Logfile of HijackThis v1.99.1
Scan saved at 17:39:38, on 2006-02-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\Gtwatch.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\windows\winsysban7.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\qouw\qouwm.exe
C:\PROGRA~1\COMMON~1\qouw\qouwa.exe
C:\WINDOWS\QXJ0dXI\command.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\system32\devldr32.exe
C:\Documents and Settings\Brat\Moje dokumenty\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1045
O4 - HKLM\..\Run: [Gtwatch] C:\WINDOWS\Gtwatch.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd7.exe
O4 - HKLM\..\Run: [winsysban] C:\windows\winsysban7.exe
O4 - HKLM\..\Run: [gimmygames] C:\\gimmygames.exe
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [qouw] C:\PROGRA~1\COMMON~1\qouw\qouwm.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {631FF594-EC25-4CFF-B869-402DF294E1D6} (Instalator oprogramowania Onet.pl) - http://slimak.onet.pl/_m/kamerzysta/OnetInstalator012s.ocx
O16 - DPF: {8C875948-9C60-4381-9248-0DF180542D53} - http://installs.spamblockerutility.com/installs/spamblockerutility/programs/spamblockerutility.cab
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} (Java Plug-in 1.4.2_06) -
O20 - Winlogon Notify: RunServicesOnce - C:\WINDOWS\system32\n2r20c9oef.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QXJ0dXI\command.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeStart >>> Uruchom >>> services.msc >>> zatrzymaj i wyłącz Command Service
-
Wyłączyć Przywracanie systemu w XP TU
-
Zastartować do trybu awaryjnego bez internetu(opis w linku wyżej).
-
Zaznaczyć wskazane wpisy w Hijacku i kliknąć Fix checked. Wpisy zostaną usunięte.
-
Skasować z dysku pliki i folder, które podkreśliłem na czerwono
-
Dokończyć skanerami online - Scanery do wyboru
-
Pokazać nowy log
zobacz Usuwanie VX2.BetterInternet i daj log nr 1 z narzędzia L2Mfix
Logfile of HijackThis v1.99.1
Scan saved at 20:41:43, on 2006-02-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\Documents and Settings\Brat\Moje dokumenty\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {631FF594-EC25-4CFF-B869-402DF294E1D6} (Instalator oprogramowania Onet.pl) - http://slimak.onet.pl/_m/kamerzysta/OnetInstalator012s.ocx
O16 - DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} (Java Plug-in 1.4.2_06) -
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\ktr8l79u1.dll
L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
“Asynchronous”=dword:00000000
“Impersonate”=dword:00000000
“DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
“Logoff”=“ChainWlxLogoffEvent”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
“Asynchronous”=dword:00000000
“Impersonate”=dword:00000000
“DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
“Logoff”=“CryptnetWlxLogoffEvent”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
“DLLName”=“cscdll.dll”
“Logon”=“WinlogonLogonEvent”
“Logoff”=“WinlogonLogoffEvent”
“ScreenSaver”=“WinlogonScreenSaverEvent”
“Startup”=“WinlogonStartupEvent”
“Shutdown”=“WinlogonShutdownEvent”
“StartShell”=“WinlogonStartShellEvent”
“Impersonate”=dword:00000000
“Asynchronous”=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
“DLLName”=“wlnotify.dll”
“Logon”=“SCardStartCertProp”
“Logoff”=“SCardStopCertProp”
“Lock”=“SCardSuspendCertProp”
“Unlock”=“SCardResumeCertProp”
“Enabled”=dword:00000001
