Logi - Podejrzenie malware

witam
Moze mi ktos pomoc ? Wyczyscilem kompa programem Spybot - Search & Destroy ale boje sie ze cos zostalo ... Moze mi ktos pomoc i sprawdzic tego loga .

Logfile of HijackThis v1.99.1
Scan saved at 22:03:05, on 2008-04-07
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
H:\windows\System32\smss.exe
H:\windows\system32\csrss.exe
H:\windows\system32\winlogon.exe
H:\windows\system32\services.exe
H:\windows\system32\lsass.exe
H:\windows\system32\svchost.exe
H:\windows\system32\svchost.exe
H:\windows\System32\svchost.exe
H:\windows\system32\svchost.exe
H:\windows\system32\svchost.exe
H:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
H:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
H:\windows\Explorer.EXE
H:\Program Files\Common Files\Symantec Shared\ccProxy.exe
H:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
H:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
H:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
H:\windows\system32\spoolsv.exe
H:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
H:\WINDOWS\System32\FTRTSVC.exe
H:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
H:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
H:\windows\system32\nvsvc32.exe
H:\Program Files\CyberLink\Shared Files\RichVideo.exe
H:\WINDOWS\system32\wdfmgr.exe
H:\WINDOWS\system32\wbem\wmiapsrv.exe
H:\windows\System32\alg.exe
H:\windows\system32\wuauclt.exe
H:\windows\RTHDCPL.EXE
H:\Program Files\VDOTool\TBPanel.exe
H:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
H:\Program Files\Nero\Nero 7\InCD\InCD.exe
H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
H:\windows\system32\RunDLL32.exe
H:\windows\System32\Rundll32.exe
H:\Program Files\Common Files\Symantec Shared\ccApp.exe
H:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
H:\windows\system32\ctfmon.exe
H:\Program Files\Winamp Remote\bin\OrbTray.exe
H:\Program Files\Gadu-Gadu\gg.exe
H:\Program Files\Skype\Phone\Skype.exe
H:\Program Files\DAEMON Tools Lite\daemon.exe
H:\Program Files\Messenger\msmsgs.exe
H:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
H:\Program Files\Kalendarz XP\Kalendarz.exe
h:\program files\winamp toolbar\WinampTbServer.exe
H:\Program Files\Skype\Plugin Manager\skypePM.exe
H:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
H:\Program Files\neostrada tp\neostradatp.exe
H:\Program Files\neostrada tp\ComComp.exe
H:\PROGRA~1\NEOSTR~1\Toaster.exe
H:\PROGRA~1\NEOSTR~1\Inactivity.exe
H:\PROGRA~1\NEOSTR~1\PollingModule.exe
H:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
H:\Program Files\neostrada tp\Watch.exe
H:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe
H:\Program Files\Mozilla Firefox\firefox.exe
H:\Documents and Settings\Administrator\Pulpit\HijackThis.exe
H:\Program Files\Kalendarz XP\lame.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = neostrada tp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - H:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11635C4A-ECC7-4ED7-A172-FA5D54D3E3EE} - H:\WINDOWS\system32\xxyvWnmn.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - H:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {8E95C1F8-6899-4B6B-B249-2C7AE1EF9ECB} - (no file)
O2 - BHO: MySidesearch Search Assistant - {9506910A-0F94-4ea1-B567-7070428B8B2B} - H:\WINDOWS\system32\mysidesearch_sidebar.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - H:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - H:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar2.dll
O2 - BHO: cpmsky.biz browser optimizer - {BCA95E31-1FBF-4F84-8F23-1BA653007A1E} - H:\WINDOWS\system32\cpmsky.dll
O2 - BHO: (no name) - {C7554421-C273-4E8A-BE0D-72130BC05B87} - H:\windows\system32\pmnljGxv.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - H:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - H:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - H:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Gainward] H:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RemoteControl] "H:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "H:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] H:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] H:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [ISUSPM Startup] H:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WOOWATCH] H:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] H:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [PostSetupCheck] H:\windows\System32\Rundll32.exe "H:\WINDOWS\system32\cpmsky.dll" DllStart
O4 - HKLM\..\Run: [outlook] H:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [Host Process] H:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [bm(1)] "H:\Program Files\Common Files\AntivirusForAll\bm.exe" dm=http://antivirusforall.com ad=http://antivirusforall.com sd=http://ykeeper.antivirusforall.com
O4 - HKLM\..\Run: [ptask] H:\Program Files\AntivirusForAll\ptask.exe
O4 - HKLM\..\Run: [ccApp] "H:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [0C51337463767D252F51] Rundll32.exe "H:\WINDOWS\system32\auwrkcgs.dll",s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] H:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [BMb7eb310e] Rundll32.exe "H:\WINDOWS\system32\rmchoexd.dll",s
O4 - HKLM\..\Run: [000000af] rundll32.exe "H:\windows\system32\bhvhmbeh.dll",b
O4 - HKLM\..\Run: [webHancer Agent] H:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [runner1] H:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\RunOnce: [SpybotSnD] "H:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [Trojan Remover] "H:\Program Files\Trojan Remover\RMVTRJAN.EXE" /restart
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "H:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [CTFMON.EXE] H:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [Orb] "H:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "H:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Skype] "H:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DAEMON Tools Lite] "H:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [nvcoi] H:\Program Files\nvcoi\nvcoi.exe
O4 - HKCU\..\Run: [Liai] "H:\DOCUME~1\ADMINI~1\DANEAP~1\SCURIT~1\fast.exe" -vt yazb
O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] H:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD2221] cmd /c del "H:\WINDOWS\system32\bhvhmbeh.dll_old"
O4 - Global Startup: Kalendarz XP.lnk = H:\Program Files\Kalendarz XP\Kalendarz.exe
O8 - Extra context menu item: &Winamp Search - H:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - H:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - H:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O17 - HKLM\System\CCS\Services\Tcpip\..\{1FF60DE8-9BE8-4930-BCEF-E3DBADDFFDE0}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{763C6166-57C5-425B-A57F-F3CADA5205D9}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{84C9EF5A-AB4F-485A-956A-AA6B23F747C5}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{1FF60DE8-9BE8-4930-BCEF-E3DBADDFFDE0}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{1FF60DE8-9BE8-4930-BCEF-E3DBADDFFDE0}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - H:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - H:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - H:\windows\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: xxyvWnmn - H:\windows\SYSTEM32\xxyvWnmn.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - H:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - H:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - H:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - H:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - H:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - H:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - H:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - H:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - H:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - H:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - H:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\windows\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - H:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - H:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - H:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - H:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - H:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Odpal hjt i wybierz opcje do a system scan only i zrobi Ci się log i zaznacz kwadrat obok poniższych wpisów i daj fix

