Log do sprawdzenia

[Yellen (Dny15)]

Nie da się w ogóle wejśc w żadną strone tylko cały czas albo włącza się inna (jakaś reklama) albo pisze “gotowe”, a strona jest cała czysta :-x

Oto log z HiJacka:

Logfile of HijackThis v1.99.1 Scan saved at 18:23:01, on 2006-02-25 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\explorer.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\WINDOWS\System32\atiptaxx.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe C:\Program Files\Common Files\CMEII\CMESys.exe C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE C:\WINDOWS\System32\paytime.exe C:\windows\winsysban11.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe C:\Program Files\SpySheriff\SpySheriff.exe C:\Program Files\Common Files\GMT\GMT.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\DLAWSZ~1\USTAWI~1\Temp\Rar$EX07.016\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL F2 - REG:system.ini: Shell=explorer.exe “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe” O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [OfficeGuard RegChecker] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe” O4 - HKLM…\Run: [AVPCC] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe” /wait O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [CMESys] “C:\Program Files\Common Files\CMEII\CMESys.exe” O4 - HKLM…\Run: [bO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1 O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKLM…\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1 O4 - HKLM…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKLM…\Run: [winsysupd] C:\windows\winsysupd11.exe O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inet20005\winlogon.exe O4 - HKLM…\Run: [Microsoft Windows System] 5A4.tmp O4 - HKLM…\Run: [gimmygames] C:\windows\gimmygames11.exe O4 - HKLM…\Run: [winsysban] C:\windows\winsysban11.exe O4 - HKLM…\RunServices: [Microsoft Windows System] 5A4.tmp O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AQQ] C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm799YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu … 0.0.15.cab O17 - HKLM\System\CCS\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O20 - AppInit_DLLs: C:\WINDOWS\System32\svch2y.dll O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\p2r4lc9q1f.dll O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing)

A usunołem już foldery i wpisy:

O4 - HKCU…\Run: [shell] “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe” O4 - HKCU…\Run: [xp_system] C:\WINDOWS\inet20005\winlogon.exe F3 - REG:win.ini: run=C:\WINDOWS\inet20005\winlogon.exe

[InfinityToJa (Gblade)]

W trybie awaryjnym z wyłączonym przywracaniem systemu usń te wpisy, pogrubione pliki/foldery usuń ręcznie:

Odinstaluj MyWebSearch i spysheriff w dodaj/usuń R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL F2 - REG:system.ini: Shell=explorer.exe “C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe” O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll O4 - HKLM…\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe O4 - HKLM…\Run: [bO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1 O4 - HKLM…\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1 O4 - HKLM…\Run: [PayTime] C:\WINDOWS\System32\paytime.exe O4 - HKLM…\Run: [winsysupd] C:\windows\winsysupd11.exe O4 - HKLM…\Run: [xp_system] C:\WINDOWS\inet20005\winlogon.exe O4 - HKLM…\Run: [Microsoft Windows System] 5A4.tmp O4 - HKLM…\Run: [gimmygames] C:\windows\gimmygames11.exe O4 - HKLM…\Run: [winsysban] C:\windows\winsysban11.exe O4 - HKLM…\RunServices: [Microsoft Windows System] 5A4.tmp O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi … xdm799YYPL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fu … 0.0.15.cab O20 - AppInit_DLLs: C:\WINDOWS\System32\svch2y.dll O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll

O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\p2r4lc9q1f.dll Masz VX2, daj loga z l2mfix: Ściągnij l2mfix http://www.atribune.org/downloads/l2mfix.exe , odpal, zrób loga z opcji nr. 1 , wklej go tu.

Przeskanuj ewido http://www.ewido.net/en/ , usuń wszystko co znajdzie.

Dajesz nowy log HijackThis + l2mfix z opcji nr. 1

[Gutek]

O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll

jeszcze na kompie powinien być plik doser.exe

O4 - HKCU…\Run: [Windows installer] C:\winstall.exe O4 - HKCU…\Run: [spySheriff] C:\Program Files\SpySheriff\SpySheriff.exe

Usuwanie tapety SpySheriff

Zostaw nie usuwaj jak nie masz darmowej wersji:

O4 - HKLM…\Run: [bO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1 O4 - HKLM…\Run: [MW1HelperStartUp] C:\PROGRA~1\MAGICW~1\MW1HEL~1.EXE /partner MW1

[Yellen (Dny15)]

O20 - AppInit_DLLs: C:\WINDOWS\System32\svch2y.dll O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll

Nie mogę usunąc tych plików. Pisze że nie ma dostępu.

jeszcze na kompie powinien być plik doser.exe

Nie moge niczego takiego znaleśc

Masz VX2, daj loga z l2mfix:

yyyyy nie rozumiem

a teraz wklejam nowy log z hijacka:

Logfile of HijackThis v1.99.1 Scan saved at 16:20:13, on 2006-02-26 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\DLAWSZ~1\USTAWI~1\Temp\Rar$EX00.313\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [OfficeGuard RegChecker] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe” O4 - HKLM…\Run: [AVPCC] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe” /wait O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AQQ] C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe O17 - HKLM\System\CCS\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\lv0409dqe.dll O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll O20 - Winlogon Notify: wancp - wancp.dll (file missing) O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing)

oraz z F2Mfix:

L2MFIX find log 010406 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] “DLLName”=“cscdll.dll” “Logon”=“WinlogonLogonEvent” “Logoff”=“WinlogonLogoffEvent” “ScreenSaver”=“WinlogonScreenSaverEvent” “Startup”=“WinlogonStartupEvent” “Shutdown”=“WinlogonShutdownEvent” “StartShell”=“WinlogonStartShellEvent” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD] “Asynchronous”=dword:00000000 “DllName”=“C:\WINDOWS\system32\lv0409dqe.dll” “Impersonate”=dword:00000000 “Logon”=“WinLogon” “Logoff”=“WinLogoff” “Shutdown”=“WinShutdown” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satmmc] “DllName”=hex(2):73,00,61,00,74,00,6d,00,6d,00,63,00,2e,00,64,00,6c,00,6c,00,\ 00,00 “Startup”=“satmmc” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 “MaxWait”=dword:00000001 “M41key”="[34524185323259[DLA WSZYSTKICH]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] “DLLName”=“wlnotify.dll” “Logon”=“SCardStartCertProp” “Logoff”=“SCardStopCertProp” “Lock”=“SCardSuspendCertProp” “Unlock”=“SCardResumeCertProp” “Enabled”=dword:00000001 “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “StartShell”=“SchedStartShell” “Logoff”=“SchedEventLogOff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] “Logoff”=“WLEventLogoff” “Impersonate”=dword:00000000 “Asynchronous”=dword:00000001 “DllName”=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] “DLLName”=“WlNotify.dll” “Lock”=“SensLockEvent” “Logon”=“SensLogonEvent” “Logoff”=“SensLogoffEvent” “Safe”=dword:00000001 “MaxWait”=dword:00000258 “StartScreenSaver”=“SensStartScreenSaverEvent” “StopScreenSaver”=“SensStopScreenSaverEvent” “Startup”=“SensStartupEvent” “Shutdown”=“SensShutdownEvent” “StartShell”=“SensStartShellEvent” “PostShell”=“SensPostShellEvent” “Disconnect”=“SensDisconnectEvent” “Reconnect”=“SensReconnectEvent” “Unlock”=“SensUnlockEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] “Asynchronous”=dword:00000000 “DllName”=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Impersonate”=dword:00000000 “Logoff”=“TSEventLogoff” “Logon”=“TSEventLogon” “PostShell”=“TSEventPostShell” “Shutdown”=“TSEventShutdown” “StartShell”=“TSEventStartShell” “Startup”=“TSEventStartup” “MaxWait”=dword:00000258 “Reconnect”=“TSEventReconnect” “Disconnect”=“TSEventDisconnect” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wancp] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DLLName”=“wancp.dll” “Logon”=“StartProcessAtWinLogon” “Logoff”=“StopProcessAtWinLogoff” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] “DLLName”=“wlnotify.dll” “Logon”=“RegisterTicketExpiredNotificationEvent” “Logoff”=“UnregisterTicketExpiredNotificationEvent” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] “{5CA22D04-2BE9-83F0-6EDC-1E60CB729E93}”="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}”=“iTunes” “{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension” “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension” “{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}”="" “{99496818-3323-4FC1-AD15-A878FBF59DDD}”="" “{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}”="" “{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}”="" “{5EAC7821-996E-4DAB-8E18-489881C7DDB8}”="" “{54397E21-F6FB-4CEA-B696-948E662C089F}”="" “{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}”="" “{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}”="" “{BF04AA25-A950-40CE-85B5-F6BF0462AED0}”="" “{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}”="" “{63A34EA6-9C4F-47D3-BB14-A60FD564310E}”="" “{67B20E57-C8D2-452C-B65C-6021EE418AFC}”="" “{C26E38BB-0AA9-4412-AD66-22F309AA82F5}”="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}] @="" “IDEx”=“ADDR” [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}\InprocServer32] @=“C:\WINDOWS\system32\wbashext.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}] @="" [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}\InprocServer32] @=“C:\WINDOWS\system32\czmrepl.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}] @="" [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}\InprocServer32] @=“C:\WINDOWS\system32\GUARAspi.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}] @="" [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}\InprocServer32] @=“C:\WINDOWS\system32\pbtorsvc.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}] @="" [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}\InprocServer32] @=“C:\WINDOWS\system32\aomparse.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}] @="" [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}\InprocServer32] @=“C:\WINDOWS\system32\dynaddr.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}] @="" [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}\InprocServer32] @=“C:\WINDOWS\system32\ecentprf.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}] @="" [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}\InprocServer32] @=“C:\WINDOWS\system32\guard.tmp” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}] @="" [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}\InprocServer32] @=“C:\WINDOWS\system32\iHssvcs.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}] @="" [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}\InprocServer32] @=“C:\WINDOWS\system32\ajfsipc.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}] @="" [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}\InprocServer32] @=“C:\WINDOWS\system32\wccsvc.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}] @="" [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}\InprocServer32] @=“C:\WINDOWS\system32\dqcpsapi.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}] @="" [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}\InprocServer32] @=“C:\WINDOWS\system32\vtmredir.dll” “ThreadingModel”=“Apartment” ********************************************************************************** Files Found are not all bad files: Locate .tmp files: ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 74CA-DE6F Katalog: C:\WINDOWS\System32 2006-02-26 16:03 234˙254 vtmredir.dll 2006-02-26 15:28 235˙667 s4pule791h.dll 2006-02-26 15:28 234˙254 lv0409dqe.dll 2006-01-25 20:20 2005-11-05 13:59 3 plik(˘w) 704˙175 bajt˘w 2 katalog(˘w) 35˙906˙228˙224 bajt˘w wolnych

:?

[Gutek]

Po pierwsze używać Look2Me-Destroyer.exe masz TUTAJ zajmiemy sie VX2

[Yellen (Dny15)]

Wyskakuje mi taki komunikat:

Component ‘mswinsck.ocx’ or one of its dependencies not correctly registered a file is missing or invalid

i nic się nie dzieje.

[Gutek]

A co jest na dole w linku

If you receive a runtime error ‘339’ please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory. http://www.ascentive.com/support/new/im … WINSCK.OCX

jak jest bład MSWINSCK.OCX pobierz masz linka - http://www.ascentive.com/support/new/im … WINSCK.OCX i skopiuj do C:\Windows\System32

[Yellen (Dny15)]

sorki :?

