Wyskakujące okienko po uruchomieniu komputera

Po uruchomieniu komputera wyskakuje mi takie okienko:

bladps5.png

wie ktoś co zrobić żeby się nie pojawiało ?

To wygląda na jakiegoś wira. Łap link coś tu o tym pliku jest:

http://www.forum.idg.pl/lofiversion/ind … 29094.html

Coś masz namieszane w autostarcie lub w rejestrze.

Aby to wyłączyć zacznij od sprawdzenia czy w C:\Documents and Settings\ Twoja Nazwa użytkownika \Menu Start\Programy\Autostart nie ma jakiś skrótów (jeśli są wykasuj je).

Jeśli tam nic nie ma to kliknij na pasek Start\Uruchom…\wpisz: msconfig\przejdź na zakładkę: Uruchamianie i odznacz wszystkie pola.

Jak to nie pomoże to przeskanuj komputer czym sie tylko da… (możesz mieć wirusa, adware, spyware itp.)

na 100% masz jakiś plik dodany do autostartu. Trza pogrzebać i usunąć ten plik.

Wklej log z Hijackthis (na http://www.wklej.org tu daj link)

To jest log z hijackthis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:25:07, on 2008-01-01

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avast\aswUpdSv.exe

C:\Program Files\Avast\ashServ.exe

C:\PROGRA~1\NEOSTR~1\CnxMon.exe

C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\PROGRA~1\Avast\ashDisp.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\WINDOWS\Mixer.exe

C:\WINDOWS\system32\regscan.exe

C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\System32\pctspk.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Avast\ashMaiSv.exe

C:\Program Files\Avast\ashWebSv.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\Program Files\Neostrada TP\Watch.exe

C:\Program Files\Neostrada TP\NeostradaTP.exe

C:\Program Files\Neostrada TP\ComComp.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Gadu-Gadu\gg.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx?mkt=pl-PL

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit C:\WINDOWS\System32\userinit.exe,userinit.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe

O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe

O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe

O4 - HKLM…\Run: [McAfee Guardian] “C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe” /SU

O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”

O4 - HKLM…\Run: [Google Desktop Search] “C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” /startup

O4 - HKLM…\Run: [avast!] C:\PROGRA~1\Avast\ashDisp.exe

O4 - HKLM…\Run: [CountrySelection] pctptt.exe

O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions

O4 - HKLM…\Run: [C-Media Mixer] Mixer.exe /startup

O4 - HKCU…\Run: [McAfee.InstantUpdate.Monitor] “C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe” /startmonitor

O4 - HKCU…\Run: [Neostrada] C:\Program Files\Neostrada TP\NeostradaTP.exe

O4 - HKCU…\Run: [Regscan] C:\WINDOWS\system32\regscan.exe

O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray

O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background

O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)

O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)

O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)

O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)

O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c … 040510.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso … 8394485414

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab

O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Seekmo/ … 44eaad9a2e

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab

O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab

O17 - HKLM\System\CCS\Services\Tcpip…{A9C811D0-349D-432C-A3A6-ABEF89AC7A1E}: NameServer = 194.204.159.1 217.98.63.164

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast\ashWebSv.exe

O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: W2K PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\System32\pctspk.exe

End of file - 8345 bytes

Co mam dalej z tym zrobić żeby nie wyskakiwało to okienko ??

