Problem z internetem (szczegoly w srodku)

**Posty:** 45 · przez **magic666** 21 Mar 2009, 13:35

Moj problem wyglada tak:
mam neostrade z modemem sagem fast 800 i byla sobie ona na kompie troche czasu.
Kiedys zauwazylem ze wyskoczyl jakis error z aplikacji ktora dolaczaja do sterownikow, a mianowicie dslmon wywalil error Out of memory.
Teraz gdy lacze sie z neostrada i dojdzie do resetu po 24 h, neostrada laczy sie (wyskakuje ten dymek) ale internetu ani widu ani slychu bez resetowania komputera internetu nie ma. To samo jest jak rozlacze sie powiedzmy przy 10 h dzialania neostrady, potrzeba reboota zeby internet wrocil.
Nie wyglada mi to na problem ze sterownikami bo te sterowniki reinstallowalem, wiec mysle ze to jakis robak czy cos w tym stylu.

Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:28, on 2009-03-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe F:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\Explorer.EXE f:\Program Files\Alwil Software\Avast4\aswUpdSv.exe f:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe F:\Program Files\cfos\spd.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Gigabyte\ET5\GUI.exe F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe F:\Program Files\cfos\cFosSpeed.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe F:\Program Files\mIRC\mirc.exe f:\Program Files\Mozilla Firefox\firefox.exe I:\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O1 - Hosts: 85.14.219.81 nProtect.lineage2.com O1 - Hosts: 208.109.206.98 L2authd.Lineage2.com O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [avast!] f:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [cFosSpeed] F:\Program Files\cfos\cFosSpeed.exe O4 - HKLM\..\Run: [SmcService] F:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A851B48A-07AA-42BB-AE9D-B1A9892FBE0B}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS2\Services\Tcpip\..\{8305682E-BAA4-45BE-BCA0-5AFED763DA00}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - f:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - f:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Web Scanner - ALWIL Software - f:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing) O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - F:\Program Files\cfos\spd.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - F:\Program Files\Sygate\SPF\smc.exe O23 - Service: WinFtp Server Service (WinFTP Server Service) - Unknown owner - F:\Program Files\WinFTP Server\WFTPSRV.exe (file missing) -- End of file - 6129 bytes

zaraz dodam log z combo fixa

combofix

Kod: Zaznacz wszystko: ComboFix 09-03-19.02 - Wojto 2009-03-21 12:37:16.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.2047.1543 [GMT 1:00] Uruchomiony z: f:\world of warcraft\addonki\ComboFix.exe AV: avast! antivirus 4.8.1335 [VPS 090320-0] *On-access scanning disabled* (Updated) AV: AVG *On-access scanning enabled* (Outdated) FW: Sygate Personal Firewall *enabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2009-02-21 do 2009-03-21 ))))))))))))))))))))))))))))))) . 2009-03-19 11:47 . 2009-03-19 11:49 <DIR> d-------- c:\documents and settings\NetworkService\Dane aplikacji\HPAppData 2009-03-19 11:41 . 2009-03-19 11:41 <DIR> d-------- c:\program files\SAGEM 2009-03-19 11:38 . 2006-02-15 10:15 176,128 --a------ c:\windows\autoclk.exe 2009-03-19 11:29 . 2006-12-22 13:18 212,992 --a------ c:\windows\system32\unaddrv.exe 2009-03-19 11:29 . 2001-02-09 11:43 4,981 --a------ c:\windows\system32\ADADIX2K.DLL 2009-03-15 11:39 . 2009-03-15 11:39 <DIR> dr------- c:\documents and settings\NetworkService\Ulubione 2009-03-15 11:31 . 2004-08-04 00:44 221,184 --a------ c:\windows\system32\wmpns.dll 2009-03-15 11:27 . 2004-10-15 18:32 83,096 --a------ c:\windows\system32\SSSensor.dll 2009-03-15 11:27 . 2004-10-15 18:17 60,496 --a------ c:\windows\system32\drivers\Teefer.sys 2009-03-15 11:27 . 2004-10-15 18:18 21,075 --a------ c:\windows\system32\drivers\wpsdrvnt.sys 2009-03-15 11:27 . 2004-10-15 18:32 14,568 --a------ c:\windows\system32\drivers\wg6n.sys 2009-03-15 11:27 . 2004-10-15 18:32 14,568 --a------ c:\windows\system32\drivers\wg5n.sys 2009-03-15 11:27 . 2004-10-15 18:32 14,568 --a------ c:\windows\system32\drivers\wg4n.sys 2009-03-15 11:27 . 2004-10-15 18:32 14,568 --a------ c:\windows\system32\drivers\wg3n.sys 2009-03-12 21:01 . 2005-01-28 13:44 258,296 --a------ c:\windows\system32\setb0.tmp 2009-03-12 21:01 . 2005-01-28 13:44 224,768 --a------ c:\windows\system32\setb1.tmp 2009-03-12 21:00 . 2009-03-12 21:09 <DIR> d-------- c:\documents and settings\Wojto\Dane aplikacji\Winamp 2009-03-11 14:33 . 2009-03-11 14:33 <DIR> d-------- c:\documents and settings\Wojto\Dane aplikacji\id Software 2009-03-11 14:32 . 2009-03-11 14:32 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\id Software 2009-03-11 14:32 . 2009-03-11 14:32 22,328 --a------ c:\documents and settings\Wojto\Dane aplikacji\PnkBstrK.sys 2009-03-07 12:17 . 2009-03-07 12:17 <DIR> d-------- c:\program files\RealVNC 2009-02-22 23:01 . 2009-02-23 09:36 <DIR> d-------- c:\program files\Common Files\Blizzard Entertainment . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-21 11:16 --------- d-----w c:\documents and settings\Wojto\Dane aplikacji\foobar2000 2009-03-19 10:41 32 ----a-w c:\windows\system32\drivers\adidsl.cfg 2009-03-19 10:41 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-15 10:41 --------- d-----w c:\documents and settings\Wojto\Dane aplikacji\HPAppData 2009-03-15 10:27 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-03-12 14:29 --------- d-----w c:\documents and settings\Wojto\Dane aplikacji\uTorrent 2009-02-19 17:08 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2009-02-19 17:02 --------- d-----w c:\program files\CCleaner 2009-02-08 16:53 --------- d-----w c:\program files\Kerio 2009-02-08 16:53 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-31 06:13 --------- d-----w c:\program files\AVG 2009-01-31 06:13 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\avg8 2009-01-28 00:58 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Blizzard 2009-01-26 04:49 --------- d-----w c:\program files\Budzik 2009-01-26 01:12 --------- d-----w c:\program files\Common Files\INCA Shared 2009-01-21 17:12 --------- d-----w c:\documents and settings\Wojto\Dane aplikacji\GanymedeNet . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EasyTuneV"="c:\program files\Gigabyte\ET5\ETcall.exe" [2006-12-15 31552] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "avast!"="f:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "cFosSpeed"="f:\program files\cfos\cFosSpeed.exe" [2008-07-03 867544] "SmcService"="f:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] "RTHDCPL"="RTHDCPL.EXE" [2008-11-17 c:\windows\RTHDCPL.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] "Nokia.PCSync"="f:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2009-03-19 1205840] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.FFDS"= ffdshow.ax "msacm.ac3filter"= ac3filter.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-12-29 11:40 687560 f:\program files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HEXelon MAX] --a------ 2007-06-28 20:44 2816512 c:\program files\HEXelon MAX 6\hexelon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2008-03-25 21:27 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon] --a------ 2008-03-13 09:34 81920 c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-09-04 23:40 6856704 c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] --a------ 2001-07-09 11:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2008-10-07 13:33 13574144 c:\windows\system32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 12:20 227328 f:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 03:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] --a------ 2008-05-02 05:15 15872 f:\program files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] --a------ 2008-11-17 16:08 17676288 c:\windows\RTHDCPL.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "f:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-31 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-31 20560] S2 ELOADER;General Purpose USB Driver (adildr.sys);c:\windows\system32\drivers\adildr.sys [2009-03-19 56088] S2 WinFTP Server Service;WinFtp Server Service;f:\program files\WinFTP Server\WFTPSRV.exe service --> f:\program files\WinFTP Server\WFTPSRV.exe service [?] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{69758a20-84c4-11dd-8d0a-4d6564696130}] \Shell\AutoRun\command - O:\LaunchU3.exe -a . . ------- Skan uzupełniający ------- . IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 TCP: {A851B48A-07AA-42BB-AE9D-B1A9892FBE0B} = 194.204.159.1 217.98.63.164 DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab FF - ProfilePath - c:\documents and settings\Wojto\Dane aplikacji\Mozilla\Firefox\Profiles\c619aysd.default\ FF - plugin: c:\documents and settings\All Users\Dane aplikacji\id Software\QuakeLive\npquakezero.dll FF - plugin: f:\program files\Mozilla Firefox\plugins\NPBILLARD8.dll FF - plugin: f:\program files\Mozilla Firefox\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-21 12:38:09 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant] "ImagePath"="" . Czas ukończenia: 2009-03-21 12:38:53 ComboFix-quarantined-files.txt 2009-03-21 11:38:51 Przed: 2,844,618,752 bajtów wolnych Po: 2,839,846,912 bajtów wolnych 165

**Posty:** 18165 · przez **wojtas** 21 Mar 2009, 19:16

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.