Po uruchomieniu komputera wyskakuje mi takie okienko:
wie ktoś co zrobić żeby się nie pojawiało ?
To wygląda na jakiegoś wira. Łap link coś tu o tym pliku jest:
Coś masz namieszane w autostarcie lub w rejestrze.
Aby to wyłączyć zacznij od sprawdzenia czy w C:\Documents and Settings\ Twoja Nazwa użytkownika \Menu Start\Programy\Autostart nie ma jakiś skrótów (jeśli są wykasuj je).
Jeśli tam nic nie ma to kliknij na pasek Start\Uruchom…\wpisz: msconfig\przejdź na zakładkę: Uruchamianie i odznacz wszystkie pola.
Jak to nie pomoże to przeskanuj komputer czym sie tylko da… (możesz mieć wirusa, adware, spyware itp.)
na 100% masz jakiś plik dodany do autostartu. Trza pogrzebać i usunąć ten plik.
To jest log z hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:25:07, on 2008-01-01
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avast\aswUpdSv.exe
C:\Program Files\Avast\ashServ.exe
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Avast\ashDisp.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\regscan.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast\ashMaiSv.exe
C:\Program Files\Avast\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.live.com/sphome.aspx?mkt=pl-PL
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit C:\WINDOWS\System32\userinit.exe,userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM…\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM…\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM…\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM…\Run: [McAfee Guardian] “C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe” /SU
O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”
O4 - HKLM…\Run: [Google Desktop Search] “C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” /startup
O4 - HKLM…\Run: [avast!] C:\PROGRA~1\Avast\ashDisp.exe
O4 - HKLM…\Run: [CountrySelection] pctptt.exe
O4 - HKLM…\Run: [sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions
O4 - HKLM…\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU…\Run: [McAfee.InstantUpdate.Monitor] “C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe” /startmonitor
O4 - HKCU…\Run: [Neostrada] C:\Program Files\Neostrada TP\NeostradaTP.exe
O4 - HKCU…\Run: [Regscan] C:\WINDOWS\system32\regscan.exe
O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU…\Run: [Gadu-Gadu] “C:\Program Files\Gadu-Gadu\gg.exe” /tray
O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA LOKALNA’)
O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’)
O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘SYSTEM’)
O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User ‘Default user’)
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.c … 040510.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso … 8394485414
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan … asinst.cab
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Seekmo/ … 44eaad9a2e
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool 8) - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C5} (GameDesire Snooker) - http://67.15.101.3/g_bin/pl/snooker_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip…{A9C811D0-349D-432C-A3A6-ABEF89AC7A1E}: NameServer = 194.204.159.1 217.98.63.164
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast\ashWebSv.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: W2K PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\System32\pctspk.exe
–
End of file - 8345 bytes
Co mam dalej z tym zrobić żeby nie wyskakiwało to okienko ??
Wpisy
O4 - HKCU\..\Run: [Regscan] C:\WINDOWS\system32\regscan.exe
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} - http://static.zangocash.com/cab/Seekmo/ ... 44eaad9a2e
usuń HijackThisem >> Fix checked Pobierz Combofix Otwórz notatnik i wklej
File::
C:\WINDOWS\system32\regscan.exe
zapisz jako CFScript (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe
http://img.wklej.org/images/88953CFScri … iemoes.gif
na pytanie “1 or 2” - to wpisz 1 i naciśnij ENTER
Powinno rozpocząć się usuwanie
Daj log Combofixa zaraz po usuwaniu
potem usuń ręcznie folder C: \Qoobox
Wielkie dzięki, pomogło komunikat się już nie pojawia
A to log z Combofixa:
ComboFix 07-12-31.4 - Stanisław 2008-01-01 20:33:25.1 - NTFSx86
Running from: C:\Documents and Settings\Stanisław\Pulpit\ComboFix.exe
Command switches used :: C:\Documents and Settings\Stanisław\Pulpit\CFScript.txt
* Created a new restore point
FILE
C:\WINDOWS\system32\regscan.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\regscan.exe
.
((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.
2008-01-01 20:28 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 19:23 . 2008-01-01 19:23
2007-12-30 18:41 . 2007-12-30 22:12
2007-12-30 18:02 . 2007-12-30 22:12
2007-12-30 15:30 . 2007-12-30 22:12
2007-12-30 15:22 . 2007-12-30 22:12
2007-12-30 15:10 . 2007-12-30 22:12
2007-12-25 23:07 . 2007-12-25 23:07 25 --a------ C:\WINDOWS\mixerdef.ini
2007-12-19 13:46 . 2007-12-31 15:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-19 13:46 . 2007-12-19 13:46 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-11 21:22 . 2007-12-14 20:28
2007-12-11 18:59 . 2007-08-13 18:54 33,792 --a–c— C:\WINDOWS\system32\dllcache\custsat.dll
2007-12-11 17:14 . 2007-12-11 17:15
2007-12-04 02:33 . 2007-12-04 02:33 823,296 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2007-12-04 02:33 . 2007-12-04 02:33 823,296 --a------ C:\WINDOWS\system32\divx_xx07.dll
2007-12-04 02:33 . 2007-12-04 02:33 802,816 --a------ C:\WINDOWS\system32\divx_xx11.dll
2007-12-04 02:33 . 2007-12-04 02:33 682,496 --a------ C:\WINDOWS\system32\DivX.dll
2007-12-02 19:44 . 2006-10-04 15:06 1,197,294 -----c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-12-02 19:44 . 2006-10-04 15:06 764,868 -----c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-12-02 19:44 . 2006-10-04 15:06 217,118 -----c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-12-02 19:39 . 2007-12-02 19:39 23,392 --a------ C:\WINDOWS\system32\nscompat.tlb
2007-12-02 19:39 . 2007-12-02 19:39 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb
2007-12-02 19:32 . 2007-12-02 19:32
2007-12-02 19:13 . 2007-12-02 19:13
2007-12-02 19:13 . 2007-12-02 19:21
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 14:39 --------- d-----w C:\Program Files\Neostrada TP
2007-12-31 21:19 --------- d-----w C:\Documents and Settings\Stanisław\Dane aplikacji\Tlen.pl
2007-12-30 21:12 --------- d-----w C:\Program Files\BearShare
2007-12-24 15:41 --------- d-----w C:\Program Files\Gadu-Gadu
2007-12-21 10:16 --------- d-----w C:\Program Files\Dragon Ball Legend
2007-12-10 13:41 --------- d-----w C:\Program Files\Avast
2007-12-07 14:25 --------- d-----w C:\Program Files\DivX
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-30 13:44 --------- d-----w C:\Documents and Settings\Stanisław\Dane aplikacji\DivX
2007-11-30 13:26 --------- d-----w C:\Program Files\NimoCodec Pack
2007-11-29 22:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-11-29 22:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-11-29 22:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-11-29 22:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-11-29 22:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-29 18:34 --------- d-----w C:\Program Files\ffdshow
2007-11-29 18:12 --------- d-----w C:\Program Files\KC Softwares
2007-11-29 18:00 --------- d-----w C:\Program Files\Xvid
2007-11-29 16:30 892,928 ----a-w C:\WINDOWS\system32\iconv.dll
2007-11-29 16:29 9,216 ----a-w C:\WINDOWS\system32\cpuinf32.dll
2007-11-29 16:29 755,200 ----a-w C:\WINDOWS\system32\ir50_32.dll
2007-11-29 16:29 245,760 ----a-w C:\WINDOWS\system32\mplvpx.dll
2007-11-29 16:29 1,415,680 ----a-w C:\WINDOWS\system32\WMV9VCM.dll
2007-11-28 22:38 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2007-11-28 21:55 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-11-28 21:53 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-11-28 21:53 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-11-28 21:53 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-11-28 21:53 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-11-28 21:53 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-11-28 21:52 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-11-27 17:59 --------- d-----w C:\Documents and Settings\Stanisław\Dane aplikacji\Canon