Wpisy

O4 - HKCU\..\Run: [Regscan] C:\WINDOWS\system32\regscan.exe

O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Seekmo/ ... 44eaad9a2e

usuń HijackThisem >> Fix checked Pobierz Combofix Otwórz notatnik i wklej

File::

C:\WINDOWS\system32\regscan.exe

zapisz jako CFScript (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

http://img.wklej.org/images/88953CFScri … iemoes.gif

na pytanie “1 or 2” - to wpisz 1 i naciśnij ENTER

Powinno rozpocząć się usuwanie

Daj log Combofixa zaraz po usuwaniu

potem usuń ręcznie folder C: \Qoobox

:slight_smile:

Wielkie dzięki, pomogło komunikat się już nie pojawia :slight_smile:

A to log z Combofixa:

ComboFix 07-12-31.4 - Stanisław 2008-01-01 20:33:25.1 - NTFSx86

Running from: C:\Documents and Settings\Stanisław\Pulpit\ComboFix.exe

Command switches used :: C:\Documents and Settings\Stanisław\Pulpit\CFScript.txt

* Created a new restore point

FILE

C:\WINDOWS\system32\regscan.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\system32\regscan.exe

.

((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))

.

2008-01-01 20:28 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2008-01-01 19:23 . 2008-01-01 19:23

2007-12-30 18:41 . 2007-12-30 22:12

2007-12-30 18:02 . 2007-12-30 22:12

2007-12-30 15:30 . 2007-12-30 22:12

2007-12-30 15:22 . 2007-12-30 22:12

2007-12-30 15:10 . 2007-12-30 22:12

2007-12-25 23:07 . 2007-12-25 23:07 25 --a------ C:\WINDOWS\mixerdef.ini

2007-12-19 13:46 . 2007-12-31 15:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-19 13:46 . 2007-12-19 13:46 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-11 21:22 . 2007-12-14 20:28

2007-12-11 18:59 . 2007-08-13 18:54 33,792 --a–c— C:\WINDOWS\system32\dllcache\custsat.dll

2007-12-11 17:14 . 2007-12-11 17:15

2007-12-04 02:33 . 2007-12-04 02:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll

2007-12-04 02:33 . 2007-12-04 02:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll

2007-12-04 02:33 . 2007-12-04 02:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll

2007-12-04 02:33 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll

2007-12-02 19:44 . 2006-10-04 15:06 1,197,294 -----c— C:\WINDOWS\system32\dllcache\sysmain.sdb

2007-12-02 19:44 . 2006-10-04 15:06 764,868 -----c— C:\WINDOWS\system32\dllcache\apph_sp.sdb

2007-12-02 19:44 . 2006-10-04 15:06 217,118 -----c— C:\WINDOWS\system32\dllcache\apphelp.sdb

2007-12-02 19:39 . 2007-12-02 19:39 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb

2007-12-02 19:39 . 2007-12-02 19:39 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb

2007-12-02 19:32 . 2007-12-02 19:32

2007-12-02 19:13 . 2007-12-02 19:13

2007-12-02 19:13 . 2007-12-02 19:21

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-01 14:39 --------- d-----w C:\Program Files\Neostrada TP

2007-12-31 21:19 --------- d-----w C:\Documents and Settings\Stanisław\Dane aplikacji\Tlen.pl

2007-12-30 21:12 --------- d-----w C:\Program Files\BearShare

2007-12-24 15:41 --------- d-----w C:\Program Files\Gadu-Gadu

2007-12-21 10:16 --------- d-----w C:\Program Files\Dragon Ball Legend

2007-12-10 13:41 --------- d-----w C:\Program Files\Avast

2007-12-07 14:25 --------- d-----w C:\Program Files\DivX

2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys

2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys

2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys

2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys

2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys

2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe

2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr

2007-11-30 13:44 --------- d-----w C:\Documents and Settings\Stanisław\Dane aplikacji\DivX

2007-11-30 13:26 --------- d-----w C:\Program Files\NimoCodec Pack

2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe

2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll

2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll

2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll

2007-11-29 18:34 --------- d-----w C:\Program Files\ffdshow

2007-11-29 18:12 --------- d-----w C:\Program Files\KC Softwares

2007-11-29 18:00 --------- d-----w C:\Program Files\Xvid

2007-11-29 16:30 892,928 ----a-w C:\WINDOWS\system32\iconv.dll

2007-11-29 16:29 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll

2007-11-29 16:29 755,200 ----a-w C:\WINDOWS\system32\ir50_32.dll

2007-11-29 16:29 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll

2007-11-29 16:29 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll

2007-11-28 22:38 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll

2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe

2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll

2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll

2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll

2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll

2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll

2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll

2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll

2007-11-27 17:59 --------- d-----w C:\Documents and Settings\Stanisław\Dane aplikacji\Canon