I teraz co? :lol:

[Gutek]

Jak uzyłes Look2Me-Destroyer.exe daj log z l2mfix opcja nr. 1 oraz z hijacka

[Yellen (Dny15)]

No to wrzucam :lol: :

HiJack:

Logfile of HijackThis v1.99.1 Scan saved at 19:11:58, on 2006-02-26 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\WINDOWS\System32\atiptaxx.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\iPod\bin\iPodService.exe C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\DLAWSZ~1\USTAWI~1\Temp\Rar$EX03.703\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [OfficeGuard RegChecker] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe” O4 - HKLM…\Run: [AVPCC] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe” /wait O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AQQ] C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe O17 - HKLM\System\CCS\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing)

L2Mfix:

L2MFIX find log 010406 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] “Asynchronous”=dword:00000000 “DllName”="" “Impersonate”=dword:00000000 “Logon”=“WinLogon” “Logoff”=“WinLogoff” “Shutdown”=“WinShutdown” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satmmc] “DllName”=hex(2):73,00,61,00,74,00,6d,00,6d,00,63,00,2e,00,64,00,6c,00,6c,00,\ 00,00 “Startup”=“satmmc” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 “MaxWait”=dword:00000001 “M41key”="[34524185323259[DLA WSZYSTKICH]" ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}”=“iTunes” “{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension” “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension” “{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}”="" “{99496818-3323-4FC1-AD15-A878FBF59DDD}”="" “{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}”="" “{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}”="" “{5EAC7821-996E-4DAB-8E18-489881C7DDB8}”="" “{54397E21-F6FB-4CEA-B696-948E662C089F}”="" “{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}”="" “{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}”="" “{BF04AA25-A950-40CE-85B5-F6BF0462AED0}”="" “{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}”="" “{63A34EA6-9C4F-47D3-BB14-A60FD564310E}”="" “{67B20E57-C8D2-452C-B65C-6021EE418AFC}”="" “{C26E38BB-0AA9-4412-AD66-22F309AA82F5}”="" “{ABE92393-EB46-4868-84A2-BF3FA268684A}”="" “{7444C717-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto PKO” “{7444C719-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto Sign” ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}] @="" “IDEx”=“ADDR” [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}\InprocServer32] @=“C:\WINDOWS\system32\wbashext.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}] @="" [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}\InprocServer32] @=“C:\WINDOWS\system32\czmrepl.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}] @="" [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}\InprocServer32] @=“C:\WINDOWS\system32\GUARAspi.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}] @="" [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}\InprocServer32] @=“C:\WINDOWS\system32\pbtorsvc.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}] @="" [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}\InprocServer32] @=“C:\WINDOWS\system32\aomparse.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}] @="" [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}\InprocServer32] @=“C:\WINDOWS\system32\dynaddr.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}] @="" [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}\InprocServer32] @=“C:\WINDOWS\system32\ecentprf.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}] @="" [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}\InprocServer32] @=“C:\WINDOWS\system32\guard.tmp” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}] @="" [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}\InprocServer32] @=“C:\WINDOWS\system32\iHssvcs.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}] @="" [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}\InprocServer32] @=“C:\WINDOWS\system32\ajfsipc.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}] @="" [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}\InprocServer32] @=“C:\WINDOWS\system32\wccsvc.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}] @="" [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}\InprocServer32] @=“C:\WINDOWS\system32\dqcpsapi.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}] @="" [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}\InprocServer32] @=“C:\WINDOWS\system32\rZsapi32.dll” “ThreadingModel”=“Apartment” Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID{ABE92393-EB46-4868-84A2-BF3FA268684A}] @="" [HKEY_CLASSES_ROOT\CLSID{ABE92393-EB46-4868-84A2-BF3FA268684A}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID{ABE92393-EB46-4868-84A2-BF3FA268684A}\Implemented Categories{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID{ABE92393-EB46-4868-84A2-BF3FA268684A}\InprocServer32] @=“C:\WINDOWS\system32\guard.tmp” “ThreadingModel”=“Apartment” ********************************************************************************** Files Found are not all bad files: Locate .tmp files: ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 74CA-DE6F Katalog: C:\WINDOWS\System32 2006-01-25 20:20 2005-11-05 13:59 0 plik(˘w) 0 bajt˘w 2 katalog(˘w) 35˙897˙606˙144 bajt˘w wolnych