2007-11-17 22:18 --------- d-----w C:\Program Files\Badongo
2007-11-17 21:28 --------- d-----w C:\Program Files\English Translator 3
2007-11-13 20:25 --------- d-----w C:\Program Files\MUGEN
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-09 12:23 --------- d-----w C:\Program Files\Activision
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-20 00:56 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-10-20 00:56 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-10-20 00:56 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2006-09-03 09:42 67,985 ----a-w C:\Documents and Settings\Stanisław\Function.zip
2006-09-03 09:42 67,985 ----a-w C:\Documents and Settings\Stanisław\Function.zip
2002-05-31 22:33 348,160 ----a-w C:\Documents and Settings\Stanisław\mss32.dll
2002-05-31 22:33 348,160 ----a-w C:\Documents and Settings\Stanisław\mss32.dll
1999-09-27 10:30 32,256 ----a-w C:\Documents and Settings\Stanisław\drvmgt.dll
1999-09-27 10:30 32,256 ----a-w C:\Documents and Settings\Stanisław\drvmgt.dll
2007-01-28 17:10 88 --sh–r C:\WINDOWS\system32\4AD25732B4.sys
2007-01-28 17:11 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“McAfee.InstantUpdate.Monitor”=“C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe” [2001-09-27 00:01 102468]
“Neostrada”=“C:\Program Files\Neostrada TP\NeostradaTP.exe” [2003-10-16 17:07 626688]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 08:44 15360]
“Gadu-Gadu”=“C:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 08:39 2119104]
“MSMSGS”=“C:\Program Files\Messenger\msmsgs.exe” [2004-10-13 17:24 1694208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“WooCnxMon”=“C:\PROGRA~1\NEOSTR~1\CnxMon.exe” [2003-10-16 17:07 24576]
“WOOWATCH”=“C:\PROGRA~1\NEOSTR~1\Watch.exe” [2003-10-16 17:07 20480]
“WOOTASKBARICON”=“C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe” [2003-10-16 17:07 53248]
“McAfee Guardian”=“C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe” [2001-09-27 02:00 142336]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe” [2007-09-25 00:11 132496]
“Google Desktop Search”=“C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe” [2007-08-17 19:07 1838592]
“avast!”=“C:\PROGRA~1\Avast\ashDisp.exe” [2007-12-04 14:00 79224]
“CountrySelection”=“pctptt.exe” [2000-01-06 00:41 68096 C:\WINDOWS\system32\pctptt.exe]
“Sony Ericsson PC Suite”=“C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” [2005-10-26 15:17 159744]
“C-Media Mixer”=“Mixer.exe” [2002-10-15 18:00 1818624 C:\WINDOWS\mixer.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\System32\CTFMON.EXE” [2004-08-04 08:44 15360]
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-05-05 20:33:58]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
“AppInit_DLLs”=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
R2 Devx;Devx;C:\WINDOWS\system32\drivers\Devx.sys [2001-09-06 13:21]
S3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys []
*Newly Created Service* - PROCEXP90
.
**************************************************************************
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 20:47:17
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-01 20:53:47
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 19:53:01
.
2007-12-14 19:37:46 — E O F —
Czy znasz ten folder
Nie znam, ale wydaje mi się że do tego foldera wyodrębniły się aktualizacje do IE 7, ponieważ mam w C:\ 3 foldery o takiej długiej nazwie z cyferkami i literami, niestety nie zapisałem do jakich folderów się wyodrębniały aktualizacje gdyż myślałem że są to foldery tymczasowe i się usuną.
Co proponujesz żebym zrobił ??
Za pomocą HijackThis usuń ten wpis:
Zgadza się potem otwórz notatnik i wklej
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
zapisz jako plik.reg >> wszystkie pliki >> scal z rejestrem >> restart
powstanie plik o takiej ikonie
w który dwa razy klikniesz potem restart