prosze o pomoc i o sprawdzenie loga

[damon]

Witam.
Mam problem:-/ pojawil mi sie w systemie wirus. Na pasku zadan jest krzyzyk w czerwonym kolku. Gdy najade strzalka jest napisana '''your computer is infected. Jak sie tego pozbyc

[ Dodano: Dzisiaj o 18:56 ]
Logfile of HijackThis v1.99.1
Scan saved at 18:56:15, on 2008-03-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\VM303_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\braviax.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Phone\Skype.exe
E:\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Outlook Express\msimn.exe
E:\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\ntos.exe,
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "E:\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WITaj!] C:\Program Files\WITaj!\Wit2000.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.09\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp07.photoprintit.de/microsite/5770/defaults/activex/IPSUploader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[quote]

[ Dodano: Dzisiaj o 19:19 ]

Kod: Zaznacz wszystko

Logfile of HijackThis v1.99.1
Scan saved at 18:56:15, on 2008-03-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\VM303_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\braviax.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Phone\Skype.exe
E:\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Outlook Express\msimn.exe
E:\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\ntos.exe,
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "E:\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WITaj!] C:\Program Files\WITaj!\Wit2000.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.09\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp07.photoprintit.de/microsite/5770/defaults/activex/IPSUploader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa ( jak będziesz sciągał zapisz go pod nazwa combo-fix.exe) oraz daj loga z hijacka

Jeśli combo nie zadziala daj loga z dss'a

[damon]

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa ( jak będziesz sciągał zapisz go pod nazwa combo-fix.exe) oraz daj loga z hijacka

Tego nie rozumiem hmm mam wrzucic tu na forum??

[ Dodano: Dzisiaj o 22:09 ]
[

Kod: Zaznacz wszystko

code][quote][quote]ComboFix 08-03-14.2 - x 2008-03-14 20:54:31.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.45 [GMT 1:00]
Running from: E:\combo-fix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Dane aplikacji\NetMon
C:\Documents and Settings\LocalService\Dane aplikacji\NetMon\domains.txt
C:\Documents and Settings\LocalService\Dane aplikacji\NetMon\log.txt
C:\Documents and Settings\x\Dane aplikacji\Sskcwrd.dll
C:\Documents and Settings\x\Dane aplikacji\Sskknwrd.dll
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\keyboard91.dat
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\system32\_000046_.tmp.dll
C:\WINDOWS\system32\mcroso~1
C:\WINDOWS\system32\mcroso~1\M?crosoft\
C:\WINDOWS\system32\tpuninstall.exe
C:\WINDOWS\system32\winivstr.exe

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_CMDSERVICE
-------\LEGACY_NTMLSVC


(((((((((((((((((((((((((   Files Created from 2008-02-14 to 2008-03-14  )))))))))))))))))))))))))))))))
.

