Problem z kompem.Zmieniajaca sie strona startowa w IE

[rudik77 (Haha)]

Witam.

Mamy problem z komputerem od jakiegos czasu,z niektorymi problemamy poradzilem sobie,ale nie kotre zostaly.Wchodzilem na strony gdzie mozna zlapac wirki,zmienila mi sie strona startowa (http://esafetylist.com/) a w niej widnieje komunikat … wyskakuja reklamy z ostrzezeniami ze komputer jest zainfekowany i doradzaja jakie programy kupic aby zwalczyc to

Nie wiem co w tej stytlacji mam robic,bardzo prosze o pomoc w rozwiazaniu problemu

Log HijqckThis i Silent Runners

Logfile of HijackThis v1.99.1 Scan saved at 22:12:26, on 29/12/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Video ActiveX Object\isamonitor.exe C:\Program Files\Video ActiveX Object\pmsngr.exe C:\WINDOWS\SOUNDMAN.EXE C:\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe C:\Program Files\Video ActiveX Object\pmmon.exe C:\Apps\Powercinema\PCMService.exe C:\apps\ABoard\ABoard.exe C:\WINDOWS\VM303_STI.EXE C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Video ActiveX Object\isamini.exe C:\apps\ABoard\AOSD.exe C:\Program Files\Fichiers communs{ACC27347-088E-1036-0710-040310280020}\Update.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\winlogon.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spybot - Search Destroy\SpybotSD.exe C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\papa\LOCALS~1\Temp\Rar$EX00.657\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.yahoo.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: PBBEFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB197B82D} - C:\WINDOWS\system32\pbbefrv2.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Video ActiveX Object\isaddon.dll O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\FICHIE~1{3CC27~1\Bar888.dll O3 - Toolbar: Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: PBBEFRV2 - {4E7BD74F-2B8D-469E-A0E8-ED6AB197B82D} - C:\WINDOWS\system32\pbbefrv2.dll (file missing) O3 - Toolbar: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\FICHIE~1{3CC27~1\Bar888.dll O3 - Toolbar: Protection Bar - {0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} - C:\Program Files\Video ActiveX Object\iesplugin.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM…\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM…\Run: [PCMService] “c:\Apps\Powercinema\PCMService.exe” O4 - HKLM…\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe O4 - HKLM…\Run: [bigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) O4 - HKLM…\Run: [kis] “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe” O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [{ACC27347-088E-1036-0710-040310280020}] “C:\Program Files\Fichiers communs{ACC27347-088E-1036-0710-040310280020}\Update.exe” te-110-12-0000245 O4 - HKLM…\Run: [ipWins] C:\Program Files\Ipwindows\ipwins.exe O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - Startup: VirtualExpander.lnk = C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe O8 - Extra context menu item: Add to Kaspersky Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra ‘Tools’ menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra ‘Tools’ menuitem: Show Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\befr.htm O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll O21 - SSODL: buprestidae - {b59f3ba4-98da-4b5f-8a2d-7b56fb11140b} - C:\WINDOWS\System32\cthkpcv.dll (file missing) O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

“Silent Runners.vbs”, revision 49, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by “{++}” Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “MSMSGS” = ““C:\Program Files\Messenger\msmsgs.exe” /background” [MS] “Gadu-Gadu” = ““C:\Program Files\Gadu-Gadu\gg.exe” /tray” [“Gadu-Gadu S.A.”] HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} “isamonitor.exe” = “C:\Program Files\Video ActiveX Object\isamonitor.exe” [null data] “none” = “C:\Program Files\Video ActiveX Object\pmsngr.exe” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} “SoundMan” = “SOUNDMAN.EXE” [“Realtek Semiconductor Corp.”] “ATIModeChange” = “Ati2mdxx.exe” [“ATI Technologies, Inc.”] “ATIPTA” = “C:\ATI Technologies\ATI Control Panel\atiptaxx.exe” [“ATI Technologies, Inc.”] “SunJavaUpdateSched” = “C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe” [null data] “PCMService” = ““c:\Apps\Powercinema\PCMService.exe”” [“CyberLink Corp.”] “ACTIVBOARD” = “c:\apps\ABoard\ABoard.exe” [“NEC Computers International”] “BigDog303” = “C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)” [“Vimicro”] “kis” = ““C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe”” [“Kaspersky Lab”] “(Default)” = “(empty string)” [file not found] “TkBellExe” = ““C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe” -osboot” [“RealNetworks, Inc.”] “{ACC27347-088E-1036-0710-040310280020}” = ““C:\Program Files\Fichiers communs{ACC27347-088E-1036-0710-040310280020}\Update.exe” te-110-12-0000245” [null data] “IpWins” = “C:\Program Files\Ipwindows\ipwins.exe” [null data] HKLM\Software\Microsoft\Active Setup\Installed Components\ {306D6C21-C1B6-4629-986C-E59E1875B8AF}(Default) = (no title provided) \StubPath = ““C:\WINDOWS\System32\rundll32.exe” “C:\Program Files\Messenger\msgsc.dll”,ShowIconsUser” [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided) - {HKLM…CLSID} = “AcroIEHlprObj Class” \InProcServer32(Default) = “C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll” [“Adobe Systems Incorporated”] {4E7BD74F-2B8D-469E-A0E8-ED6AB197B82D}(Default) = (no title provided) - {HKLM…CLSID} = “PBBEFRV2” \InProcServer32(Default) = “C:\WINDOWS\system32\pbbefrv2.dll” [file not found] {53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided) - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\PROGRA~1\SPYBOT~1\SDHelper.dll” [“Safer Networking Limited”] {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D}(Default) = (no title provided) - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Video ActiveX Object\isaddon.dll” [null data] {C1B4DEC2-2623-438e-9CA2-C9043AB28508}(Default) = (no title provided) - {HKLM…CLSID} = “Bar888” \InProcServer32(Default) = “C:\PROGRA~1\FICHIE~1{3CC27~1\Bar888.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ “{42071714-76d4-11d1-8b24-00a0c9068ff3}” = “Extension Affichage Panorama du Panneau de configuration” - {HKLM…CLSID} = “Extension Affichage Panorama du Panneau de configuration” \InProcServer32(Default) = “deskpan.dll” [file not found] “{88895560-9AA2-1069-930E-00AA0030EBC8}” = “Extension icône HyperTerminal” - {HKLM…CLSID} = “HyperTerminal Icon Ext” \InProcServer32(Default) = “C:\WINDOWS\System32\hticons.dll” [“Hilgraeve, Inc.”] “{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}” = “Shell Extensions for RealOne Player” - {HKLM…CLSID} = “RealOne Player Context Menu Class” \InProcServer32(Default) = “C:\Program Files\Real\RealPlayer\rpshell.dll” [“RealNetworks, Inc.”] “{DEE12703-6333-4D4E-8F34-738C4DCC2E04}” = “RecordNow! SendToExt” - {HKLM…CLSID} = “RecordNow! SendToExt” \InProcServer32(Default) = “C:\Apps\RecordNow\shlext.dll” [null data] “{42042206-2D85-11D3-8CFF-005004838597}” = “Microsoft Office HTML Icon Handler” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Microsoft Office\Office10\msohev.dll” [MS] “{E4000AC4-5E5F-4956-807A-C5854405D64F}” = “VirtualExpanderFile.1” - {HKLM…CLSID} = “Virtual Expander Shell Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\VirtualExpander\VEShellExt.dll” [“Sony Corporation”] “{85E0B171-04FA-11D1-B7DA-00A0C90348D6}” = “Web Anti-Virus” - {HKLM…CLSID} = “Web Anti-Virus” \InProcServer32(Default) = “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll” [“Kaspersky Lab”] “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” = “WinRAR shell extension” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\ “{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}” = “buprestidae” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\cthkpcv.dll” [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ “buprestidae” = “{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\WINDOWS\System32\cthkpcv.dll” [file not found] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\ “AppInit_DLLs” = “C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll” [“Kaspersky Lab”] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ klogon\DLLName = “C:\WINDOWS\System32\klogon.dll” [“Kaspersky Lab”] HKLM\Software\Classes*\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] {58C83EE0-5261-11D3-81DC-D2AB3F16133C}(Default) = “{58C83EE0-5261-11D3-81DC-D2AB3F16133C}” - {HKLM…CLSID} = “iolo Incinerator Context Menu for Files” \InProcServer32(Default) = “C:\WINDOWS\System32\incinerator.dll” [“iolo technologies, LLC”] VirtualExpander(Default) = “{E4000AC4-5E5F-4956-807A-C5854405D64F}” - {HKLM…CLSID} = “Virtual Expander Shell Extension” \InProcServer32(Default) = “C:\WINDOWS\system32\VirtualExpander\VEShellExt.dll” [“Sony Corporation”] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus(Default) = “{dd230880-495a-11d1-b064-008048ec2fc5}” - {HKLM…CLSID} = (no title provided) \InProcServer32(Default) = “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll” [“Kaspersky Lab”] WinRAR(Default) = “{B41DB860-8EE4-11D2-9906-E49FADC173CA}” - {HKLM…CLSID} = “WinRAR” \InProcServer32(Default) = “C:\Program Files\WinRAR\rarext.dll” [null data] {58C83EE0-5261-11D3-81DC-D2AB3F16133C}(Default) = “{58C83EE0-5261-11D3-81DC-D2AB3F16133C}” - {HKLM…CLSID} = “iolo Incinerator Context Menu for Files” \InProcServer32(Default) = “C:\WINDOWS\System32\incinerator.dll” [“iolo technologies, LLC”] Group Policies {policy setting}: -------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ “shutdownwithoutlogon” = (REG_DWORD) hex:0x00000001 {Shutdown: Allow system to be shut down without having to log on} “undockwithoutlogon” = (REG_DWORD) hex:0x00000001 {Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Colline verdoyante.bmp” Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ “Wallpaper” = “C:\WINDOWS\Web\Wallpaper\Colline verdoyante.bmp” Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ “SCRNSAVE.EXE” = “C:\WINDOWS\System32\logon.scr” [MS] Startup items in “papa” “All Users” startup folders: ------------------------------------------------------ C:\Documents and Settings\papa\Menu Démarrer\Programmes\Démarrage “VirtualExpander” - shortcut to: “C:\WINDOWS\system32\VirtualExpander\VirtualExpander.exe” [“Sony Corporation”] Enabled Scheduled Tasks: ------------------------ “Rappel d’enregistrement 1” - launches: “C:\WINDOWS\System32\OOBE\oobebaln.exe /sys /r /n:1” [MS] “Rappel d’enregistrement 2” - launches: “C:\WINDOWS\System32\OOBE\oobebaln.exe /sys /r /n:2” [MS] “Rappel d’enregistrement 3” - launches: “C:\WINDOWS\System32\OOBE\oobebaln.exe /sys /r /n:3” [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] 000000000002\LibraryPath = “%SystemRoot%\System32\winrnr.dll” [MS] 000000000003\LibraryPath = “%SystemRoot%\System32\mswsock.dll” [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ “{4E7BD74F-2B8D-469E-A0E8-ED6AB197B82D}” - {HKLM…CLSID} = “PBBEFRV2” \InProcServer32(Default) = “C:\WINDOWS\system32\pbbefrv2.dll” [file not found] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ “{4E7BD74F-2B8D-469E-A0E8-ED6AB197B82D}” = (no title provided) - {HKLM…CLSID} = “PBBEFRV2” \InProcServer32(Default) = “C:\WINDOWS\system32\pbbefrv2.dll” [file not found] “{C1B4DEC2-2623-438E-9CA2-C9043AB28508}” = (no title provided) - {HKLM…CLSID} = “Bar888” \InProcServer32(Default) = “C:\PROGRA~1\FICHIE~1{3CC27~1\Bar888.dll” [null data] “{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}” = (no title provided) - {HKLM…CLSID} = “Protection Bar” \InProcServer32(Default) = “C:\Program Files\Video ActiveX Object\iesplugin.dll” [null data] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F}(Default) = “Protection Bar” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\Video ActiveX Object\iesplugin.dll” [null data] HKLM\Software\Classes\CLSID{85E0B171-04FA-11D1-B7DA-00A0C90348D6}(Default) = “Web Anti-Virus” Implemented Categories{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32(Default) = “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll” [“Kaspersky Lab”] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ “MenuText” = “Console Java (Sun)” “CLSIDExtension” = “{08B0E5C0-4FCB-11CF-AAA5-00401C608501}” - {HKLM…CLSID} = “Web Browser Applet Control” \InProcServer32(Default) = “C:\WINDOWS\System32\msjava.dll” [file not found] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ “ButtonText” = “Web Anti-Virus” Miscellaneous IE Hijack Points ------------------------------ C:\WINDOWS\INF\IERESET.INF (used to “Reset Web Settings”) Added lines (compared with English-language version): [strings]: START_PAGE_URL=file://C:\APPS\IE\offline\befr.htm [strings]: SAFESITE_VALUE=“http://home.microsoft.com/intl/fr/” Missing lines (compared with English-language version): [strings]: 2 lines Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Kaspersky Internet Security 6.0, AVP, “C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe -r” [“Kaspersky Lab”] Machine Debug Manager, MDM, ““C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe”” [MS] SmartLinkService, SLService, “slserv.exe” [" "] ---------- : Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer “No” at the first message box and “Yes” at the second message box. ---------- (total run time: 244 seconds, including 1 second for message boxes)

[Joan (Joan Sunshine)]

Użyj SmitFraudFix z opcji 2 w trybie awaryjnym i po tym nowe logi z HJT i Silent Runners a także raport ze SmitFraudFix – plik c:\rapport.txt.