“Impersonate”=dword:00000001
“Asynchronous”=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
“Asynchronous”=dword:00000000
“DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
“Impersonate”=dword:00000000
“StartShell”=“SchedStartShell”
“Logoff”=“SchedEventLogOff”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
“Logoff”=“WLEventLogoff”
“Impersonate”=dword:00000000
“Asynchronous”=dword:00000001
“DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
“DLLName”=“WlNotify.dll”
“Lock”=“SensLockEvent”
“Logon”=“SensLogonEvent”
“Logoff”=“SensLogoffEvent”
“Safe”=dword:00000001
“MaxWait”=dword:00000258
“StartScreenSaver”=“SensStartScreenSaverEvent”
“StopScreenSaver”=“SensStopScreenSaverEvent”
“Startup”=“SensStartupEvent”
“Shutdown”=“SensShutdownEvent”
“StartShell”=“SensStartShellEvent”
“PostShell”=“SensPostShellEvent”
“Disconnect”=“SensDisconnectEvent”
“Reconnect”=“SensReconnectEvent”
“Unlock”=“SensUnlockEvent”
“Impersonate”=dword:00000001
“Asynchronous”=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
“Asynchronous”=dword:00000000
“DllName”=“C:\WINDOWS\system32\ktr8l79u1.dll”
“Impersonate”=dword:00000000
“Logon”=“WinLogon”
“Logoff”=“WinLogoff”
“Shutdown”=“WinShutdown”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
“Asynchronous”=dword:00000000
“DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
“Impersonate”=dword:00000000
“Logoff”=“TSEventLogoff”
“Logon”=“TSEventLogon”
“PostShell”=“TSEventPostShell”
“Shutdown”=“TSEventShutdown”
“StartShell”=“TSEventStartShell”
“Startup”=“TSEventStartup”
“MaxWait”=dword:00000258
“Reconnect”=“TSEventReconnect”
“Disconnect”=“TSEventDisconnect”
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
“DLLName”=“wlnotify.dll”
“Logon”=“RegisterTicketExpiredNotificationEvent”
“Logoff”=“UnregisterTicketExpiredNotificationEvent”
“Impersonate”=dword:00000001
“Asynchronous”=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
“DLLName”=“wzcdlg.dll”
“Logon”=“WZCEventLogon”
“Logoff”=“WZCEventLogoff”
“Impersonate”=dword:00000000
“Asynchronous”=dword:00000000
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
“{6C7C6A13-E135-4566-205E-DD06A7419BAB}”=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
“{00022613-0000-0000-C000-000000000046}”=“Karta waciwoci pliku multimedialnego”
“{176d6597-26d3-11d1-b350-080036a75b03}”=“ZarzĄdzanie skanerem ICM”
“{1F2E5C40-9550-11CE-99D2-00AA006E086C}”=“Strona zabezpieczeä NTFS”
“{3EA48300-8CF6-101B-84FB-666CCB9BCD32}”=“Strona waciwoci OLE Docfile”
“{40dd6e20-7c17-11ce-a804-00aa003ca9f6}”=“Rozszerzenia powoki dla udost©pniania zasob˘w”
“{41E300E0-78B6-11ce-849B-444553540000}”=“PlusPack CPL Extension”
“{42071712-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL karty graficznej”
“{42071713-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL monitora wywietlania”
“{42071714-76d4-11d1-8b24-00a0c9068ff3}”=“Rozszerzenie CPL kadrowania wywietlania”
“{4E40F770-369C-11d0-8922-00A024AB2DBB}”=“Strona zabezpieczeä usugi DS”
“{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}”=“Strona zgodnoci”
“{56117100-C0CD-101B-81E2-00AA004AE837}”=“Program obsugi danych wycinkowych powoki”
“{59099400-57FF-11CE-BD94-0020AF85B590}”=“Rozszerzenie Disc Copy”
“{59be4990-f85c-11ce-aff7-00aa003ca9f6}”=“Rozszerzenia powoki dla obiekt˘w Microsoft Windows Network”
“{5DB2625A-54DF-11D0-B6C4-0800091AA605}”=“ZarzĄdzanie monitorem ICM”
