Nie otwiera sie menadżer zadań ani regedit


(Rudasmar) #1

witam!!tak jak właśnie widać w temacie mam problem związany z otwarciem menadżera zadań i regedit. tutaj wklejam loga z otl

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\GEST not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\cdoosoft not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Power2GoExpress not found.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\DisableRegistryTools deleted successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\DisableTaskMgr deleted successfully.

Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units{31435657-9980-0010-8000-00AA00389B71}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{31435657-9980-0010-8000-00AA00389B71}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components{31435657-9980-0010-8000-00AA00389B71}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{31435657-9980-0010-8000-00AA00389B71}\ not found.

C:\autorun.inf folder moved successfully.

Folder move failed. D:\autorun.inf scheduled to be moved on reboot.

File E:\autorun.inf not found.

C:\Qoobox\TestC folder moved successfully.

C:\Qoobox\Test folder moved successfully.

C:\Qoobox\Quarantine\Registry_backups folder moved successfully.

C:\Qoobox\Quarantine\D folder moved successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32 folder moved successfully.

C:\Qoobox\Quarantine\C\WINDOWS\Help folder moved successfully.

C:\Qoobox\Quarantine\C\WINDOWS folder moved successfully.

C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Menu Start folder moved successfully.

C:\Qoobox\Quarantine\C\Documents and Settings\All Users folder moved successfully.

C:\Qoobox\Quarantine\C\Documents and Settings folder moved successfully.

C:\Qoobox\Quarantine\C folder moved successfully.

C:\Qoobox\Quarantine folder moved successfully.

C:\Qoobox\LastRun folder moved successfully.

C:\Qoobox\BackEnv folder moved successfully.

C:\Qoobox folder moved successfully.

File C:\autorun.inf not found.

File C:\9qqigqwf.exe not found.

File C:\ws.exe not found.

File C:\y.exe not found.

File C:\0fpdq2dw.exe not found.

File C:\df.exe not found.

File C:\c2e.exe not found.

File C:\qkm.exe not found.

File C:\sywyrl0q.exe not found.

File C:\WINDOWS\System32\ptnrtg.dll not found.

========== FILES ==========

File\Folder D:\9qqigqwf.exe not found.

File\Folder E:\9qqigqwf.exe not found.

File\Folder D:\ws.exe not found.

File\Folder E:\ws.exe not found.

File\Folder D:\y.exe not found.

File\Folder E:\y.exe not found.

File\Folder D:\0fpdq2dw.exe not found.

File\Folder E:\0fpdq2dw.exe not found.

File\Folder D:\df.exe not found.

File\Folder E:\df.exe not found.

File\Folder D:\c2e.exe not found.

File\Folder E:\c2e.exe not found.

File\Folder D:\qkm.exe not found.

File\Folder E:\qkm.exe not found.

File\Folder D:\sywyrl0q.exe not found.

File\Folder E:\sywyrl0q.exe not found.

========== REGISTRY ==========

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"FirstRunDisabled" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"AntiVirusDisableNotify" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"FirewallDisableNotify" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"UpdatesDisableNotify" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"AntiVirusOverride" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"FirewallOverride" | 0 /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\"UacDisableNotify" | 0 /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\H:\explorer.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\Komp1\USTAWI~1\Temp\uxpo.exe not found.

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\DOCUME~1\Komp1\USTAWI~1\Temp\w95cca.exe not found.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Gość

->Temp folder emptied: 587534 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: Shasti

->Temp folder emptied: 750701 bytes

->Temporary Internet Files folder emptied: 2954607 bytes

->Java cache emptied: 35432091 bytes

->Opera cache emptied: 40482264 bytes

->Flash cache emptied: 67397 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 2596 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 16384 bytes

RecycleBin emptied: 409436 bytes

Total Files Cleaned = 77,00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07302010_161759

Files\Folders moved on Reboot...

Folder move failed. D:\autorun.inf scheduled to be moved on reboot.

C:\WINDOWS\temp\Perflib_Perfdata_c94.dat moved successfully.

Registry entries deleted on Reboot...

tutaj z combofix

ComboFix 10-07-29.01 - Shasti 2010-07-30 4:05.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.2046.1400 [GMT 2:00]

Uruchomiony z: c:\documents and settings\Shasti\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

.

