Automatyczny start Moje Dokumenty -Prośba o sprawdzenie loga

kolpi · 7 Kwiecień 2008 14:09

Witam,

Mam problem z automatycznym otwieraniem się Moich Dokumentów przy starcie systemu.

Mógłby ktoś zerknąć na loga i przeanalizować? Z góry dziękuję.

Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-04-06 18:51:36 Platform: Windows XP Dodatek Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe D:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe D:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe D:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\WINDOWS\system32\fmctrl.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\1\Pulpit\dss.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe Reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM…\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [systemTray] SysTray.Exe O4 - HKLM…\Run: [FmctrlTray] Fmctrl.EXE O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘LOCAL SERVICE’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘NETWORK SERVICE’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: *.nowa.ehurtownia.pl (HKCU) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/sho … wflash.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\system32\ImapiRox.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe – End of file - 4278 bytes – File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL “%1”,%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser “%1”,%* .scr - AutoCADScriptFile - shell\open\command - “C:\WINDOWS\notepad.exe” “%1” – Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 AFS2K - c:\windows\system32\drivers\afs2k.sys R2 CdaC15BA - c:\windows\system32\drivers\cdac15ba.sys R3 gameport (FM801 PCI Joystick) - c:\windows\system32\drivers\fmjoy.sys R3 wdm_fm801 (FM801 PCI Audio (WDM)) - c:\windows\system32\drivers\fm801.sys – Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 C-DillaCdaC11BA - c:\windows\system32\drivers\cdac11ba.exe – Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E96B-E325-11CE-BFC1-08002BE10318} Description: Standardowa klawiatura 101/102 klawisze lub Microsoft Natural Keyboard PS/2 Device ID: ACPI\PNP0303\4&15F50029&0 Manufacturer: (Klawiatury standardowe) Name: Standardowa klawiatura 101/102 klawisze lub Microsoft Natural Keyboard PS/2 PNP Device ID: ACPI\PNP0303\4&15F50029&0 Service: i8042prt – Files created between 2008-03-06 and 2008-04-06 ----------------------------- 2008-03-26 17:08:00 45 —h----- C:\WINDOWS\dsez5108.dat – Find3M Report --------------------------------------------------------------- 2008-04-06 16:07:50 1632 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-02-29 11:33:12 50416 --a------ C:\Documents and Settings\1\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-02-21 17:06:58 0 d-------- C:\Program Files\Autodesk 2008-02-21 17:06:54 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-02-21 17:05:24 0 d-------- C:\Program Files\AnswerWorks 4.0 2008-02-21 17:03:16 0 d-------- C:\Program Files\Common Files\Autodesk Shared 2008-02-21 17:03:16 0 d-------- C:\Documents and Settings\1\Dane aplikacji\Autodesk 2008-02-07 17:51:16 0 d-------- C:\Documents and Settings\1\Dane aplikacji\Anix Software 2008-02-07 17:50:54 0 d-------- C:\Program Files\MySlideShow Plug-ins 2008-02-07 17:50:54 0 d-------- C:\Program Files\Common Files\Anix Shared 2008-02-07 17:32:24 0 d-------- C:\Documents and Settings\1\Dane aplikacji\Digital Photo Slide Show – Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-03-29 19:37] “SystemTray”=“SysTray.Exe” [2001-10-30 12:00 C:\WINDOWS\system32\systray.exe] “FmctrlTray”=“Fmctrl.EXE” [2001-08-20 21:47 C:\WINDOWS\system32\fmctrl.exe] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2004-07-15 11:42] “nwiz”=“nwiz.exe” [2004-07-15 11:42 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2004-07-15 11:42] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] “Userinit”=“C:\WINDOWS\system32\userinit.exe,userinit.exe” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @=“Service” [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @=“Volume shadow copy” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^1^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] path=C:\Documents and Settings\1\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.1.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] D:\Program Files\HP Scanjet 2300c\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{6bfbf8a0-a40a-11dc-b8bf-00304f50dd19}] Auto\command- E:\UFO.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{ac65f870-cf15-11db-b47e-0002441b5b11}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{c79e6fe0-e633-11d9-bb7a-0002441b5b11}] Auto\command- AdobeR.exe e AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{d45d7a40-d4da-11dc-b9b7-00304f50dd19}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

Leon1 · 7 Kwiecień 2008 14:47

Wyłącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

Wylecz pendriva lub kartę pamięci http://www.softpedia.com/get/Security/Security-Related/PRT-Perlovga-Removal-Tool.shtml lub format

wpis

usuń HijackThisem >> Fix checked

Pobierz Combofix http://forum.dobreprogramy.pl/viewtopic.php?f=16&t=36654 przeskanuj system daj log

kolpi · 7 Kwiecień 2008 15:10

Dzięki serdeczne, wykonałem powyższe instrukcje i wklejam kolejnego loga tak jak prosiłeś:

ComboFix 08-04-06.1 - 1 2008-04-07 17:04:34.1 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.118 [GMT 2:00] Running from: C:\Documents and Settings\1\Pulpit\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED . ((((((((((((((((((((((((( Files Created from 2008-03-07 to 2008-04-07 ))))))))))))))))))))))))))))))) . 2008-04-06 18:48 . 2008-04-06 18:48 2008-04-06 17:41 . 2008-04-06 17:41 272 --a------ C:\WINDOWS\hpqcopy.INI 2008-04-03 08:12 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys 2008-04-03 08:12 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys 2008-03-26 17:08 . 2008-03-26 17:08 45 —h----- C:\WINDOWS\dsez5108.dat 2008-03-24 11:08 . 2006-10-22 15:06 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-29 17:45 1,146,232 ----a-w C:\WINDOWS\system32\aswBoot.exe 2008-03-29 17:35 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2008-03-29 17:29 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2008-03-29 17:27 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2008-03-29 17:26 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2008-03-29 17:23 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr 2008-02-29 09:33 50,416 ----a-w C:\Documents and Settings\1\Dane aplikacji\GDIPFONTCACHEV1.DAT 2008-02-21 15:06 54,784 ----a-w C:\WINDOWS\system32\drivers\CDAC11BA.EXE 2008-02-21 15:06 12,464 ----a-w C:\WINDOWS\system32\drivers\CDAC15BA.SYS 2008-02-21 15:06 --------- d-----w C:\Program Files\Common Files\Macrovision Shared 2008-02-21 15:06 --------- d-----w C:\Program Files\Autodesk 2008-02-21 15:05 --------- d-----w C:\Program Files\AnswerWorks 4.0 2008-02-21 15:03 --------- d-----w C:\Program Files\Common Files\Autodesk Shared 2008-02-21 15:03 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Autodesk 2008-02-21 15:03 --------- d-----w C:\Documents and Settings\1\Dane aplikacji\Autodesk 2008-02-07 15:51 --------- d-----w C:\Documents and Settings\1\Dane aplikacji\Anix Software 2008-02-07 15:50 --------- d-----w C:\Program Files\MySlideShow Plug-ins 2008-02-07 15:50 --------- d-----w C:\Program Files\Common Files\Anix Shared 2008-02-07 15:32 --------- d-----w C:\Documents and Settings\1\Dane aplikacji\Digital Photo Slide Show 2008-02-02 20:10 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\ezsid.dat 2007-12-15 19:39 1,024 ----a-w C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\pdfxls2.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “avast!”=“D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2008-03-29 19:37 79224] “SystemTray”=“SysTray.Exe” [2001-10-30 12:00 3072 C:\WINDOWS\system32\systray.exe] “FmctrlTray”=“Fmctrl.EXE” [2001-08-20 21:47 270336 C:\WINDOWS\system32\fmctrl.exe] “NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2004-07-15 11:42 4112384] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 00:44 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] “msacm.l3acm”= l3codecx.acm [HKLM~\startupfolder\C:^Documents and Settings^1^Menu Start^Programy^Autostart^OpenOffice.ux.pl 2.1.0.lnk] path=C:\Documents and Settings\1\Menu Start\Programy\Autostart\OpenOffice.ux.pl 2.1.0.lnk backup=C:\WINDOWS\pss\OpenOffice.ux.pl 2.1.0.lnkStartup [HKLM~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 17:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2004-07-15 11:42 4112384 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2004-07-15 11:42 81920 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2004-07-15 11:42 843776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OrderReminder] -ra------ 2006-07-30 18:00 98304 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] --a------ 2002-04-11 04:19 69632 D:\Program Files\HP Scanjet 2300c\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] “%windir%\system32\sessmgr.exe”= “D:\Program Files\Gadu Gadu\Gadu-Gadu\gg.exe”= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 19:31] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 19:35] R3 gameport;FM801 PCI Joystick;C:\WINDOWS\system32\DRIVERS\fmjoy.sys [2001-11-02 10:49] R3 wdm_fm801;FM801 PCI Audio (WDM);C:\WINDOWS\system32\drivers\fm801.sys [2001-11-02 14:33] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{6bfbf8a0-a40a-11dc-b8bf-00304f50dd19}] \Shell\Auto\command - E:\UFO.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-07 17:06:45 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-07 17:07:41 ComboFix-quarantined-files.txt 2008-04-07 15:07:34 Pre-Run: 1,171,546,112 bajtów wolnych Post-Run: 1,163,857,920 bajtów wolnych

Leon1 · 7 Kwiecień 2008 15:43

Otwórz notatnik i wklej

zapisz jako plik.reg >> wszystkie pliki >> scal z rejestrem >> restart

powstanie plik o takiej ikonie

w który dwa razy klikniesz potwierdzisz chęć dodania do rejestru potem restart

przeskanuj tym http://www.kaspersky.pl/virusscanner.html

jeśli coś znajdzie pokaż raport

jeśli czysty usuń ręcznie folder C: \Qoobox

usuń instalkę Combofix z dysku.

włącz przywracanie systemu

Agaton · 7 Kwiecień 2008 16:48

kolpi ,

Ważny komunikat dotyczący tytułowania tematów

Proszę poprawić tytuł tematu na konkretny, mówiący o problemie.

W celu dokonania zaleconej korekty - proszę użyć przycisku przy poście otwierającym ten temat.

Zignorowanie zalecenia będzie skutkowało usunięciem tematu do Kosza.

W związku ze zmianą, jaka obowiązuje przy wklejaniu logów w tym dziale, przeczytaj i zastosuj się do Tematu

kolpi · 7 Kwiecień 2008 19:20

Postąpiłem wg instrukcji. Kaspersky wykrył:

Leon1 · 7 Kwiecień 2008 19:26

Należało by to usunąć

kolpi · 7 Kwiecień 2008 20:16

Tak też zrobiłem, chociaż jednego z tych plików nawet jako ukryty nie pokazało.

Dziękuję serdecznie za pomoc.