prosze o sprawdzenie log'a

[marcingo81]

LOG z Win 98
Logfile of HijackThis v1.99.1
Scan saved at 11:45:20, on 06-03-28
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCIOMON.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCPFW.EXE
C:\PROGRAM FILES\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCGUIDE.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCCLIENT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\POP3TRAP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\MOUSEPAD6.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\COMMAND.EXE
C:\PROGRAM FILES\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\WRSSSDK.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.590\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.100.2:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O3 - Toolbar: @msdxmLC.dll,-1@1045,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [keyboard] C:\WINDOWS\KEYBOARD6.exe
O4 - HKLM\..\Run: [newname] C:\WINDOWS\NEWNAME6.exe
O4 - HKLM\..\Run: [mousepad] C:\WINDOWS\MOUSEPAD6.exe
O4 - HKLM\..\Run: [Command] C:\WINDOWS\command.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE" /startintray
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PCCPFW] C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Avast4\ashServ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe"
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

[Red]

prosze o opisanie problemu i objecie loga w tagi

[marcingo81]

Chyba mam problemy ze wstawieniem tagow.. po prostu nie wiem jak.
Az wstyd sie przyznac
Problem polega na spowolnieniu dzialania komputera (a przynajmniej tak mi sie wydaje), wyskakuja co jakis czas uporczywe strony i po jakims czasie myszka przestaje dzialac
Z gory dziekuje za porady

[ Dodano: Dzisiaj o 11:04 ]
Juz sie nauczylem dawac Tagi:-)
Przesle jeszcze raz loga

Logfile of HijackThis v1.99.1
Scan saved at 11:59:40, on 06-03-28
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCIOMON.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCPFW.EXE
C:\PROGRAM FILES\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCGUIDE.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCCLIENT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\POP3TRAP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\MOUSEPAD6.EXE
C:\WINDOWS\COMMAND.EXE
C:\PROGRAM FILES\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\AVAST4\ASHMAISV.EXE
C:\PROGRAM FILES\GADU-GADU\GG.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.171\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.100.2:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O3 - Toolbar: @msdxmLC.dll,-1@1045,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [keyboard] C:\WINDOWS\KEYBOARD6.exe
O4 - HKLM\..\Run: [newname] C:\WINDOWS\NEWNAME6.exe
O4 - HKLM\..\Run: [mousepad] C:\WINDOWS\MOUSEPAD6.exe
O4 - HKLM\..\Run: [Command] C:\WINDOWS\command.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PCCPFW] C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Avast4\ashServ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe"
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

[Red]

prosze w trybie awaryjnym usunac:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O4 - HKLM\..\Run: [keyboard] C:\WINDOWS\KEYBOARD6.exe
O4 - HKLM\..\Run: [newname] C:\WINDOWS\NEWNAME6.exe
O4 - HKLM\..\Run: [mousepad] C:\WINDOWS\MOUSEPAD6.exe
O4 - HKLM\..\Run: [Command] C:\WINDOWS\command.exe
O4 - HKCU\..\Run: [Shell] "C:\WINDOWS\SYSTEM\ibm00001.exe"

to co pogrubiłem usun recznie z dysku ,a wpisy zaznacz w hijacku i nacisnij fix
Daj log do kontroli po usuwaniu

[marcingo81]

Log po usunieciu i skanowaniu
(dalej wyskskuja strony)

Logfile of HijackThis v1.99.1
Scan saved at 12:37:52, on 06-03-28
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCIOMON.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCPFW.EXE
C:\PROGRAM FILES\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCGUIDE.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCCLIENT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\POP3TRAP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.546\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.100.2:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O3 - Toolbar: @msdxmLC.dll,-1@1045,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PCCPFW] C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Avast4\ashServ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

[Red]

jeszcze zostało:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 makethemcry.com
O1 - Hosts: 127.0.0.5 toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com
O1 - Hosts: 127.0.0.5 www.makethemcry.com
O1 - Hosts: 127.0.0.5 www.toolbarpartner.com

prosze usunac i dac log do kontroli

[marcingo81]

Mam nadzieje ze ostatni Log do wgladu:-)

Logfile of HijackThis v1.99.1
Scan saved at 12:57:17, on 06-03-28
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCIOMON.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCPFW.EXE
C:\PROGRAM FILES\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HPZTSB09.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCGUIDE.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\PCCCLIENT.EXE
C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2002\POP3TRAP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE
C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.328\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.100.2:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: @msdxmLC.dll,-1@1045,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb09.exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [PCCIOMON.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCIOMON.exe"
O4 - HKLM\..\RunServices: [PCCPFW] C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Avast4\ashServ.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

[ Dodano: Dzisiaj o 11:51 ]
Hmm ponownie pojawily sie wyskakujace strony

[ Dodano: Dzisiaj o 12:09 ]
Wlasnie przelecialem koputer Spybotem i wykryl "smitfraud-C"
Pliki wykonywalne do niego "drsmartload1.exe" oraz drsmartload46a.exe"
Oba w katalogu glownym C:\

[Red]

Ok,log z hijacka jest czysty i juz nie bedzie na potrzebny

Potrzebuje kolejny log>>>
prosze sciagnac:

http://www.thatcomputerguy.us/downloads/findit9xme.zip

Rozpakuj >>> uruchom *Find.bat* >>> pokaż zawartość *output.txt*
na forum

[marcingo81]

Hmm
Sciagnalem, rozpakowalem ale nie ma "Find.bat"
sa trzy pliki:
FindIt9xME.exe
Locate.exe
Strings.exe

Locate.exe smiga po dysku a reszta nic w zasadzie nie robi

[ Dodano: Dzisiaj o 12:33 ]
!!!! pomylka, jednak pierwszy plik uruchomil cos i smiga teraz dysk!!!

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

------- System Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

ILGUTIL DLL 226 592 06.03.22 11:54 ILGUTIL.DLL
MTSYSTEM DLL 226 592 06.03.22 11:54 MTSYSTEM.DLL
SQSCLASS DLL 226 592 06.03.22 11:54 SQSCLASS.DLL
IHCTL DLL 226 592 06.03.22 11:54 ihctl.dll
ROCHED20 DLL 226 592 06.03.22 11:54 roched20.dll
5 plik(˘w) 1 132 960 bajt˘w
0 katalog(˘w) 36 594,23 MB wolnych

------- System Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

ILGUTIL DLL 226 592 06.03.22 11:54 ILGUTIL.DLL
MTSYSTEM DLL 226 592 06.03.22 11:54 MTSYSTEM.DLL
SQSCLASS DLL 226 592 06.03.22 11:54 SQSCLASS.DLL
IHCTL DLL 226 592 06.03.22 11:54 ihctl.dll
ROCHED20 DLL 226 592 06.03.22 11:54 roched20.dll
5 plik(˘w) 1 132 960 bajt˘w
0 katalog(˘w) 36 568,31 MB wolnych

------- System Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

ILGUTIL DLL 226 592 06.03.22 11:54 ILGUTIL.DLL
MTSYSTEM DLL 226 592 06.03.22 11:54 MTSYSTEM.DLL
SQSCLASS DLL 226 592 06.03.22 11:54 SQSCLASS.DLL
IHCTL DLL 226 592 06.03.22 11:54 ihctl.dll
ROCHED20 DLL 226 592 06.03.22 11:54 roched20.dll
5 plik(˘w) 1 132 960 bajt˘w
0 katalog(˘w) 36 546,94 MB wolnych

------- System Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

ILGUTIL DLL 226 592 06.03.22 11:54 ILGUTIL.DLL
MTSYSTEM DLL 226 592 06.03.22 11:54 MTSYSTEM.DLL
SQSCLASS DLL 226 592 06.03.22 11:54 SQSCLASS.DLL
IHCTL DLL 226 592 06.03.22 11:54 ihctl.dll
ROCHED20 DLL 226 592 06.03.22 11:54 roched20.dll
5 plik(˘w) 1 132 960 bajt˘w
0 katalog(˘w) 36 541,44 MB wolnych

------- System Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

ILGUTIL DLL 226 592 06.03.22 11:54 ILGUTIL.DLL
MTSYSTEM DLL 226 592 06.03.22 11:54 MTSYSTEM.DLL
SQSCLASS DLL 226 592 06.03.22 11:54 SQSCLASS.DLL
IHCTL DLL 226 592 06.03.22 11:54 ihctl.dll
ROCHED20 DLL 226 592 06.03.22 11:54 roched20.dll
5 plik(˘w) 1 132 960 bajt˘w
0 katalog(˘w) 36 421,47 MB wolnych

------- Hidden Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

FOLDER HTT 13 264 04.08.23 14:21 folder.htt
DESKTOP INI 266 04.08.23 14:21 desktop.ini
2 plik(˘w) 13 530 bajt˘w
0 katalog(˘w) 36 594,22 MB wolnych

---------------- User Agent ------------

------- Hidden Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

FOLDER HTT 13 264 04.08.23 14:21 folder.htt
DESKTOP INI 266 04.08.23 14:21 desktop.ini
2 plik(˘w) 13 530 bajt˘w
0 katalog(˘w) 36 568,31 MB wolnych

---------------- User Agent ------------

------- Hidden Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

FOLDER HTT 13 264 04.08.23 14:21 folder.htt
DESKTOP INI 266 04.08.23 14:21 desktop.ini
2 plik(˘w) 13 530 bajt˘w
0 katalog(˘w) 36 546,94 MB wolnych

---------------- User Agent ------------

------- Hidden Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

FOLDER HTT 13 264 04.08.23 14:21 folder.htt
DESKTOP INI 266 04.08.23 14:21 desktop.ini
2 plik(˘w) 13 530 bajt˘w
0 katalog(˘w) 36 541,44 MB wolnych

---------------- User Agent ------------

------- Hidden Files in System Directory -------


Wolumin w stacji dysk˘w C nie ma etykiety
Numer seryjny woluminu: C11F-2EEC
Katalog C:\WINDOWS\SYSTEM

FOLDER HTT 13 264 04.08.23 14:21 folder.htt
DESKTOP INI 266 04.08.23 14:21 desktop.ini
2 plik(˘w) 13 530 bajt˘w
0 katalog(˘w) 36 421,47 MB wolnych

---------------- User Agent ------------

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{80649252-1768-8B11-F7FE-971198F53B67}"=""


------------------ Locate.com Results ------------------

C:\WINDOWS\SYSTEM\
ilgutil.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
mtsystem.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
sqsclass.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
ihctl.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
roched20.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K

5 items found: 5 files, 0 directories.
Total of file sizes: 1 132 960 bytes 1,08 M

------------------ Locate.com Results ------------------

C:\WINDOWS\SYSTEM\
ilgutil.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
mtsystem.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
sqsclass.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
ihctl.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
roched20.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K

5 items found: 5 files, 0 directories.
Total of file sizes: 1 132 960 bytes 1,08 M

------------------ Locate.com Results ------------------

C:\WINDOWS\SYSTEM\
ilgutil.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
mtsystem.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
sqsclass.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
ihctl.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
roched20.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K

5 items found: 5 files, 0 directories.
Total of file sizes: 1 132 960 bytes 1,08 M

------------------ Locate.com Results ------------------

C:\WINDOWS\SYSTEM\
ilgutil.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
mtsystem.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
sqsclass.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
ihctl.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
roched20.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K

5 items found: 5 files, 0 directories.
Total of file sizes: 1 132 960 bytes 1,08 M

------------------ Locate.com Results ------------------

C:\WINDOWS\SYSTEM\
ilgutil.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
mtsystem.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
sqsclass.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
ihctl.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K
roched20.dll Wed 2006-03-22 11:54:04 ..S.R 226 592 221,28 K

5 items found: 5 files, 0 directories.
Total of file sizes: 1 132 960 bytes 1,08 M

------------ Strings.exe Qoologic Results ------------

C:\WINDOWS\hosts: 127.0.0.1 www.qoologic.com

-------------- Strings.exe Aspack Results -------------


----------------- HKLM Run Key ------------------

-------------- Strings.exe Umonitor Results -------------
-------------- Strings.exe Umonitor Results -------------
-------------- Strings.exe Umonitor Results -------------
-------------- Strings.exe Umonitor Results -------------

-------------- Strings.exe Umonitor Results -------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\SYSTEM\\hpztsb09.exe"
"internat.exe"="internat.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"pccguide.exe"=""C:\\Program Files\\Trend Micro\\PC-cillin 2002\\pccguide.exe""
"PCCIOMON.exe"=""C:\\Program Files\\Trend Micro\\PC-cillin 2002\\PCCIOMON.exe""
"PCCClient.exe"=""C:\\Program Files\\Trend Micro\\PC-cillin 2002\\PCCClient.exe""
"Pop3trap.exe"=""C:\\Program Files\\Trend Micro\\PC-cillin 2002\\Pop3trap.exe""
"HP Software Update"=""C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe""
"HP Component Manager"=""C:\\PROGRAM FILES\\HP\\HPCORETECH\\HPCMPMGR.EXE""
"DeviceDiscovery"="C:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpotdd01.exe"
"avast! Web Scanner"="C:\\PROGRA~1\\AVAST4\\ASHWEBSV.EXE"
"ashMaiSv"="C:\\PROGRA~1\\AVAST4\\ashmaisv.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"




[Red]

prosze otworzyc notatnik windowsa i wklej w nim to co ponizej:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\User Agent\Post Platform]
"{80649252-1768-8B11-F7FE-971198F53B67}"=-

nastepnie w notstniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg


Nastepnie otwierasz notatnik raz jeszcze i wklejasz w nim :

CD C:\WINDOWS\SYSTEM
ATTRIB -R -S -H ILGUTIL.DLL
ATTRIB -R -S -H MTSYSTEM.DLL
ATTRIB -R -S -H SQSCLASS.DLL
ATTRIB -R -S -H ihctl.dll
ATTRIB -R -S -H roched20.dll
DEL ILGUTIL.DLL
DEL MTSYSTEM.DLL
DEL SQSCLASS.DLL
DEL ihctl.dll
DEL roched20.dll

w notatniku >> Plik >>Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako FIX.BAT >> plik umieść na C:\

Zresetuj komputer do linii komend DOS i wprowadź komendę C:\FIX.BAT. Reset kompa i uruchom FIX.REG. ten pierwszy ktory tworzyłes w notatniku.

Dajesz nowy log z FindIt do oceny.

[marcingo81]

Poprosze o lika do tego programu poniewaz nie potrafie go znalezc nigdzie w sieci
PS Na razie nic nie wyskakuje.


Na razie nie widze nieporzadanych objawow

[Red]

juz po sprawie jeszcze tylko wykonaj ten fix w notatniku i wszystko:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\User Agent\Post Platform]
"{80649252-1768-8B11-F7FE-971198F53B67}"=-

nastepnie w notstniku>>Plik >> Zapisz jako, zapisz jako typ: wszystkie pliki, nazwa pliku: Fix.reg

kliknij dwa razy i dodaj do rejestru

[marcingo81]

Bardzo dziękuje za pomoc w usuwaniu szkodników
Pozdrawiam serdecznie