O2 - BHO: (no name) - {11635C4A-ECC7-4ED7-A172-FA5D54D3E3EE} - H:\WINDOWS\system32\xxyvWnmn.dll
O2 - BHO: (no name) - {8E95C1F8-6899-4B6B-B249-2C7AE1EF9ECB} - (no file)
O2 - BHO: MySidesearch Search Assistant - {9506910A-0F94-4ea1-B567-7070428B8B2B} - H:\WINDOWS\system32\mysidesearch_sidebar.dll

O3 - Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - (no file)
O4 - HKLM\..\Run: [PostSetupCheck] H:\windows\System32\Rundll32.exe "H:\WINDOWS\system32\cpmsky.dll" DllStart
O2 - BHO: cpmsky.biz browser optimizer - {BCA95E31-1FBF-4F84-8F23-1BA653007A1E} - H:\WINDOWS\system32\cpmsky.dll
O4 - HKLM\..\Run: [outlook] H:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [webHancer Agent] H:\Program Files\webHancer\Programs\whagent.exe
O8 - Extra context menu item: &Winamp Search - H:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - H:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - H:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer

po wykonaniu tego koniecznie daj loga z combofixa

Nie!

Wpisów O10 się nigdy nie usuwa poprzez HiJackThis! Kończy się to utratą Internetu.

Otwórz Notatnik i wklej:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

Plik => Zapisz jako => Zmień rozszerzenie z .txt na Wszystkie pliki => Następnie zapisz pod nazwą FIX.REG.

Uruchom utworzony plik FIX.REG, a później potwierdź dodanie do Rejestru i zresetuj komputer.

Pobierz SDFix.

1. Naciśnij dwa razy na plik SDFix.exe. Program wypakuje się na dysk systemowy – C:\SDFix
2. Uruchom ponownie komputer i wejdź do Trybu Awaryjnego (Przed bootowaniem Windowsa naciśnij F8).
3. Wejdź do folderu który utworzył SDFix i kliknij dwa razy na plik RunThis.bat
4. Naciśnij Y by narzędzie rozpoczęło proces usuwania szkodników.
5. Po zakończeniu usuwania program poprosi o wciśnięcie dowolnego klawisza na klawiaturze (Any Key). Po naciśnięciu komputer zostanie uruchomiony ponownie.
6. Po restarcie aplikacja uruchomi się ponownie. Kiedy w okienku pojawi się Finished, naciśnij dowolny klawisz, aby program zakończył pracę.
7. Na koniec pokaż log z programu znajdujący się w lokalizacji – C:\SDFix\Report.txt

Po pracy pokaż logi z: HiJack This + Silent Runners + ComboFix + SDFix.

Maciej13 ma rację przepraszam Cię że wskazałem Ci usunąć te wpisy.