“{675F097E-4C4D-11D0-B6C1-0800091AA605}”=“ZarzĄdzanie drukarkĄ ICM”
“{764BF0E1-F219-11ce-972D-00AA00A14F56}”=“Rozszerzenia powoki dla kompresji plik˘w”
“{77597368-7b15-11d0-a0c2-080036af3f03}”=“Rozszerzenie powoki drukarek sieci Web”
“{7988B573-EC89-11cf-9C00-00AA00A14F56}”=“Disk Quota UI”
“{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}”=“Menu kontekstowe szyfrowania”
“{85BBD920-42A0-1069-A2E4-08002B30309D}”=“Akt˘wka”
“{88895560-9AA2-1069-930E-00AA0030EBC8}”=“Rozszerzenie ikony HyperTerminalu”
“{BD84B380-8CA2-1069-AB1D-08000948F534}”=“Fonts”
“{DBCE2480-C732-101B-BE72-BA78E9AD5B27}”=“Profil ICC”
“{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}”=“Strona zabezpieczeä drukarek”
“{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}”=“Rozszerzenia powoki dla udost©pniania zasob˘w”
“{f92e8c40-3d33-11d2-b1aa-080036a75b03}”=“Display TroubleShoot CPL Extension”
“{7444C717-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto PKO”
“{7444C719-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto Sign”
“{7007ACC7-3202-11D1-AAD2-00805FC1270E}”=“PoĄczenia sieciowe”
“{992CFFA0-F557-101A-88EC-00DD010CCC48}”=“PoĄczenia sieciowe”
“{E211B736-43FD-11D1-9EFB-0000F8757FCD}”="&Skanery i aparaty fotograficzne"
“{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}”="&Skanery i aparaty fotograficzne"
“{905667aa-acd6-11d2-8080-00805f6596d2}”="&Skanery i aparaty fotograficzne"
“{3F953603-1008-4f6e-A73A-04AAC7A992F1}”="&Skanery i aparaty fotograficzne"
“{83bbcbf3-b28a-4919-a5aa-73027445d672}”="&Skanery i aparaty fotograficzne"
“{F0152790-D56E-4445-850E-4F3117DB740C}”=“Remote Sessions CPL Extension”
“{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension”
“{60254CA5-953B-11CF-8C96-00AA00B8708C}”=“Rozszerzenia powoki dla hosta skrypt˘w systemu Windows”
“{2206CDB2-19C1-11D1-89E0-00C04FD7A829}”=“Microsoft Data Link”
“{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Icon Handler”
“{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}”=“Tasks Folder Shell Extension”
“{D6277990-4C6A-11CF-8D87-00AA0060F5BF}”=“Zaplanowane zadania”
“{0DF44EAA-FF21-4412-828E-260A8728E7F1}”=“Pasek zadaä i menu Start”
“{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}”=“Wyszukaj”
“{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsuga techniczna”
“{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}”=“Pomoc i obsuga techniczna”
“{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}”=“Uruchom…”
“{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}”=“Internet”
“{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}”=“E-mail”
“{D20EA4E1-3957-11d2-A40B-0C5020524152}”=“Czcionki”
“{D20EA4E1-3957-11d2-A40B-0C5020524153}”=“Narz©dzia administracyjne”
“{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}”=“Audio Media Properties Handler”
“{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}”=“Video Media Properties Handler”
“{E4B29F9D-D390-480b-92FD-7DDB47101D71}”=“Wav Properties Handler”
“{87D62D94-71B3-4b9a-9489-5FE6850DC73E}”=“Avi Properties Handler”
“{A6FD9E45-6E44-43f9-8644-08598F5A74D9}”=“Midi Properties Handler”
“{c5a40261-cd64-4ccf-84cb-c394da41d590}”=“Video Thumbnail Extractor”
“{5E6AB780-7743-11CF-A12B-00AA004AE837}”=“Pasek narz©dzi programu Microsoft Internet”
“{22BF0C20-6DA7-11D0-B373-00A0C9034938}”=“Stan pobierania”
“{91EA3F8B-C99B-11d0-9815-00C04FD91972}”=“Folder powoki zwi©kszonej”
“{6413BA2C-B461-11d1-A18A-080036B11A03}”=“Folder powoki zwi©kszonej 2”
“{F61FFEC1-754F-11d0-80CA-00AA005B4383}”=“BandProxy”
“{7BA4C742-9E81-11CF-99D3-00AA004AE837}”=“Pasek przeglĄdarki Microsoft”
“{30D02401-6A81-11d0-8274-00C04FD5AE38}”=“Pasek wyszukiwania”
“{32683183-48a0-441b-a342-7c2a440a9478}”=“Pasek multimedi˘w”
“{169A0691-8DF9-11d1-A1C4-00C04FD75D13}”=“Wyszukiwanie w okienku”
“{07798131-AF23-11d1-9111-00A0C98BA67D}”=“Wyszukiwanie w sieci Web”
“{AF4F6510-F982-11d0-8595-00AA004CD6D8}”=“Narz©dzie opcji drzewa rejestru”
“{01E04581-4EEE-11d0-BFE9-00AA005B4383}”="&Adres"
“{A08C11D2-A228-11d0-825B-00AA005B4383}”=“Pole edycji adresu”
“{00BB2763-6A77-11D0-A535-00C04FD7D062}”=“Autouzupenianie Microsoft”
“{7376D660-C583-11d0-A3A5-00C04FD706EC}”=“Wyodr©bnianie obraz˘w Trident”
“{6756A641-DE71-11d0-831B-00AA005B4383}”=“Lista autouzupeniania MRU”
“{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}”=“Niestandardowa lista autouzupeniania MRU”
“{7e653215-fa25-46bd-a339-34a2790f3cb7}”=“Dost©pny”
“{acf35015-526e-4230-9596-becbe19f0ac9}”=“Pasek podr©czny ledzenia”
“{E0E11A09-5CB8-4B6C-8332-E00720A168F2}”=“Analizator paska adresu”
“{00BB2764-6A77-11D0-A535-00C04FD7D062}”=“Lista autouzupeniania historii Microsoft”
“{03C036F1-A186-11D0-824A-00AA005B4383}”=“Lista autouzupeniania folderu powoki Microsoft”
“{00BB2765-6A77-11D0-A535-00C04FD7D062}”=“Kontener wielu list autouzupeniania Microsoft”
“{ECD4FC4E-521C-11D0-B792-00A0C90312E1}”=“Menu witryny paska powoki”
“{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}”=“Shell DeskBarApp”
“{ECD4FC4C-521C-11D0-B792-00A0C90312E1}”=“Pasek pulpitu powoki”
“{ECD4FC4D-521C-11D0-B792-00A0C90312E1}”=“Shell Rebar BandSite”
“{DD313E04-FEFF-11d1-8ECD-0000F87A470C}”=“Pomoc dla uľytkownika”
“{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}”=“Globalne ustawienia folder˘w”
“{EFA24E61-B078-11d0-89E4-00C04FC9E26E}”=“Favorites Band”
“{0A89A860-D7B1-11CE-8350-444553540000}”=“Shell Automation Inproc Service”
“{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}”=“Shell DocObject Viewer”
“{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}”=“Microsoft Browser Architecture”
“{FBF23B40-E3F0-101B-8488-00AA003E56F8}”=“InternetShortcut”
“{3C374A40-BAE4-11CF-BF7D-00AA006946EE}”=“Microsoft Url History Service”
“{FF393560-C2A7-11CF-BFF4-444553540000}”=“Historia”
“{7BD29E00-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe”
“{7BD29E01-76C1-11CF-9DD0-00A0C9034933}”=“Tymczasowe pliki internetowe”
“{CFBFAE00-17A6-11D0-99CB-00C04FD64497}”=“Microsoft Url Search Hook”
“{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}”=“Ekran powitalny pakietu IE4”
“{67EA19A0-CCEF-11d0-8024-00C04FD75D13}”=“CDF Extension Copy Hook”
“{131A6951-7F78-11D0-A979-00C04FD705A2}”=“ISFBand OC”
“{9461b922-3c5a-11d2-bf8b-00c04fb93661}”=“Search Assistant OC”
“{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}”=“Internet”
“{871C5380-42A0-1069-A2EA-08002B30309D}”=“Internet Name Space”
“{EFA24E64-B078-11d0-89E4-00C04FC9E26E}”=“Pasek eksploratora”
“{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service”
“{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}”=“Sendmail service”
“{88C6C381-2E85-11D0-94DE-444553540000}”=“Folder pami©ci podr©cznej ActiveX”
“{E6FB5E20-DE35-11CF-9C87-00AA005127ED}”=“WebCheck”
“{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}”=“Subscription Mgr”
“{F5175861-2688-11d0-9C5E-00AA00A45957}”=“Folder subskrypcji”
“{08165EA0-E946-11CF-9C87-00AA005127ED}”=“WebCheckWebCrawler”
“{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}”=“WebCheckChannelAgent”
“{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}”=“TrayAgent”
“{7D559C10-9FE9-11d0-93F7-00AA0059CE02}”=“Code Download Agent”
“{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}”=“ConnectionAgent”
“{D8BD2030-6FC9-11D0-864F-00AA006809D9}”=“PostAgent”
“{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}”=“WebCheck SyncMgr Handler”
“{352EC2B7-8B9A-11D1-B8AE-006008059382}”=“Menedľer aplikacji powoki”
“{0B124F8F-91F0-11D1-B8B5-006008059382}”=“Wyliczanie zainstalowanych aplikacji”
“{CFCCC7A0-A282-11D1-9082-006008059382}”=“Publikator aplikacji Darwin”
“{e84fda7c-1d6a-45f6-b725-cb260c236066}”=“Shell Image Verbs”
“{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}”=“Shell Image Data Factory”
“{3F30C968-480A-4C6C-862D-EFC0897BB84B}”=“GDI+program wyodr©bniajĄcy miniatury plik˘w”
“{9DBD2C50-62AD-11d0-B806-00C04FD706EC}”=“Informacje podsumowujĄce obsugi miniatur (DOCFILES)”
“{EAB841A0-9550-11cf-8C16-00805F1408F3}”=“Wyodr©bnianie miniatur HTML”
“{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}”=“Shell Image Property Handler”
“{CC6EEFFB-43F6-46c5-9619-51D571967F7D}”=“Kreator publikacji w sieci Web”
“{add36aa8-751a-4579-a266-d66f5202ccbb}”=“Zamawianie odbitek w sieci Web”
“{6b33163c-76a5-4b6c-bf21-45de9cd503a1}”=“Obiekt powoki kreatora publikacji”
“{58f1f272-9240-4f51-b6d4-fd63d1618591}”=“Kreator uzyskiwania profilu usugi Passport”
“{7A9D77BD-5403-11d2-8785-2E0420524153}”=“Konta uľytkownik˘w”
“{BD472F60-27FA-11cf-B8B4-444553540000}”=“Compressed (zipped) Folder Right Drag Handler”
“{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}”=“Compressed (zipped) Folder SendTo Target”
“{f39a0dc0-9cc8-11d0-a599-00c04fd64433}”=“Plik kanau”
“{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}”=“Skr˘t kanau”
“{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}”=“Obiekt obsugi kanau”
“{f3da0dc0-9cc8-11d0-a599-00c04fd64437}”=“Channel Menu”
“{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}”=“Channel Properties”
“{63da6ec0-2e98-11cf-8d82-444553540000}”=“FTP Folders Webview”
“{883373C3-BF89-11D1-BE35-080036B11A03}”=“Microsoft DocProp Shell Ext”
“{A9CF0EAE-901A-4739-A481-E35B73E47F6D}”=“Microsoft DocProp Inplace Edit Box Control”
“{8EE97210-FD1F-4B19-91DA-67914005F020}”=“Microsoft DocProp Inplace ML Edit Box Control”
“{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}”=“Microsoft DocProp Inplace Droplist Combo Control”
“{6A205B57-2567-4A2C-B881-F787FAB579A3}”=“Microsoft DocProp Inplace Calendar Control”
“{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}”=“Microsoft DocProp Inplace Time Control”
“{8A23E65E-31C2-11d0-891C-00A024AB2DBB}”=“Directory Query UI”
“{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}”=“Shell properties for a DS object”
“{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}”=“Directory Object Find”
“{F020E586-5264-11d1-A532-0000F8757D7E}”=“Directory Start/Search Find”
“{0D45D530-764B-11d0-A1CA-00AA00C16E65}”=“Directory Property UI”
“{62AE1F9A-126A-11D0-A14B-0800361B1103}”=“Directory Context Menu Verbs”
“{ECF03A33-103D-11d2-854D-006008059367}”=“MyDocs Copy Hook”
“{ECF03A32-103D-11d2-854D-006008059367}”=“MyDocs Drop Target”
“{4a7ded0a-ad25-11d0-98a8-0800361b1103}”=“MyDocs Properties”
“{750fdf0e-2a26-11d1-a3ea-080036587f03}”=“Offline Files Menu”
“{10CFC467-4392-11d2-8DB4-00C04FA31A66}”=“Offline Files Folder Options”
“{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}”=“Folder plik˘w trybu offline”
“{143A62C8-C33B-11D1-84FE-00C04FA34A14}”=“Microsoft Agent Character Property Sheet Handler”
“{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}”=“DfsShell”
“{60fd46de-f830-4894-a628-6fa81bc0190d}”="%DESC_PublishDropTarget%"
“{7A80E4A8-8005-11D2-BCF8-00C04F72C717}”=“MMC Icon Handler”
“{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}”=".CAB file viewer"
“{32714800-2E5F-11d0-8B85-00AA0044F941}”="&Do os˘b…"
“{8DD448E6-C188-4aed-AF92-44956194EB1F}”=“Windows Media Player Play as Playlist Context Menu Handler”
“{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}”=“Windows Media Player Burn Audio CD Context Menu Handler”
“{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}”=“Windows Media Player Add to Playlist Context Menu Handler”
“{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}”=“Set Program Access and Defaults”
“{596AB062-B4D2-4215-9F74-E9109B0A8153}”=“Previous Versions Property Page”
“{9DB7A13C-F208-4981-8353-73CC61AE2783}”=“Previous Versions”
“{692F0339-CBAA-47e6-B5B5-3B84DB604E87}”=“Extensions Manager Folder”
“{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension”
“{BDEADF00-C265-11D0-BCED-00A0C90AB50F}”=“Foldery w sieci Web”
“{00020D75-0000-0000-C000-000000000046}”=“Microsoft Office Outlook Desktop Icon Handler”
“{0006F045-0000-0000-C000-000000000046}”=“Microsoft Office Outlook Custom Icon Handler”
“{42042206-2D85-11D3-8CFF-005004838597}”=“Microsoft Office HTML Icon Handler”
“{E0B67F84-054E-47A7-8979-09D712838642}”=""
“{21569614-B795-46b1-85F4-E737A8DC09AD}”=“Shell Search Band”
“{A70C977A-BF00-412C-90B7-034C51DA2439}”=“NvCpl DesktopContext Class”
“{1CDB2949-8F65-4355-8456-263E7C208A5D}”=“Desktop Explorer”
“{1E9B04FB-F9E5-4718-997B-B8DA88302A47}”=“Desktop Explorer Menu”
“{1E9B04FB-F9E5-4718-997B-B8DA88302A48}”=“nView Desktop Context Menu”
“{FFB699E0-306A-11d3-8BD1-00104B6F7516}”=“Play on my TV helper”
“{B51E7ED5-2B30-41E7-B7FD-5F0D2CD29007}”=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID{B51E7ED5-2B30-41E7-B7FD-5F0D2CD29007}]
@=""
“IDEx”=“ADDR”
[HKEY_CLASSES_ROOT\CLSID{B51E7ED5-2B30-41E7-B7FD-5F0D2CD29007}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID{B51E7ED5-2B30-41E7-B7FD-5F0D2CD29007}\Implemented Categories{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID{B51E7ED5-2B30-41E7-B7FD-5F0D2CD29007}\InprocServer32]
@=“C:\WINDOWS\system32\cdwmdm.dll”
“ThreadingModel”=“Apartment”
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
atmtd.dll Fri 2006-02-10 17:09:24 A… 687 592 671,48 K
browseui.dll Thu 2005-11-24 1:39:20 A… 1 022 464 998,50 K
cdwmdm.dll Sun 2006-02-12 20:16:28 …S.R 234 196 228,71 K
gdi32.dll Thu 2005-12-29 3:56:06 A… 280 064 273,50 K
lqrmonui.dll Sun 2006-02-12 20:12:02 …S.R 235 685 230,16 K
mcports.dll Sun 2006-02-12 19:32:12 …S.R 235 685 230,16 K
mshtml.dll Thu 2005-11-24 1:39:22 A… 3 013 632 2,87 M
shdocvw.dll Thu 2005-12-01 4:34:28 A… 1 492 480 1,42 M
8 items found: 8 files (3 H/S), 0 directories.
Total of file sizes: 7 201 798 bytes 6,87 M
Locate .tmp files:
No matches found.
**********************************************************************************
Directory Listing of system files:
Wolumin w stacji C nie ma etykiety.
Numer seryjny woluminu: 14DE-A059
Katalog: C:\WINDOWS\System32
2006-02-12 20:16 234˙196 cdwmdm.dll
2006-02-12 20:16 234˙315 lvjm0911e.dll
2006-02-12 20:12 235˙685 lqrmonui.dll
2006-02-12 20:11 234˙196 ktr8l79u1.dll
2006-02-12 20:03 234˙269 hp4023hmg.dll
2006-02-12 19:48 236˙694 mv00l9dm1.dll
2006-02-12 19:32 235˙685 mcports.dll
2006-02-11 12:09 236˙998 jtrm0791e.dll
2006-02-10 17:08 235˙371 jt0807due.dll
2006-02-05 21:11
2005-12-18 21:28 11˙270 KGyGaAvL.sys
2005-03-10 01:24
1999-09-30 19:21 166˙672 mstext35.dll
1999-09-28 21:42 1˙050˙896 msjet35.dll
1999-09-09 22:06 252˙688 msexcl35.dll
1999-09-09 22:06 168˙720 msltus35.dll
1999-08-25 14:57 415˙504 msrepl35.dll
1999-06-10 09:34 123˙664 msjint35.dll
1999-06-10 09:34 24˙848 msjter35.dll
1999-06-07 18:59 250˙128 mspdox35.dll
1999-04-25 17:00 287˙504 Msxbse35.dll
1999-04-25 17:00 368˙912 Vbar332.dll
1999-04-25 17:00 252˙176 Msrd2x35.dll
21 plik(˘w) 5˙490˙391 bajt˘w
2 katalog(˘w) 1˙695˙989˙760 bajt˘w wolnych
Njapierw VX2
Zrób tak, zapuść z tego narzędzia L2Mfix opcję 2. Run Fix = opcja automatycznego usuwania VX2, jej wybranie spowoduje uruchomienie procedury czyszczącej oraz prośbę kompa o reset. W trakcie resetu zastartuje plik second.bat, który zabije rundll32.exe + explorer.exe (zniknie wam Pulpit) i dokończy procedurę czyszczącą.
To może trwać DO PIĘCIU MINUT! Na koniec dostaniecie loga co znaleziono i co usunięto ale tego loga nie dawaj, tylko daj nowy log nr 1 z L2Mfix , czekam
Zrobiłem to co mówiłeś a to log
L2MFIX find log 010406No lipa ręcznie się pomeczysz i mPAMIĘTAJ BEZ NETU USUWASZ! 
Otwórz Notatnik i wklej w nim to:
Plik Zapisz jako Zmień rozszerzenie z TXT na Wszystkie pliki Zapisz pod nazwą FIX.REG
Start do z Konsoli Odzyskiwania CD XP i komendy:
CD C:\WINDOWS\system32
ATTRIB -R-S-H mhutil.dll
ATTRIB -R-S-H enpsl1771.dll
ATTRIB -R-S-H s8pu0i79e8.dll
ATTRIB -R-S-H g004ladq1d0e.dll
ATTRIB -R-S-H o6480ghue6480.dll
ATTRIB -R-S-H cdwmdm.dll
ATTRIB -R-S-H lvjm0911e.dll
ATTRIB -R-S-H lqrmonui.dll
ATTRIB -R-S-H hp4023hmg.dll
ATTRIB -R-S-H mv00l9dm1.dll
ATTRIB -R-S-H mcports.dll
ATTRIB -R-S-H jtrm0791e.dll
ATTRIB -R-S-H jt0807due.dll
ATTRIB -R-S-H atmtd.dll
DEL mhutil.dll
DEL enpsl1771.dll
DEL s8pu0i79e8.dll
DEL g004ladq1d0e.dll
DEL o6480ghue6480.dll
DEL cdwmdm.dll
DEL lvjm0911e.dll
DEL lqrmonui.dll
DEL hp4023hmg.dll
DEL mv00l9dm1.dll
DEL mcports.dll
DEL jtrm0791e.dll
DEL jt0807due.dll
DEL atmtd.dll
EXIT
Przejście do trybu awaryjnego Windows i uruchomienie pliku FIX.REG. Dajesz mi nowego loga L2MFix robionego z opcji 1.
EDIT: mam nowy program -ale dam nizej
Kto powiedział ze VX2 to łatwa rzecz ale na pewno teraz lepiej polecisz - jest mniej i słąbszy.
Otwórz Notatnik i wklej w nim to:
Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG
Start do z Konsoli Odzyskiwania CD XP i komendy:
DEL gimmygames.exe
*CD C:\WINDOWS*
DEL winsysupd8.exe
DEL winsysban8.exe
CD C:\WINDOWS\system32
ATTRIB -R-S-H guard.tmp
ATTRIB -R-S-H atmtd.dll
ATTRIB -R-S-H dn8601lse.dll
ATTRIB -R-S-H i4420ehoeh4c0.dll
ATTRIB -R-S-H enrql1951.dll
ATTRIB -R-S-H n2l8lc3u1f.dll
DEL guard.tmp
DEL atmtd.dll
DEL dn8601lse.dll
DEL i4420ehoeh4c0.dll
DEL enrql1951.dll
DEL n2l8lc3u1f.dll
EXIT
Przejście do trybu awaryjnego Windows i uruchomienie pliku FIX.REG. Dajesz mi nowego loga L2MFix robionego z opcji 1.
I jak po tym uruchomisz fix-a to hijackiem usuń:
folder ręcznie w tym awaryjnym trybie
USUŃ na razie z Hijacka wpisy i pliki ręcznie oraz folder
Jak pisałem wcześniej nie mam możliwości zasosowania konsoli odzyskiwania.Czy nie ma innego sposobu?
Jeżeli miałeś gołego XP i SP2 zainstalowałeś to odinstaluj i z dyskietek skasujesz syfa!
format jedynie 
jak masz tylko XP gołego albo SP1 to - http://www.searchengines.pl/phpbb203/in … opic=19204 i stwórz: Tworzenie bootowalnych CD
EDIT:
Spróbuj jeszcze - Look2Me-Destroyer.exe
i po tym daj log nr 1 z narzędzia L2Mfix
nie o to chodzi mam xp z sp2 ale problem polega na tym ze nie ma teraz sp2 i jak wkładmam xp mam komunikat że mam stara wersje xp.Nie mam niestety sp2(na płytce) żeby zrobic konsoli odzyskiwania 
A co do Look2Me-Destroyer.exe nie moge tego odpaliś jak klikam uruchom mam taki komunikat
"COMPONENT ‘mswinsck.ocx’ or one of its dependencies not correctly
registered:a file is missing or invalid"
zrobiłem scan ewido
Zrób to co mówię VX2 jak siedzia l tak siedzi bootowalną CD zrób i konsola - albo foramt tylko to pomoże
ok robie botowalną cd :o moze mi sie uda.
mam pytanie na płycie xp mam pliki win51 i win51ip te wystarcza do botowania czy trzeba miec tak jak jest w opisie win51ip.sp2 lub win51ip.sp1
olej format ,nie jest potrzebny ,ale potrzebny jest mi widok z tego co znalazł ewido ,wklej to co znajdzie po przeskanowaniu .
Masz przecież napisane potrzebny też xpboot.bin
nie no to wiem że xpboot.bin jest potrzebny .Pytałem sie tylko o tamte pliki.mam nero 6 da tym zrobić botowanie?
A z Ewido zaraz wkleje
No jest tak ściagasz SP2 oraz xpboot.bin!
Tworzysz 2 foldery: CD_XP, XPSP2 do pierwszego cąła płytę kopiujesz do 2 SP2 i Start >>> Uruchom >>> C:\WindowsXP-KB835935-SP2-PLK.exe /integrate:c:\cd_xp - mam nadzieję że nie wyskoczy błąd
I jak się zgra całość to powinny być w tym folderze-
CD_XP nowe pliki win51ic.sp1, win51ip.sp1 lub win51ip.sp2. teraz jasne?
Potem wypalenie 
scan z ewido
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 18:31:46, 2006-02-16
+ Report-Checksum: 5C76B2EF
+ Scan result:
[1308] C:\WINDOWS\system32\wP2time.dll -> Adware.Look2Me : Error during cleaning
C:\WINDOWS\system32\g004ladq1d0e.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ktjql7151.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\naxpnt.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ __delete_on_reboot__ wP2time.dll -> Adware.Look2Me : Cleaned with backup
C:\WINDOWS\Temp\Cookies\brat@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\WINDOWS\Temp\Cookies\brat@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned with backup
C:\WINDOWS\Temp\Cookies\brat@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup
::Report End