Wielkie dzięki :lol:

[Gutek]

Bez netu, net na zero i:

Otwórz Notatnik i wklej w nim to:

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}”=- “{99496818-3323-4FC1-AD15-A878FBF59DDD}”=- “{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}”=- “{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}”=- “{5EAC7821-996E-4DAB-8E18-489881C7DDB8}”=- “{54397E21-F6FB-4CEA-B696-948E662C089F}”=- “{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}”=- “{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}”=- “{BF04AA25-A950-40CE-85B5-F6BF0462AED0}”=- “{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}”=- “{63A34EA6-9C4F-47D3-BB14-A60FD564310E}”=- “{67B20E57-C8D2-452C-B65C-6021EE418AFC}”=- “{C26E38BB-0AA9-4412-AD66-22F309AA82F5}”=- “{ABE92393-EB46-4868-84A2-BF3FA268684A}”=- [-HKEY_CLASSES_ROOT\CLSID{AEEFD283-06F5-46AA-A6CD-14AE9DFDA03E}] [-HKEY_CLASSES_ROOT\CLSID{99496818-3323-4FC1-AD15-A878FBF59DDD}] [-HKEY_CLASSES_ROOT\CLSID{B7E6D8ED-F762-4091-B462-B1EF0CC392D1}] [-HKEY_CLASSES_ROOT\CLSID{ABE58A89-E9B7-4CBA-B7A5-4DD4AC596F88}] [-HKEY_CLASSES_ROOT\CLSID{5EAC7821-996E-4DAB-8E18-489881C7DDB8}] [-HKEY_CLASSES_ROOT\CLSID{54397E21-F6FB-4CEA-B696-948E662C089F}] [-HKEY_CLASSES_ROOT\CLSID{30120BD7-6D3E-4FD3-9C82-590B086C2EC0}] [-HKEY_CLASSES_ROOT\CLSID{1FC62D5C-D4B6-4A8B-B6CD-321C672E74E7}] [-HKEY_CLASSES_ROOT\CLSID{BF04AA25-A950-40CE-85B5-F6BF0462AED0}] [-HKEY_CLASSES_ROOT\CLSID{DB7565E5-F903-45B2-832F-7AF1C6A1ECB8}] [-HKEY_CLASSES_ROOT\CLSID{63A34EA6-9C4F-47D3-BB14-A60FD564310E}] [-HKEY_CLASSES_ROOT\CLSID{67B20E57-C8D2-452C-B65C-6021EE418AFC}] [-HKEY_CLASSES_ROOT\CLSID{C26E38BB-0AA9-4412-AD66-22F309AA82F5}] [-HKEY_CLASSES_ROOT\CLSID{ABE92393-EB46-4868-84A2-BF3FA268684A}]

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\System32\czmrepl.dll

C:\WINDOWS\System32\guard.tmp

C:\WINDOWS\System32\rZsapi32.dll

C:\WINDOWS\System32\dqcpsapi.dll

C:\WINDOWS\System32\wccsvc.dll

C:\WINDOWS\System32\ajfsipc.dll

C:\WINDOWS\System32\iHssvcs.dll

C:\WINDOWS\System32\ecentprf.dll

C:\WINDOWS\System32\dynaddr.dll

C:\WINDOWS\System32\aomparse.dll

C:\WINDOWS\System32\pbtorsvc.dll

C:\WINDOWS\System32\GUARAspi.dll

C:\WINDOWS\System32\wbashext.dll i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz. Przejście do trybu awaryjnego Windows i uruchomienie pliku FIX.REG.