((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\autorun.inf

c:\documents and settings\All Users\Menu Start\HP Image Zone .lnk

c:\windows\Alcmtr.exe

c:\windows\Help\DVCLAL

c:\windows\Help\PACKAGEINFO

c:\windows\system32\winlogon.bak

D:\autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABP470N5

-------\Service_abp470n5

((((((((((((((((((((((((( Pliki utworzone od 2010-06-28 do 2010-07-30 )))))))))))))))))))))))))))))))

.

2010-07-28 15:31 . 2010-07-28 15:32 -------- d-----w- c:\program files\Valve

2010-07-28 11:18 . 2010-07-29 21:07 -------- d-----w- C:\valve

2010-07-25 07:39 . 2010-07-25 07:39 33224 --sh--r- C:\mlrnft.exe

2010-07-11 19:05 . 2010-07-11 19:05 -------- d-----w- c:\documents and settings\Gość

.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-29 17:35 . 2009-02-22 16:29 108392 ----a-w- c:\documents and settings\Shasti\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2010-07-28 10:12 . 2009-03-13 09:34 -------- d-----w- c:\documents and settings\Shasti\Dane aplikacji\Samsung

2010-07-28 10:12 . 2009-02-22 16:33 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-28 10:09 . 2009-03-10 19:19 -------- d-----w- c:\program files\Nokia

2010-07-14 19:45 . 2001-10-30 11:00 89234 ----a-w- c:\windows\system32\perfc015.dat

2010-07-14 19:45 . 2001-10-30 11:00 500092 ----a-w- c:\windows\system32\perfh015.dat

2010-07-11 19:13 . 2009-02-22 20:33 -------- d-----w- c:\program files\Winamp

2010-07-02 13:29 . 2009-02-22 16:41 -------- d-----w- c:\program files\Opera

2010-06-08 20:06 . 2009-02-23 18:58 -------- d-----w- c:\documents and settings\Shasti\Dane aplikacji\skypePM

2010-06-08 20:06 . 2009-02-23 18:57 -------- d-----w- c:\documents and settings\Shasti\Dane aplikacji\Skype

2010-05-24 18:06 . 2010-05-24 18:06 503808 ----a-w- c:\documents and settings\Shasti\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6973a9aa-n\msvcp71.dll

2010-05-24 18:06 . 2010-05-24 18:06 499712 ----a-w- c:\documents and settings\Shasti\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6973a9aa-n\jmc.dll

2010-05-24 18:06 . 2010-05-24 18:06 348160 ----a-w- c:\documents and settings\Shasti\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-6973a9aa-n\msvcr71.dll

2010-05-24 18:06 . 2010-05-24 18:06 61440 ----a-w- c:\documents and settings\Shasti\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1090952c-n\decora-sse.dll

2010-05-24 18:06 . 2010-05-24 18:06 12800 ----a-w- c:\documents and settings\Shasti\Dane aplikacji\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-1090952c-n\decora-d3d.dll

2009-11-28 11:35 . 2009-02-28 22:26 900 --sha-w- c:\windows\system32\KGyGaAvL.sys

.

------- Sigcheck -------

[-] 2009-03-21 . 66ECFE388AD1BD281DD3391B756670CF . 510464 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[7] 2008-04-14 . 51FD2E13D723857B9CA239AE77150F48 . 510464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="d:\program files\steam\steam.exe" [2010-07-29 1316176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2008-07-23 16804864]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 181104]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 398056]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 360448]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\documents and settings\All Users\Dane aplikacji\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2006-01-12 13:40 229376 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]

2008-12-03 11:47 1275392 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]

2008-04-13 21:13 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]

2008-04-13 21:13 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"AntiVirService"=2 (0x2)

"AntiVirSchedulerService"=2 (0x2)

"wuauserv"=2 (0x2)

"TabletServicePen"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe"

"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

"MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC

"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

"PWRISOVM.EXE"=c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\Network Diagnostic\xpnetdiag.exe"=

"%windir%\system32\sessmgr.exe"=

"d:\Program Files\DC++\DCPlusPlus.exe"=

"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=

"c:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=

"c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=

"c:\Program Files\Nowe Gadu-Gadu\gg.exe"=

"c:\Program Files\Opera\opera.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hposid01.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"=

"c:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"=

"c:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"=

"c:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"=

"c:\valve\hl.exe"=

"c:\Program Files\Nero\Nero 7\Nero Home\NeroHome.exe"=

"c:\Documents and Settings\Shasti\Pulpit\winbox.exe"=

"c:\Program Files\Java\jre6\bin\java.exe"=

"d:\Program Files\Steam\Steam.exe"= d:\program files\steam\steam.exe

"c:\Program Files\Corel\CorelDRAW Graphics Suite 13\Programs\CorelDRW.exe"=

"c:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"=

"c:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"=

"c:\Program Files\Common Files\Java\Java Update\jusched.exe"=

"c:\Program Files\TuneUp Utilities 2008\OneClick.exe"=

"c:\WINDOWS\RTHDCPL.EXE"=

"c:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe"=

"c:\Program Files\QuickTime\qttask.exe"=

"c:\WINDOWS\system32\netsh.exe"=

"c:\Program Files\Common Files\Java\Java Update\jucheck.exe"=

"c:\Program Files\Skype\Phone\Skype.exe"=

"d:\Program Files\Steam\steamapps\rudas07\counter-strike\hl.exe"=

"c:\Documents and Settings\Shasti\Pulpit\Gamma Control.exe"=

"c:\Program Files\WinRAR\WinRAR.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8975:TCP"= 8975:TCP:qfedgp

R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2009-08-16 33824]

S3 amsint32;amsint32;\??\c:\windows\system32\drivers\jtgdqr.sys -- c:\windows\system32\drivers\jtgdqr.sys [?]

S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\drivers\whfltr2k.sys [2007-01-25 6784]

S3 whmice2k;Advanced Wheel Mouse Upper Filter Driver;c:\windows\system32\drivers\whmice2k.sys [2004-04-26 6885]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - ABP470N5

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

rooqklwog

ckdiwsggq

.

Zawartość folderu 'Zaplanowane zadania'

2010-07-17 c:\windows\Tasks\AppleSoftwareUpdate.job

  • c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2010-07-30 c:\windows\Tasks\Konserwacja jednym kliknięciem.job

  • c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-08-27 11:09]

.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.google.pl/

IE: Eksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

  • USUNIĘTO PUSTE WPISY - - - -

MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe

MSConfigStartUp-CursorFX - c:\program files\Stardock\CursorFX\CursorFX.exe

MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe

MSConfigStartUp-WheelMouse - c:\advanc~1\wh_exec.exe

AddRemove-{C1080852-065E-4991-9260-F3756E3CC182} - c:\documents and settings\Shasti\Ustawienia lokalne\Dane aplikacji{A850D4D9-871B-4234-908D-21C457767270}\CursorFX_public.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-30 04:11

Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...

skanowanie pomyślnie ukończone

ukryte pliki: 0

**************************************************************************

.

--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

  • 'winlogon.exe'(828)

c:\windows\system32\Ati2evxx.dll

  • 'explorer.exe'(3960)

c:\windows\system32\WININET.dll

c:\windows\system32\wpdshserviceobj.dll

c:\windows\system32\portabledevicetypes.dll

c:\windows\system32\portabledeviceapi.dll

.

------------------------ Pozostałe uruchomione procesy ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\wbem\wmiapsrv.exe

c:\windows\RTHDCPL.EXE

.

**************************************************************************

.

Czas ukończenia: 2010-07-30 04:17:41 - komputer został uruchomiony ponownie

ComboFix-quarantined-files.txt 2010-07-30 02:17

Przed: 21 707 038 720 bajtów wolnych

Po: 21 670 191 104 bajtów wolnych

WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe

  • End Of File - - 9A84E902040EF83C5215B4F3D447AF66

dziękuje i czekam na odpowiedź i jakieś wskazówki


(Gryf00n) #2

pobierz UnHookExec.inf

ppm i wybierz zapisz jako

następnie w explorerze ppm i zainstaluj

Następnie użyj jakiegoś skanera typu Live CD

klick

klick

tutaj

ponieważ ten system to jedna wielka puszka


(Rudasmar) #3

niestety dalej nie pomoglo dlej mi sie nie chce otworzyc menadzer ani regedit


(Agatonster) #4

rudas07 ,

Proszę poprawić pisownię w tytule tematu i w opisie problemu. W celu edycji swojego posta proszę skorzystać z przycisku Edytuj.

Zignorowanie zalecenia będzie skutkowało usunięciem tematu do Kosza.

Zamieszczenie logów na forum - przeczytaj i zastosuj się do zaleceń.


(dethloe123) #5

Masz wirusa Sality : http://forum.dobreprogramy.pl/usuwanie-znanych-wirusow-sality-jeefo-parite-virut-itp-t370365.html#p2400382