2007-11-17 22:18 --------- d-----w C:\Program Files\Badongo

2007-11-17 21:28 --------- d-----w C:\Program Files\English Translator 3

2007-11-13 20:25 --------- d-----w C:\Program Files\MUGEN

2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-11-09 12:23 --------- d-----w C:\Program Files\Activision

2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll

2007-10-20 00:56 129,784 ------w C:\WINDOWS\system32\pxafs.dll

2007-10-20 00:56 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

2007-10-20 00:56 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

2006-09-03 09:42 67,985 ----a-w C:\Documents and Settings\Stanisław\Function.zip

2006-09-03 09:42 67,985 ----a-w C:\Documents and Settings\Stanisław\Function.zip

2002-05-31 22:33 348,160 ----a-w C:\Documents and Settings\Stanisław\mss32.dll

2002-05-31 22:33 348,160 ----a-w C:\Documents and Settings\Stanisław\mss32.dll

1999-09-27 10:30 32,256 ----a-w C:\Documents and Settings\Stanisław\drvmgt.dll

1999-09-27 10:30 32,256 ----a-w C:\Documents and Settings\Stanisław\drvmgt.dll

2007-01-28 17:10 88 --sh–r C:\WINDOWS\system32\4AD25732B4.sys

2007-01-28 17:11 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“McAfee.InstantUpdate.Monitor”=“C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe” [2001-09-27 00:01 102468]

“Neostrada”=“C:\Program Files\Neostrada TP\NeostradaTP.exe” [2003-10-16 17:07 626688]

“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 08:44 15360]

“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 08:39 2119104]

“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

“WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 17:07 24576]

“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 17:07 20480]

“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 17:07 53248]

“McAfee Guardian”=“C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe” [2001-09-27 02:00 142336]

“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 00:11 132496]

“Google Desktop Search”=“C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” [2007-08-17 19:07 1838592]

“avast!”=“C:\PROGRA~1\Avast\ashDisp.exe” [2007-12-04 14:00 79224]

“CountrySelection”=“pctptt.exe” [2000-01-06 00:41 68096 C:\WINDOWS\system32\pctptt.exe]

“Sony Ericsson PC Suite”=“C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” [2005-10-26 15:17 159744]

“C-Media Mixer”=“Mixer.exe” [2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe]

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

“CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\

DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-05-05 20:33:58]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

“AppInit_DLLs”=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

R2 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 13:21]

S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []

S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys []

*Newly Created Service* - PROCEXP90

.

**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-01 20:47:17

Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-01-01 20:53:47

C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 19:53:01

.

2007-12-14 19:37:46 — E O F —

Czy znasz ten folder

:slight_smile:

Nie znam, ale wydaje mi się że do tego foldera wyodrębniły się aktualizacje do IE 7, ponieważ mam w C:\ 3 foldery o takiej długiej nazwie z cyferkami i literami, niestety nie zapisałem do jakich folderów się wyodrębniały aktualizacje gdyż myślałem że są to foldery tymczasowe i się usuną.

Co proponujesz żebym zrobił ??

Za pomocą HijackThis usuń ten wpis:

Zgadza się potem otwórz notatnik i wklej

Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"Shell"="Explorer.exe"

"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

zapisz jako plik.reg >> wszystkie pliki >> scal z rejestrem >> restart

b57f17008275c957m.jpg

powstanie plik o takiej ikonie

062aec4c9b51c033m.jpg

w który dwa razy klikniesz potem restart

:slight_smile: