%s hxxp://java.com hxxp://www.java.com hxxp://java.comP|UJava o00:d hxxp://java.comP|UJava vO(uASRnfMOY(uNyR5u0Lhb{:g0IQIQxd>ehV0:gvvu . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_isodrive -------\Service_isodrive ((((((((((((((((((((((((( Pliki utworzone od 2008-11-12 do 2008-12-12 ))))))))))))))))))))))))))))))) . 2008-12-12 16:05 . 2003-12-11 11:15 626,960 -ra------ c:\windows\system32\hpvaut32.dll 2008-12-12 16:05 . 2003-12-11 11:15 487,424 -ra------ c:\windows\system32\hpvcp70.dll 2008-12-12 16:04 . 2003-12-11 11:15 344,064 -ra------ c:\windows\system32\hpvcr70.dll 2008-12-12 16:03 . 2008-12-12 16:03 <DIR> d--hs---- C:\FOUND.009 2008-12-12 11:48 . 2008-12-12 11:48 <DIR> d--hs---- C:\FOUND.008 2008-12-12 11:35 . 2008-12-12 11:35 <DIR> d-------- c:\windows\LastGood.Tmp 2008-12-09 19:36 . 2008-12-09 19:36 <DIR> d-------- C:\Nowy folder 2008-12-03 18:15 . 2008-12-03 18:15 <DIR> d-------- c:\program files\Ubisoft 2008-12-03 18:15 . 1994-09-21 00:00 12,800 --a------ c:\windows\system32\WING32.DLL 2008-12-02 17:16 . 2008-12-02 17:16 <DIR> d-------- C:\!KillBox 2008-12-01 19:43 . 2003-12-11 11:15 44,544 -ra------ c:\windows\system32\MSXML4a.dll 2008-12-01 19:37 . 2008-12-01 19:37 <DIR> d-------- c:\program files\Hewlett-Packard 2008-12-01 19:36 . 2008-12-01 19:36 <DIR> d-------- c:\program files\HP 2008-12-01 19:36 . 2008-12-01 19:44 551,203 --a------ c:\windows\hpdj3740.his 2008-12-01 19:36 . 2008-12-01 19:44 10,647 --a------ c:\windows\hpdj3740.ini 2008-11-30 09:05 . 2008-11-30 09:05 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-11-30 08:50 . 2008-11-30 08:50 <DIR> d-------- c:\windows\system32\drivers\Avg 2008-11-30 08:50 . 2008-11-30 08:50 <DIR> d-------- c:\program files\AVG 2008-11-30 08:50 . 2008-11-30 08:50 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\avg8 2008-11-30 08:50 . 2008-11-30 08:50 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-30 08:50 . 2008-11-30 08:50 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-30 08:50 . 2008-11-30 08:50 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-11-30 08:33 . 2008-11-30 08:33 <DIR> d--hs---- C:\FOUND.007 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-11-29 19:50 . 2008-11-29 19:50 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-11-29 19:37 . 2008-11-29 19:37 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2008-11-29 19:37 . 2008-11-29 19:37 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-11-29 18:42 . 2008-11-29 18:42 <DIR> d-------- c:\program files\Blue Byte 2008-11-29 18:26 . 2008-11-29 18:26 <DIR> d-------- c:\program files\DOSBox-0.72 2008-11-29 09:15 . 2008-11-29 09:15 68,296 --a------ c:\windows\system32\drivers\GRD.sys 2008-11-29 09:13 . 2008-11-29 09:13 <DIR> d-------- c:\program files\Common Files\G DATA 2008-11-29 09:13 . 2008-11-29 09:13 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\G DATA 2008-11-29 09:13 . 2008-11-29 09:13 50,888 --a------ c:\windows\system32\drivers\MiniIcpt.sys 2008-11-29 09:13 . 2008-11-29 09:13 50,888 --a------ c:\windows\system32\drivers\GDTdiIcpt.sys 2008-11-29 08:27 . 2008-11-29 08:27 <DIR> d-------- c:\program files\Lucky18 Casino 2008-11-28 20:25 . 2008-11-28 20:25 <DIR> d-------- C:\profiles 2008-11-27 18:03 . 2008-11-27 18:03 <DIR> d--hs---- C:\FOUND.006 2008-11-27 11:06 . 2008-11-27 11:06 <DIR> d--hs---- C:\FOUND.005 2008-11-27 10:27 . 2008-11-27 10:27 <DIR> d--hs---- C:\FOUND.004 2008-11-27 10:01 . 2008-11-27 10:01 <DIR> d--hs---- C:\FOUND.003 2008-11-26 19:07 . 2008-11-26 19:07 <DIR> d-------- c:\windows\ServicePackFiles 2008-11-26 19:07 . 2008-04-14 22:51 294,912 --------- c:\windows\system32\dllcache\dlimport.exe 2008-11-26 18:57 . 2008-11-26 18:57 <DIR> d-------- C:\BLUEBYTE 2008-11-25 18:25 . 2008-11-25 18:25 <DIR> d-------- C:\nfs 2008-11-24 15:45 . 2008-11-24 15:45 <DIR> d-------- C:\office sharepoint2007 2008-11-23 20:59 . 2008-11-23 20:59 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Dev-Cpp 2008-11-22 21:13 . 2008-11-22 21:13 <DIR> d---s---- c:\documents and settings\Banek\UserData 2008-11-21 19:58 . 2008-11-21 19:58 <DIR> dr-h----- c:\documents and settings\Banek\Dane aplikacji\SecuROM 2008-11-21 19:58 . 2008-11-21 19:58 107,888 --a------ c:\windows\system32\CmdLineExt.dll 2008-11-21 19:54 . 2008-11-21 19:54 <DIR> d-------- c:\program files\Common Files\Adobe 2008-11-21 19:46 . 2008-11-21 19:46 <DIR> d-------- c:\program files\Atari 2008-11-21 19:25 . 2008-11-21 19:25 <DIR> d-------- c:\program files\UltraISO 2008-11-21 19:25 . 2008-11-21 19:25 <DIR> d-------- c:\program files\Common Files\EZB Systems 2008-11-20 18:38 . 2008-11-20 18:38 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\OpenOffice.org2 2008-11-19 19:14 . 2008-11-19 19:14 <DIR> d-------- C:\Downloads 2008-11-19 19:13 . 2008-11-19 19:13 <DIR> d-------- c:\program files\BitComet 2008-11-19 11:48 . 2008-11-19 11:49 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\BESTplayer 2008-11-18 20:54 . 2008-11-18 20:54 626,065,408 --a------ C:\WinLite.iso 2008-11-18 20:27 . 2008-11-18 20:27 <DIR> d-------- c:\program files\nLite 2008-11-18 20:09 . 2008-11-18 20:09 <DIR> d-------- c:\program files\Intel 2008-11-18 20:09 . 2008-11-18 20:09 <DIR> d-------- C:\Intel 2008-11-18 08:00 . 2008-11-18 08:00 <DIR> d--hs---- C:\FOUND.002 2008-11-17 22:32 . 86,750 c:\windows\system32\drivers\7631126c.sys 2008-11-17 17:56 . 2008-11-17 17:56 <DIR> d-------- c:\program files\VSO 2008-11-17 17:56 . 2008-11-17 17:56 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Vso 2008-11-17 17:56 . 2008-11-17 17:56 94,208 --a------ c:\windows\system32\drivers\ezplay.sys 2008-11-17 17:56 . 2008-11-17 17:56 94,208 --a------ c:\documents and settings\Banek\Dane aplikacji\ezplay.sys 2008-11-17 17:56 . 2008-11-17 17:56 47,360 --a------ c:\windows\system32\drivers\pcouffin.sys 2008-11-17 17:56 . 2008-11-17 17:56 47,360 --a------ c:\documents and settings\Banek\Dane aplikacji\pcouffin.sys 2008-11-16 15:32 . 2002-01-12 16:30 3,567 --a------ c:\windows\system32\drivers\PortTalk.sys 2008-11-16 13:33 . 2008-11-16 13:33 <DIR> d-------- c:\windows\Sun 2008-11-16 08:10 . 2008-04-14 22:51 221,184 --a------ c:\windows\system32\wmpns.dll 2008-11-15 19:04 . 2008-11-15 19:04 <DIR> d-------- C:\Mortal Kombat PL 2008-11-15 19:03 . 2008-12-10 21:00 69 --a------ c:\windows\NeroDigital.ini 2008-11-15 18:57 . 2008-11-15 18:57 <DIR> d-------- c:\program files\MSXML 4.0 2008-11-15 16:09 . 2008-11-15 16:09 <DIR> d-------- c:\documents and settings\Banek\Dane aplikacji\Ahead 2008-11-15 16:09 . 2008-11-15 16:09 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Ahead 2008-11-15 16:06 . 2008-11-15 16:06 <DIR> d-------- c:\program files\Nero 2008-11-15 16:06 . 2008-11-15 16:06 <DIR> d-------- c:\program files\Common Files\Ahead 2008-11-15 16:06 . 2008-11-15 16:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Nero 2008-11-14 20:10 . 2008-11-14 20:10 <DIR> d-------- c:\program files\TVAnts 2008-11-14 19:38 . 2006-12-10 22:32 499,712 --a------ c:\windows\system32\msvcp71.dll 2008-11-14 19:38 . 2006-12-10 22:32 348,160 --a------ c:\windows\system32\msvcr71.dll 2008-11-14 19:38 . 2008-06-08 22:58 60,273 --a------ c:\windows\system32\pthreadGC2.dll 2008-11-14 19:38 . 2008-11-02 15:02 7,680 --a------ c:\windows\system32\ff_vfw.dll 2008-11-14 19:38 . 2008-11-02 15:02 6,144 --a------ c:\windows\system32\ff_acm.acm 2008-11-14 19:38 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest 2008-11-14 19:22 . 2008-11-14 19:22 <DIR> d-------- c:\program files\ffdshow 2008-11-14 19:22 . 2008-11-14 19:22 <DIR> d-------- c:\program files\DirectShow Pack 2008-11-14 19:19 . 2008-11-14 19:19 <DIR> d-------- c:\program files\Java 2008-11-14 19:19 . 2008-11-14 19:19 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-14 19:19 . 2008-11-14 19:19 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-14 17:52 . 2008-11-14 17:52 <DIR> d-------- c:\program files\SAGEM 2008-11-14 17:35 . 2008-11-14 17:35 <DIR> d-------- c:\program files\SopCast 2008-11-13 19:47 . 2008-11-13 19:47 <DIR> d-------- C:\SportsKeeping 2008-11-13 19:06 . 2008-11-13 19:06 <DIR> d-------- c:\program files\ATI 2008-11-13 19:04 . 2008-11-13 19:04 <DIR> d-------- c:\program files\ATI Technologies 2008-11-13 19:04 . 2008-11-13 19:04 <DIR> d-------- C:\ATI 2008-11-13 17:59 . 2008-09-15 16:27 1,846,656 --------- c:\windows\system32\dllcache\win32k.sys 2008-11-13 17:51 . 2008-05-07 06:12 1,291,776 --------- c:\windows\system32\dllcache\quartz.dll 2008-11-13 17:51 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\drivers\bthport.sys 2008-11-13 17:51 . 2008-06-14 18:36 273,024 --------- c:\windows\system32\dllcache\bthport.sys 2008-11-13 17:50 . 2008-09-08 11:41 333,824 --------- c:\windows\system32\dllcache\srv.sys 2008-11-13 17:50 . 2008-08-14 11:04 138,496 --------- c:\windows\system32\dllcache\afd.sys 2008-11-13 17:27 . 2008-08-14 14:26 2,190,464 --------- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-13 17:27 . 2008-08-14 14:26 2,146,816 --------- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-13 17:27 . 2008-08-14 14:26 2,067,328 --------- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-13 17:27 . 2008-08-14 14:26 2,025,472 --------- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-13 17:27 . 2008-04-11 20:06 691,712 --------- c:\windows\system32\dllcache\inetcomm.dll 2008-11-13 17:25 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-13 17:25 . 2008-05-08 15:02 203,136 --------- c:\windows\system32\dllcache\rmcast.sys 2008-11-13 15:28 . 2008-11-13 15:28 <DIR> d-------- c:\program files\K-Lite Codec Pack 2008-11-13 08:02 . 2008-10-15 17:36 337,408 --------- c:\windows\system32\dllcache\netapi32.dll 2008-11-12 21:01 . 2008-11-12 21:01 <DIR> d-------- C:\my shared folder 2008-11-12 21:01 . 2008-11-12 21:01 <DIR> d-------- C:\eMule 2008-11-12 20:56 . 2008-11-12 20:56 <DIR> d-------- C:\stery . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-25 14:29 94,208 ----a-w c:\windows\DUMP6b7b.tmp 2008-11-14 17:01 94,208 ----a-w c:\windows\DUMP25a8.tmp 2008-11-11 15:27 --------- d-----w c:\program files\eMule 2008-11-11 13:33 --------- d-----w c:\program files\Kings Bounty 2008-11-11 12:50 --------- d-----w c:\program files\Lavalys 2008-11-11 11:38 --------- d-----w c:\program files\Winamp 2008-11-11 11:38 --------- d-----w c:\program files\Codec 2008-11-11 11:37 --------- d-----w c:\documents and settings\Banek\Dane aplikacji\Talkback 2008-11-11 10:32 86,016 ----a-w c:\windows\system32\OpenAL32.dll 2008-11-11 10:32 262,144 ----a-w c:\windows\system32\wrap_oal.dll 2008-11-11 10:20 --------- d-----w c:\program files\Futuremark 2008-11-11 09:50 --------- d-----w c:\program files\AMD 2008-11-11 09:48 315,392 ----a-w c:\windows\HideWin.exe 2008-11-11 09:48 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-11 09:48 --------- d-----w c:\program files\Realtek 2008-11-11 09:47 --------- d-----w c:\program files\Common Files\InstallShield 2008-11-11 09:46 --------- d-----w c:\documents and settings\Banek\Dane aplikacji\InstallShield 2008-11-11 09:38 --------- d-----w c:\program files\microsoft frontpage 2008-11-11 09:36 --------- d-----w c:\program files\Usługi online 2008-10-29 03:11 3,341,824 ----a-w c:\windows\system32\drivers\ati2mtag.sys 2008-10-29 03:11 3,341,824 ----a-w c:\windows\system32\dllcache\ati2mtag.sys 2008-10-29 02:23 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll 2008-10-29 02:22 314,880 ----a-w c:\windows\system32\ati2dvag.dll 2008-10-29 02:11 43,520 ----a-w c:\windows\system32\ati2edxx.dll 2008-10-29 02:11 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe 2008-10-29 02:11 188,416 ----a-w c:\windows\system32\atipdlxx.dll 2008-10-29 02:11 147,456 ----a-w c:\windows\system32\Oemdspif.dll 2008-10-29 02:11 10,973,184 ----a-w c:\windows\system32\atioglxx.dll 