2008-03-14 20:38 . 2008-03-14 20:38   <DIR>   d--------   C:\ComboFix[1]
2008-03-14 20:33 . 2008-03-14 20:33   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-03-14 20:15 . 2008-03-14 10:32   <DIR>   d--------   C:\SDFix
2008-03-14 20:11 . 2008-03-14 20:24   1,586   --a------   C:\WINDOWS\system32\tmp.reg
2008-03-14 20:09 . 2007-09-05 23:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-03-14 20:09 . 2006-04-27 16:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-03-14 20:09 . 2008-03-14 09:09   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-03-14 20:09 . 2008-03-05 22:29   82,432   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-03-14 20:09 . 2003-06-05 20:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-03-14 20:09 . 2004-07-31 17:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-03-14 20:09 . 2007-10-03 23:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-03-14 18:31 . 2008-03-14 18:31   18,965   --a------   C:\Program Files\Common Files\yxig.exe
2008-03-14 18:31 . 2008-03-14 18:31   17,473   --a------   C:\WINDOWS\ygifatywo.bin
2008-03-14 18:31 . 2008-03-14 18:31   16,896   --a------   C:\WINDOWS\system32\musa.exe
2008-03-14 18:31 . 2008-03-14 18:31   15,346   --a------   C:\Documents and Settings\x\Dane aplikacji\ucytave.bat
2008-03-14 18:31 . 2008-03-14 18:31   14,851   --a------   C:\WINDOWS\ulyxizyj.inf
2008-03-14 18:31 . 2008-03-14 18:31   14,752   --a------   C:\Documents and Settings\x\Dane aplikacji\elicib.reg
2008-03-14 18:31 . 2008-03-14 18:31   13,305   --a------   C:\WINDOWS\yqelyv.ban
2008-03-14 18:31 . 2008-03-14 18:31   11,836   --a------   C:\WINDOWS\fihec.inf
2008-03-14 18:31 . 2008-03-14 18:31   11,593   --a------   C:\DOCUME~1\ALLUSE~1\DANEAP~1\xoga.pif
2008-03-14 18:31 . 2008-03-14 18:31   11,575   --a------   C:\WINDOWS\system32\igemubamod._sy
2008-03-14 18:31 . 2008-03-14 18:31   10,851   --a------   C:\WINDOWS\uqizaduwam._dl
2008-03-14 18:31 . 2008-03-14 18:31   10,469   --a------   C:\Program Files\Common Files\pagotoj.sys
2008-03-14 18:15 . 2008-03-14 18:15   <DIR>   d--hs----   C:\FOUND.036
2008-03-14 17:35 . 2008-03-14 17:33   6,656   ---------   C:\WINDOWS\system32\trz2.tmp
2008-03-14 16:36 . 2008-03-14 16:36   <DIR>   d--hs----   C:\FOUND.035
2008-03-08 18:29 . 2008-03-08 18:29   <DIR>   d--hs----   C:\FOUND.034

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-15 19:06   ---------   d-----w   C:\Program Files\Winamp Remote
2003-08-27 10:49   3,424   ----a-w   C:\WINDOWS\inf\OTHER\cmiainfo.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Skype"="E:\Phone\Skype.exe" [2006-03-02 11:55 19485224]
"WITaj!"="C:\Program Files\WITaj!\Wit2000.exe" [2004-01-02 01:09 901120]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Cmaudio"="cmicnfg.cpl" []
"ashMaiSv"="C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe" [2007-12-04 13:59 247160]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-11-11 13:47 7311360]
"nwiz"="nwiz.exe" [2005-11-11 13:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2005-11-11 13:47 86016 C:\WINDOWS\system32\nvmctray.dll]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" [2005-06-23 11:13 61440]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\Gadu-Gadu\\ggphone\\ggphone.exe"=
"E:\\Program Files skoki narciarskie\\Skoki Narciarskie 2005\\SkiJumping2005.exe"=
"E:\\StubInstaller.exe"=
"E:\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"E:\\Phone\\Skype.exe"=

S1 ewido security suite driver;ewido security suite driver;D:\ewido anti-malware\guard.sys []
S3 autorun;autorun;C:\huadio.tmp []
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2004-02-14 12:09]
S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2005-03-22 10:03]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 20:58:50
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\autorun]
"ImagePath"="\??\C:\huadio.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Completion time: 2008-03-14 21:01:47 - machine was rebooted [x]
ComboFix-quarantined-files.txt  2008-03-14 20:01:42

[b]SDFix: Version 1.157 [/b]

Run by x on 2008-03-14 at 20:44

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\smdat32a.sys  - Deleted
C:\WINDOWS\system32\braviax.exe  - Deleted
C:\WINDOWS\Temp\$_2341233.TMP  - Deleted
C:\WINDOWS\Temp\$_2341234.TMP  - Deleted
C:\WINDOWS\Temp\$b17a2e8.tmp  - Deleted
C:\WINDOWS\Uninst2.htm  - Deleted
C:\WINDOWS\Unist1.htm  - Deleted
C:\WINDOWS\uninstall_nmon.vbs  - Deleted
C:\WINDOWS\system32\ntos.exe  - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll  - Deleted


Could Not Remove C:\WINDOWS\system32\wsnpoem\video.dll



Removing Temp Files

[b]ADS Check [/b]:



                                 [b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 20:48:38
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  BigDog303 = C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)????????????????0?????????@??????????????

scanning hidden files ...

C:\WINDOWS\system32\ntos.exe 303104 bytes
C:\WINDOWS\system32\wsnpoem
C:\WINDOWS\system32\wsnpoem\video.dll 0 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 3


[b]Remaining Services [/b]:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\\Gadu-Gadu\\gg.exe"="E:\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny"
"E:\\Morpheus\\MorphEXE.exe"="E:\\Morpheus\\MorphEXE.exe:*:Enabled:Morpheus"
"E:\\eMule\\emule.exe"="E:\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\Java\\jre1.5.0_01\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_01\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\Program Files\\Real\\RealOne Player\\RealPlay.exe"="C:\\Program Files\\Real\\RealOne Player\\RealPlay.exe:*:Enabled:RealPlayer"
"E:\\Gadu-Gadu\\ggphone\\ggphone.exe"="E:\\Gadu-Gadu\\ggphone\\ggphone.exe:*:Disabled:TODO: <File description>"
"D:\\easyCALL\\easyCALL.exe"="D:\\easyCALL\\easyCALL.exe:*:Disabled:easyCALL"
"D:\\eMule\\eMule.exe"="D:\\eMule\\eMule.exe:*:Enabled:eMule Plus"
"D:\\śmieszne\\tlen.exe"="D:\\śmieszne\\tlen.exe:*:Enabled:tlen"
"D:\\BOKS TV\\nba2005.exe"="D:\\BOKS TV\\nba2005.exe:*:Enabled:NBA LIVE 2005"
"E:\\Program Files skoki narciarskie\\Skoki Narciarskie 2005\\SkiJumping2005.exe"="E:\\Program Files skoki narciarskie\\Skoki Narciarskie 2005\\SkiJumping2005.exe:*:Enabled:SkiJumping2005"
"E:\\zainstalowane NBA\\nba2005.exe"="E:\\zainstalowane NBA\\nba2005.exe:*:Enabled:NBA LIVE 2005"
"C:\\VP-EYE\\avi\\avi.exe"="C:\\VP-EYE\\avi\\avi.exe:*:Enabled:Video Monitor"
"E:\\eDonkey2000\\edonkey2000.exe"="E:\\eDonkey2000\\edonkey2000.exe:*:Enabled:edonkey2000"
"E:\\Kazaa Lite Resurrection\\kazaalite.kpp"="E:\\Kazaa Lite Resurrection\\kazaalite.kpp:*:Enabled:kazaalite"
"E:\\StubInstaller.exe"="E:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"E:\\LimeWire\\LimeWire.exe"="E:\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"E:\\Program Files\\BearShare\\BearShare.exe"="E:\\Program Files\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Program Files\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"="C:\\Program Files\\EA GAMES\\Need for Speed Underground 2\\speed2.exe:*:Enabled:speed2"
"C:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe"="C:\\Program Files\\InterVideo\\DVD8\\WinDVD.exe:*:Enabled:WinDVD"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"E:\\Phone\\Skype.exe"="E:\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[b]Remaining Files [/b]:

C:\WINDOWS\system32\wsnpoem\video.dll  Found

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Tue 18 Apr 2006         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 19 Feb 2008            20 A..H. --- "C:\Documents and Settings\x\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1lic.bak"
Tue 18 Apr 2006         4,348 ...H. --- "C:\Documents and Settings\x\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv1key.bak"
Fri 31 Aug 2007         9,656 A.SH. --- "C:\Documents and Settings\x\Moje dokumenty\Moja muzyka\Kopia zapasowa licencji\drmv2key.bak"

[b]Finished![/b]

Logfile of HijackThis v1.99.1
Scan saved at 22:07:51, on 2008-03-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\VM303_STI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Phone\Skype.exe
E:\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\internet explorer\iexplore.exe
E:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Skype] "E:\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [WITaj!] C:\Program Files\WITaj!\Wit2000.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.09\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.09\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp07.photoprintit.de/microsite/5770/defaults/activex/IPSUploader.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe[/quote][/quote]

[/code]

[wojtas]

skasuj ten wpis w hijacku"

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\ygifatywo.bin
C:\WINDOWS\system32\musa.exe
C:\Documents and Settings\x\Dane aplikacji\ucytave.bat
C:\Documents and Settings\x\Dane aplikacji\ucytave.bat
C:\WINDOWS\ulyxizyj.inf
C:\Documents and Settings\x\Dane aplikacji\elicib.reg
C:\WINDOWS\yqelyv.ban
C:\WINDOWS\fihec.inf
C:\DOCUME~1\ALLUSE~1\DANEAP~1\xoga.pif
C:\WINDOWS\system32\igemubamod._sy
C:\WINDOWS\uqizaduwam._dl
C:\Program Files\Common Files\pagotoj.sys
C:\WINDOWS\system32\trz2.tmp
C:\huadio.tmp
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\wsnpoem\video.dll

Folder::
C:\WINDOWS\system32\wsnpoem
C:\FOUND.036
C:\FOUND.035
C:\FOUND.034

Driver::
autorun

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[damon]

Kod: Zaznacz wszystko

ComboFix 08-03-14.4 - x 2008-03-15 14:32:12.4 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1250.1.1045.18.7 [GMT 1:00]
Running from: E:\ComboFix.exe
Command switches used :: E:\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\DOCUME~1\ALLUSE~1\DANEAP~1\xoga.pif
C:\Documents and Settings\x\Dane aplikacji\elicib.reg
C:\Documents and Settings\x\Dane aplikacji\ucytave.bat
C:\huadio.tmp
C:\Program Files\Common Files\pagotoj.sys
C:\WINDOWS\fihec.inf
C:\WINDOWS\system32\igemubamod._sy
C:\WINDOWS\system32\musa.exe
C:\WINDOWS\system32\ntos.exe
C:\WINDOWS\system32\trz2.tmp
C:\WINDOWS\system32\wsnpoem\video.dll
C:\WINDOWS\ulyxizyj.inf
C:\WINDOWS\uqizaduwam._dl
C:\WINDOWS\ygifatywo.bin
C:\WINDOWS\yqelyv.ban
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\ALLUSE~1\DANEAP~1\xoga.pif
C:\Documents and Settings\x\Dane aplikacji\elicib.reg
C:\Documents and Settings\x\Dane aplikacji\ucytave.bat
C:\FOUND.034
C:\FOUND.034\FILE0000.CHK
C:\FOUND.034\FILE0001.CHK
C:\FOUND.034\FILE0002.CHK
C:\FOUND.035
C:\FOUND.035\FILE0000.CHK
C:\FOUND.036
C:\FOUND.036\FILE0000.CHK
C:\FOUND.036\FILE0001.CHK
C:\FOUND.036\FILE0002.CHK
C:\FOUND.036\FILE0003.CHK
C:\FOUND.036\FILE0004.CHK
C:\FOUND.036\FILE0005.CHK
C:\FOUND.036\FILE0006.CHK
C:\FOUND.036\FILE0007.CHK
C:\Program Files\Common Files\pagotoj.sys
C:\WINDOWS\fihec.inf
C:\WINDOWS\system32\igemubamod._sy
C:\WINDOWS\system32\musa.exe
C:\WINDOWS\system32\trz2.tmp
C:\WINDOWS\ulyxizyj.inf
C:\WINDOWS\uqizaduwam._dl
C:\WINDOWS\ygifatywo.bin
C:\WINDOWS\yqelyv.ban

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_AUTORUN
-------\autorun


(((((((((((((((((((((((((   Files Created from 2008-02-15 to 2008-03-15  )))))))))))))))))))))))))))))))
.

2008-03-15 12:46 . 2008-03-15 12:46   <DIR>   d--------   C:\WINDOWS\LastGood
2008-03-15 12:14 . 2007-07-30 19:19   38,232   --a------   C:\WINDOWS\system32\wucltui.dll.mui
2008-03-15 12:14 . 2007-07-30 19:20   30,040   --a------   C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-15 12:14 . 2007-07-30 19:20   30,040   --a------   C:\WINDOWS\system32\wuapi.dll.mui
2008-03-15 12:14 . 2007-07-30 19:18   21,336   --a------   C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-15 12:05 . 2008-03-15 12:05   <DIR>   d--hs----   C:\FOUND.038
2008-03-15 11:41 . 2008-03-15 11:41   <DIR>   d--hs----   C:\FOUND.037
2008-03-14 20:33 . 2008-03-14 20:33   <DIR>   d--------   C:\WINDOWS\ERUNT
2008-03-14 20:11 . 2008-03-15 11:50   1,586   --a------   C:\WINDOWS\system32\tmp.reg
2008-03-14 20:09 . 2007-09-05 23:22   289,144   --a------   C:\WINDOWS\system32\VCCLSID.exe
2008-03-14 20:09 . 2006-04-27 16:49   288,417   --a------   C:\WINDOWS\system32\SrchSTS.exe
2008-03-14 20:09 . 2008-03-14 09:09   86,528   --a------   C:\WINDOWS\system32\VACFix.exe
2008-03-14 20:09 . 2008-03-05 22:29   82,432   --a------   C:\WINDOWS\system32\IEDFix.exe
2008-03-14 20:09 . 2003-06-05 20:13   53,248   --a------   C:\WINDOWS\system32\Process.exe
2008-03-14 20:09 . 2004-07-31 17:50   51,200   --a------   C:\WINDOWS\system32\dumphive.exe
2008-03-14 20:09 . 2007-10-03 23:36   25,600   --a------   C:\WINDOWS\system32\WS2Fix.exe
2008-03-14 18:31 . 2008-03-14 18:31   18,965   --a------   C:\Program Files\Common Files\yxig.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-15 19:06   ---------   d-----w   C:\Program Files\Winamp Remote
2003-08-27 10:49   3,424   ----a-w   C:\WINDOWS\inf\OTHER\cmiainfo.sys
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"Skype"="E:\Phone\Skype.exe" [2006-03-02 11:55 19485224]
"WITaj!"="C:\Program Files\WITaj!\Wit2000.exe" [2004-01-02 01:09 901120]
"Gadu-Gadu"="E:\Gadu-Gadu\gg.exe" [2007-11-14 11:54 2131392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Cmaudio"="cmicnfg.cpl" []
"ashMaiSv"="C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe" [2007-12-04 13:59 247160]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-11-11 13:47 7311360]
"nwiz"="nwiz.exe" [2005-11-11 13:47 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2005-11-11 13:47 86016 C:\WINDOWS\system32\nvmctray.dll]
"BigDog303"="C:\WINDOWS\VM303_STI.exe" [2005-06-23 11:13 61440]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [ ]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-04 00:44 159744]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:44 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\Gadu-Gadu\\gg.exe"=
"E:\\Gadu-Gadu\\ggphone\\ggphone.exe"=
"E:\\Program Files skoki narciarskie\\Skoki Narciarskie 2005\\SkiJumping2005.exe"=
"E:\\StubInstaller.exe"=
"E:\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"=
"E:\\Phone\\Skype.exe"=

S1 ewido security suite driver;ewido security suite driver;D:\ewido anti-malware\guard.sys []
S3 PhilCam8116;Logitech QuickCam Pro 3000(PID_08B0);C:\WINDOWS\system32\DRIVERS\CamDrL21.sys [2004-02-14 12:09]
S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2005-03-22 10:03]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 14:39:13
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-15 14:40:04 - machine was rebooted
ComboFix2.txt  2008-03-15 13:23:50
ComboFix-quarantined-files.txt  2008-03-15 13:40:02

[ Dodano: Dzisiaj o 15:08 ]
Nie moglem wyjsc z trybu awaryjnego

Wirus jest gdzies win32;tibs-ado[trj]

tak apropo to nie mamnarazie w pasku ten czerwony krzyzyk

[wojtas]

C:\Program Files\Common Files\yxig.exe

skasuj ten plik do kosza

[damon]

juz skasowale apropo moze wiesz;
Mam autlook express i nie moge wejsc na link w mejlu na strone www po najechaniu myszka tzn pojawia sie strona internet explorer ale nic nie ma pusto Moze nie mam ze jest to domyslna przegladarka ale jak to zrobic

[wojtas]

nie wiem nie uzywałem nigdy tego