Wirus Win32:Sinowal

mtsteddy · 4 Grudzień 2007 16:41

witam,

od jakiegoś czasu zauważyłem, że komputer wolno chodzi tzn. wolniej niż zwykle otwierał programy takie jak: komunikator tlen, irfan view i inne. Dzisiaj Avast wykrył mi wirusa Win32:Sinowal lecz nie może go usunąć. Dałem go do kwarantanny, jednak wolałbym go w jakiś sposób się pozbyć. Oto log z HJ:

Logfile of HijackThis v1.99.1 Scan saved at 17:27:20, on 2007-12-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\Rundll32.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Alwil Software\Avast4\ashChest.exe D:\Programy\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM…\Run: [nwiz] nwiz.exe /install O4 - HKLM…\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM…\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM…\Run: [updReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM…\Run: [RemoteControl] “C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” O4 - HKLM…\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKLM…\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime O4 - HKCU…\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU…\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU…\Run: [Creative MediaSource Go] “C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe” /SCB O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.33/g_bin/pl/snooker_2_0_0_35.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

To Avast mi wyświetlił:

pozdrawiam

Gutek · 4 Grudzień 2007 16:43

Daj log z ComboFix

mtsteddy · 4 Grudzień 2007 17:25

log:

ComboFix 07-12-02.7 - Michal 2007-12-04 17:46:13.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.653 [GMT 1:00] Running from: C:\Documents and Settings\Michal\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-11-04 to 2007-12-04 ))))))))))))))))))))))))))))))) . 2007-12-02 18:23 . 2007-12-02 18:23 2007-12-02 13:31 . 2007-12-02 13:31 2007-11-26 17:24 . 2007-11-26 17:24 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-03 20:05 --------- d-----w C:\Program Files\niemiecki 2007-12-01 12:21 --------- d-----w C:\Documents and Settings\Michal\Dane aplikacji\Tlen.pl 2007-11-28 14:45 --------- d-----w C:\Program Files\Mozilla Thunderbird 2007-11-26 16:24 20 —h–w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2007-11-14 20:05 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-11 19:48 --------- d-----w C:\Program Files\Leksykonia 2007-10-25 13:34 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-17 19:02 --------- d-----w C:\Program Files\Video mp3 Extractor 2007-10-15 11:52 --------- d-----w C:\Program Files\YouTube Video Downloader 2007-10-14 14:40 --------- d-----w C:\Program Files\Odkurzacz 2007-10-13 17:54 --------- d-----w C:\Documents and Settings\Michal\Dane aplikacji\Mobipocket 2007-10-06 20:25 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-06 20:25 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avery . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-03-02 21:38] “Creative Detector”=“C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe” [2004-12-02 17:23] “Creative MediaSource Go”=“C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe” [2004-11-30 10:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2005-06-15 10:20 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe] “P17Helper”=“Rundll32 P17.dll” [] “UpdReg”=“C:\WINDOWS\UpdReg.EXE” [2000-05-11 00:00] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 20:24] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [2005-11-10 12:03] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “CTRegRun”=“C:\WINDOWS\CTRegRun.EXE” [1999-10-11 02:00] “CTSysVol”=“C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe” [2005-02-15 15:10] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-08-27 16:19] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-22 18:34:06] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 06:05:26] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-08-27 16:21:08] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2006-03-22 13:20:55] R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-04 18:21:09 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-04 18:22:04 - machine was rebooted C:\ComboFix2.txt … 2007-11-14 13:27 . — E O F —

Edit:

i jeszcze log z Avasta:

Gutek · 4 Grudzień 2007 20:46

Prawoklik na Mój Komputer>>Przywracanie systemu>> wyłącz przywracanie systemu na wszystkich dyskach.

Dodatkowo usuń plik

C:\Program Files\Common Files\Microsoft Shared\Web Folders[b]trz37.tmp

Pobierz program SDFix

mtsteddy · 5 Grudzień 2007 16:20

oto log z SDFix’a:

ComboFix 07-12-02.7 - Michal 2007-12-04 17:46:13.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.653 [GMT 1:00] Running from: C:\Documents and Settings\Michal\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-11-04 to 2007-12-04 ))))))))))))))))))))))))))))))) . 2007-12-02 18:23 . 2007-12-02 18:23 2007-12-02 13:31 . 2007-12-02 13:31 2007-11-26 17:24 . 2007-11-26 17:24 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-03 20:05 --------- d-----w C:\Program Files\niemiecki 2007-12-01 12:21 --------- d-----w C:\Documents and Settings\Michal\Dane aplikacji\Tlen.pl 2007-11-28 14:45 --------- d-----w C:\Program Files\Mozilla Thunderbird 2007-11-26 16:24 20 —h–w C:\Documents and Settings\All Users\Dane aplikacji\PKP_DLec.DAT 2007-11-14 20:05 --------- d-----w C:\Program Files\NAPI-PROJEKT 2007-11-11 19:48 --------- d-----w C:\Program Files\Leksykonia 2007-10-25 13:34 --------- d-----w C:\Program Files\Common Files\Adobe 2007-10-17 19:02 --------- d-----w C:\Program Files\Video mp3 Extractor 2007-10-15 11:52 --------- d-----w C:\Program Files\YouTube Video Downloader 2007-10-14 14:40 --------- d-----w C:\Program Files\Odkurzacz 2007-10-13 17:54 --------- d-----w C:\Documents and Settings\Michal\Dane aplikacji\Mobipocket 2007-10-06 20:25 --------- d–h--w C:\Program Files\InstallShield Installation Information 2007-10-06 20:25 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Avery . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 01:44] “Odkurzacz-MCD”=“C:\Program Files\Odkurzacz\odk_mcd.exe” [2007-03-02 21:38] “Creative Detector”=“C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe” [2004-12-02 17:23] “Creative MediaSource Go”=“C:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe” [2004-11-30 10:00] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2005-06-15 10:20 C:\WINDOWS\system32\nwiz.exe] “NvMediaCenter”=“RUNDLL32.exe” [2004-08-04 01:44 C:\WINDOWS\system32\rundll32.exe] “P17Helper”=“Rundll32 P17.dll” [] “UpdReg”=“C:\WINDOWS\UpdReg.EXE” [2000-05-11 00:00] “RemoteControl”=“C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe” [2004-11-02 20:24] “avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-09-06 11:06] “SunJavaUpdateSched”=“C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe” [2005-11-10 12:03] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 10:50] “CTRegRun”=“C:\WINDOWS\CTRegRun.EXE” [1999-10-11 02:00] “CTSysVol”=“C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe” [2005-02-15 15:10] “QuickTime Task”=“C:\Program Files\QuickTime\qttask.exe” [2007-08-27 16:19] [HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] “CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2004-08-04 01:44] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-03-22 18:34:06] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 06:05:26] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 19:05:56] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-08-27 16:21:08] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2006-03-22 13:20:55] R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys R3 P17;Sound Blaster Audigy;C:\WINDOWS\system32\drivers\P17.sys S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-04 18:21:09 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-04 18:22:04 - machine was rebooted C:\ComboFix2.txt … 2007-11-14 13:27 . — E O F —

w tym samym czasie utworzył się jeszcze jeden plik, który zamieszczam poniżej:

pozdrawiam, Michał

Gutek · 5 Grudzień 2007 16:35

gdzie ten log? Wyżej jest log zCombo.

mtsteddy · 5 Grudzień 2007 16:57

oj, mój błąd :oops:

to jest prawidłowy log:

SDFix: Version 1.114 Run by Michal on 2007-12-04 at 22:28 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-04 22:39:30 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden services & system hive … scanning hidden registry entries … [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c] “Order”=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,… scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] “C:\Program Files\Tlen.pl\tlen.exe”=“C:\Program Files\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl” “C:\Program Files\YouTube Video Downloader\YoutubeDownloader.exe”=“C:\Program Files\YouTube Video Downloader\YoutubeDownloader.exe:*:Enabled:YouTube Video Downloader” “C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe”=“C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe:*:Enabled:ALLPlayer V3.1” “C:\Program Files\Alwil Software\Avast4\ashAvast.exe”=“C:\Program Files\Alwil Software\Avast4\ashAvast.exe:*:Enabled:avast! Antivirus” [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Sun 11 Jun 2006 4,348 …SH. — “C:\Documents and Settings\All Users\DRM\DRMv1.bak” Mon 25 Jun 2007 6,794,752 …H. — “C:\Documents and Settings\Pawel\Pulpit~WRL2079.tmp” Mon 25 Jun 2007 6,794,752 …H. — “C:\Documents and Settings\Pawel\Pulpit~WRL2303.tmp” Sat 23 Jun 2007 3,123,200 …H. — “C:\Documents and Settings\Pawel\Pulpit~WRL3552.tmp” Mon 25 Jun 2007 6,793,728 …H. — “C:\Documents and Settings\Pawel\Pulpit~WRL3770.tmp” Sat 8 Sep 2007 857 …HR — “C:\Documents and Settings\Michal\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak” Finished!

Gutek · 5 Grudzień 2007 17:06

Już powinno być Ok

mtsteddy · 5 Grudzień 2007 17:14

wielkie dzięki za pomoc :mrgreen:

jednak mam jeszcze jedno pytanie, co zrobić z tymi plikami:

oraz z tym: C:\Program Files\Common Files\Microsoft Shared\Web Folders\ trz37.tmp

ponieważ tego nie ma w podanej lokalizacji, mimo, że próbowałem go usunąć przed wykonaniem “usuwania” programem SDFix.

Gutek · 5 Grudzień 2007 21:16

Prawoklik na Mój Komputer>>Przywracanie systemu>> wyłącz przywracanie systemu na wszystkich dyskach.

Użyj ATF-Cleaner - http://www.atribune.org/ccount/click.php?id=1 i oczyść nim TEMP

C:/Program Files/Common Files/Microsoft Shared/Web Folders i usuń w tym folderze wszystko co jest

mtsteddy · 5 Grudzień 2007 21:33

przeczyściłem TEMP tym programem. Jednak nadal mam pytanie co do tych plików w kwarantannie, co mam z nimi zrobić

pozdrawiam i dziękuję za cierpliwość

Gutek · 5 Grudzień 2007 21:39

Możesz je usnąć ręcznie z kwarantanny

mtsteddy · 6 Grudzień 2007 13:51

wielkie dzięki za pomoc i cierpliwość

pozdrawiam, Michał