2008-10-29 02:10 143,360 ----a-w c:\windows\system32\ati2evxx.dll 2008-10-29 02:09 585,728 ----a-w c:\windows\system32\ati2evxx.exe 2008-10-29 02:07 53,248 ----a-w c:\windows\system32\ATIDDC.DLL 2008-10-29 01:58 4,041,472 ----a-w c:\windows\system32\ati3duag.dll 2008-10-29 01:49 307,200 ----a-w c:\windows\system32\atiiiexx.dll 2008-10-29 01:41 2,472,832 ----a-w c:\windows\system32\ativvaxx.dll 2008-10-29 01:25 48,640 ----a-w c:\windows\system32\amdpcom32.dll 2008-10-29 01:21 389,120 ----a-w c:\windows\system32\atikvmag.dll 2008-10-29 01:19 44,032 ----a-w c:\windows\system32\atiadlxx.dll 2008-10-29 01:19 17,408 ----a-w c:\windows\system32\atitvo32.dll 2008-10-29 01:18 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll 2008-10-29 01:18 253,952 ----a-w c:\windows\system32\atiok3x2.dll 2008-10-29 01:12 577,536 ----a-w c:\windows\system32\ati2cqag.dll 2008-10-28 20:05 593,920 ------w c:\windows\system32\ati2sgag.exe 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:42 286,720 ----a-w c:\windows\system32\gdi32.dll 2008-10-23 12:42 286,720 ------w c:\windows\system32\dllcache\gdi32.dll 2008-10-21 17:51 118,784 ----a-w c:\windows\system32\atibrtmon.exe 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\dllcache\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 13:12 561,688 ----a-w c:\windows\system32\dllcache\wuapi.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 13:12 323,608 ----a-w c:\windows\system32\dllcache\wucltui.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\dllcache\cdm.dll 2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 13:09 51,224 ----a-w c:\windows\system32\dllcache\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 13:08 34,328 ----a-w c:\windows\system32\dllcache\wups.dll 2008-10-16 01:02 668,672 ----a-w c:\windows\system32\wininet.dll 2008-10-16 01:02 668,672 ------w c:\windows\system32\dllcache\wininet.dll 2008-10-16 01:02 619,520 ------w c:\windows\system32\dllcache\urlmon.dll 2008-10-16 01:02 3,088,896 ------w c:\windows\system32\dllcache\mshtml.dll 2008-10-16 01:02 1,499,136 ------w c:\windows\system32\dllcache\shdocvw.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\strmdll.dll 2008-10-03 10:04 247,326 ----a-w c:\windows\system32\dllcache\strmdll.dll 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys . ((((((((((((((((((((((((((((( snapshot_2008-11-29_19.29.34,17 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 19:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE + 2004-03-17 13:11:52 5,428 ----a-w c:\windows\hpfmdl_s04_main.dat + 2008-12-01 18:44:12 45,056 ----a-r c:\windows\Installer\{B81023A5-71ED-46EB-BE3B-9F974D1155F1}\HPSUShortcut2_936C42D08CEE4BDFB8CEC4BDC93C6CF8_1.exe - 2004-08-11 00:45:04 96,768 ----a-w c:\windows\system32\dllcache\logagent.exe + 2008-06-10 08:17:42 96,768 ----a-w c:\windows\system32\dllcache\logagent.exe - 2004-08-11 00:45:04 1,027,072 ----a-w c:\windows\system32\dllcache\wmnetmgr.dll + 2008-06-10 10:37:02 1,026,048 ----a-w c:\windows\system32\dllcache\WMNetmgr.dll - 2006-12-07 06:40:50 2,362,184 ----a-w c:\windows\system32\dllcache\wmvcore.dll + 2008-06-10 10:57:40 2,364,472 ----a-w c:\windows\system32\dllcache\WMVCore.dll + 2008-11-30 07:50:40 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys + 2004-03-04 15:04:54 196,608 ----a-w c:\windows\system32\hpzcoi10.dll + 2004-03-04 15:05:56 344,064 ----a-w c:\windows\system32\hpzcon10.dll + 2004-03-04 15:18:08 180,315 ----a-w c:\windows\system32\hpzsnt10.dll - 2004-08-11 00:45:04 96,768 ----a-w c:\windows\system32\logagent.exe + 2008-06-10 08:17:42 96,768 ----a-w c:\windows\system32\logagent.exe - 2008-11-03 15:10:26 17,318,336 ----a-w c:\windows\system32\MRT.exe + 2008-12-09 23:24:38 17,593,280 ----a-w c:\windows\system32\MRT.exe - 2008-08-20 05:11:06 3,088,896 ----a-w c:\windows\system32\mshtml.dll + 2008-10-16 01:02:56 3,088,896 ----a-w c:\windows\system32\mshtml.dll - 2008-08-20 05:11:04 1,499,136 ----a-w c:\windows\system32\shdocvw.dll + 2008-10-16 01:02:54 1,499,136 ----a-w c:\windows\system32\shdocvw.dll + 2004-03-04 15:48:52 168,640 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpf2vw10.dat + 2004-03-04 14:18:50 196,608 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpz2ku10.dll + 2004-03-04 15:10:04 286,720 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzcfg10.exe + 2004-03-04 15:04:54 196,608 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzcoi10.dll + 2004-03-04 15:05:56 344,064 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzcon10.dll + 2004-03-04 14:55:18 647,168 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzeng10.exe + 2004-03-04 00:21:36 1,589,248 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzimc10.dll + 2004-03-04 00:22:20 352,256 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzime10.dll + 2004-03-04 15:11:32 200,704 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzjui10.dll + 2004-03-04 14:33:50 487,424 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzpm310.dll + 2004-03-04 15:24:04 331,776 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzpre10.exe + 2004-03-04 19:22:14 3,198,976 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzr3210.dll + 2004-03-04 19:18:22 1,708,032 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzrm310.dll + 2004-03-04 15:37:00 679,936 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzslk10.dll + 2004-03-04 15:18:08 180,315 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzsnt10.dll + 2004-03-04 15:43:30 385,024 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzstc10.exe + 2004-03-04 14:56:28 163,840 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpzstw10.exe + 2004-03-04 15:47:08 61,440 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpztbi10.dll + 2004-03-04 15:46:24 172,032 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpztbu10.exe + 2004-03-04 15:34:16 7,331,840 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpztbx10.exe + 2004-03-04 15:46:24 172,032 ----a-w c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe + 2004-03-04 15:48:52 168,640 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpf2vw10.dat + 2004-03-04 14:18:50 196,608 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpz2ku10.dll + 2004-03-04 15:10:04 286,720 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzcfg10.exe + 2004-03-04 15:04:54 196,608 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzcoi10.dll + 2004-03-04 15:05:56 344,064 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzcon10.dll + 2004-03-04 14:55:18 647,168 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzeng10.exe + 2004-03-04 00:21:36 1,589,248 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzimc10.dll + 2004-03-04 00:22:20 352,256 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzime10.dll + 2004-03-04 15:11:32 200,704 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzjui10.dll + 2004-03-04 14:33:50 487,424 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzpm310.dll + 2004-03-04 15:24:04 331,776 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzpre10.exe + 2004-03-04 19:22:14 3,198,976 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzr3210.dll + 2004-03-04 19:18:22 1,708,032 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzrm310.dll + 2004-03-04 15:37:00 679,936 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzslk10.dll + 2004-03-04 15:18:08 180,315 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzsnt10.dll + 2004-03-04 15:43:30 385,024 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzstc10.exe + 2004-03-04 14:56:28 163,840 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpzstw10.exe + 2004-03-04 15:47:08 61,440 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpztbi10.dll + 2004-03-04 15:46:24 172,032 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpztbu10.exe + 2004-03-04 15:34:16 7,331,840 ----a-w c:\windows\system32\spool\drivers\w32x86\hpdeskjet_37404f2e\hpztbx10.exe - 2008-04-14 21:51:46 60,416 ------w c:\windows\system32\tzchange.exe + 2008-10-23 10:07:00 62,976 ------w c:\windows\system32\tzchange.exe - 2008-08-20 05:11:04 619,520 ----a-w c:\windows\system32\urlmon.dll + 2008-10-16 01:02:56 619,520 ----a-w c:\windows\system32\urlmon.dll - 2004-08-11 00:45:04 1,027,072 ----a-w c:\windows\system32\wmnetmgr.dll + 2008-06-10 10:37:02 1,026,048 ----a-w c:\windows\system32\WMNetmgr.dll - 2006-12-07 06:40:50 2,362,184 ----a-w c:\windows\system32\wmvcore.dll + 2008-06-10 10:57:40 2,364,472 ----a-w c:\windows\system32\WMVCore.dll + 2008-12-12 15:04:40 16,384 ----a-w c:\windows\Temp\Perflib_Perfdata_45c.dat . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016] "WinampAgent"="c:\program files\Winamp\Winampa.exe" [2003-04-02 12288] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-14 136600] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-02 1261336] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664] "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032] "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2004-02-18 49152] "nwiz"="nwiz.exe" [2006-10-31 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2007-11-22 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3acm"= l3codecp.acm "msacm.avis"= ff_acm.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] --a------ 2008-08-29 16:11 61440 c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "e:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\eMule\\emule.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "c:\\Program Files\\TVAnts\\Tvants.exe"= "c:\\Program Files\\BitComet\\BitComet.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "22412:TCP"= 22412:TCP:BitComet 22412 TCP "22412:UDP"= 22412:UDP:BitComet 22412 UDP R1 avgldx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-30 97928] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-30 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-30 231704] R2 avgtdix;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-30 76040] S2 rsstrqro;rsstrqro;\??\c:\windows\system32\drivers\rsstrqro.sys [] S3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [2008-11-16 3567] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c5a31c0-afda-11dd-b6a1-806d6172696f}] \Shell\AutoRun\command - D:\livebox_tp.EXE . . ------- Skan uzupełniający ------- . IE: &download all by flashget - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm IE: &download by flashget - c:\program files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm c:\windows\Downloaded Program Files\ewidoOnlineScan.dll - O16 -: {193c772a-87be-4b19-a7bb-445b226fe9a1} hxxp://downloads.ewido.net/ewidoOnlineScan.cab . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-12 16:04:41 Windows 5.1.2600 Dodatek Service Pack 3 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\controlset005\Services\7631126c] "ImagePath"="\SystemRoot\System32\drivers\7631126c.sys" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(560) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\Ati2evxx.exe c:\windows\system32\Ati2evxx.exe c:\program files\AVG\AVG8\AVGWDSVC.EXE c:\program files\JAVA\JRE6\BIN\JQS.EXE c:\windows\system32\wdfmgr.exe c:\program files\AVG\AVG8\AVGTRAY.EXE c:\program files\Winamp\winamp.exe c:\program files\AVG\AVG8\avgrsx.exe . ************************************************************************** . Czas ukończenia: 2008-12-12 16:06:38 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-12-12 15:06:36 ComboFix4.txt 2008-11-14 18:46:56 ComboFix3.txt 2008-11-29 18:30:34 ComboFix2.txt 2008-11-30 16:48:48 Przed: 18 697 519 104 bajtów wolnych Po: 18,667,208,704 bajtów wolnych 400 --- E O F --- 2008-12-12 10:37:26

**Posty:** 18165 · przez **wojtas** 12 Gru 2008, 20:51

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.