Nowy log z l2mfix opcja nr. 1

[Yellen (Dny15)]

:? :? Zrobiłem

Proszę oto log z hiJacka:

Logfile of HijackThis v1.99.1 Scan saved at 20:59:01, on 2006-02-26 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe C:\WINDOWS\System32\atiptaxx.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe C:\Program Files\WinRAR\WinRAR.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\wuauclt.exe C:\DOCUME~1\DLAWSZ~1\USTAWI~1\Temp\Rar$EX02.312\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [OfficeGuard RegChecker] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe” O4 - HKLM…\Run: [AVPCC] “C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe” /wait O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM…\Run: [AtiPTA] atiptaxx.exe O4 - HKLM…\Run: [bearShare] “C:\Program Files\BearShare\BearShare.exe” /pause O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM…\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [AQQ] C:\DOCUME~1\DLAWSZ~1\MOJEDO~1\MOJEOB~1\POPRAW~1\AQQ\AQQ.exe O17 - HKLM\System\CCS\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS1\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O17 - HKLM\System\CS2\Services\Tcpip…{7F0F8468-CEF4-4B47-B430-91BA8690A1E8}: NameServer = 194.204.159.1,194.204.152.34 O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll O23 - Service: AVP Control Centre Service (AVPCC) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /Service (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KAV Monitor Service (KAVMonitorService) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpm.exe" /Service (file missing)

i L2Mfix:

L2MFIX find log 010406 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] “Asynchronous”=dword:00000000 “DllName”="" “Impersonate”=dword:00000000 “Logon”=“WinLogon” “Logoff”=“WinLogoff” “Shutdown”=“WinShutdown” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 “Logoff”=“ChainWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] “Asynchronous”=dword:00000000 “Impersonate”=dword:00000000 “DllName”=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 “Logoff”=“CryptnetWlxLogoffEvent” [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\satmmc] “DllName”=hex(2):73,00,61,00,74,00,6d,00,6d,00,63,00,2e,00,64,00,6c,00,6c,00,\ 00,00 “Startup”=“satmmc” “Impersonate”=dword:00000001 “Asynchronous”=dword:00000001 “MaxWait”=dword:00000001 “M41key”="[34524185323259[DLA WSZYSTKICH]" ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] “{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}”=“iTunes” “{5F327514-6C5E-4d60-8F16-D07FA08A78ED}”=“Auto Update Property Sheet Extension” “{B41DB860-8EE4-11D2-9906-E49FADC173CA}”=“WinRAR shell extension” “{7444C717-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto PKO” “{7444C719-39BF-11D1-8CD9-00C04FC29D45}”=“Rozszerzenie Crypto Sign” ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: Locate .tmp files: ********************************************************************************** Directory Listing of system files: Wolumin w stacji C nie ma etykiety. Numer seryjny woluminu: 74CA-DE6F Katalog: C:\WINDOWS\System32 2006-01-25 20:20 2005-11-05 13:59 0 plik(˘w) 0 bajt˘w 2 katalog(˘w) 35˙897˙012˙224 bajt˘w wolnych

[Gutek]

No i VX2 z głowy ale jeszzcze raz uzyj Pocket Killbox. i wklej C:\WINDOWS\SYSTEM32\satmmc.dll i gdy skasujesz zobacz czy w Hijacku nie ma wpisu

O20 - Winlogon Notify: satmmc - C:\WINDOWS\SYSTEM32\satmmc.dll

[Yellen (Dny15)]

I jaka nie mam tego wpisu to juz ok?? :lol:

Wielkie dzięki Gutek ratujesz mi znowu D**e :mrgreen: