Witam!

Skanowalem system AdAware i SpySweeper. Nic nie pomaga. Wciaz bez przerwy wyskakuja denerwujace okienka przegladarki z reklamami. CWSShredder wykrywa CWS.Jksearch i niby go usuwa, ale gdy skanuje jeszcze raz to po raz kolejny go wykrywa.

A tak wyglada log:

Logfile of HijackThis v1.99.1
Scan saved at 16:23:13, on 2005–10–22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
D:\Programy\Eset\nod32kui.exe
D:\Programy\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
d:\Programy\Eset\nod32krn.exe
C:\WINDOWS\system32\svchost.exe
d:\Programy\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Programy\TotalCommander\TOTALCMD.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
D:\Programy\Gadu–Gadu\gg.exe
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
D:\Programy\HiJackThis\HijackThis.exe

R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 – HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 – Toolbar: Easy–WebPrint – {327C2873–E90D–4c37–AA9D–10AC9BABA46C} – d:\Programy\Canon\Easy–WebPrint\Toolband.dll
O4 – HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 – HKLM\..\Run: [nod32kui] "d:\Programy\Eset\nod32kui.exe" /WAITSERVICE
O4 – HKLM\..\Run: [VirtualCloneDrive] "d:\Programy\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 – HKCU\..\Run: [gg] "D:\Programy\Gadu–Gadu\gg.exe" /tray
O8 – Extra context menu item: Easy–WebPrint Add To Print List – res://d:\Programy\Canon\Easy–WebPrint\Resource.dll/RC_AddToList.html
O8 – Extra context menu item: Easy–WebPrint High Speed Print – res://d:\Programy\Canon\Easy–WebPrint\Resource.dll/RC_HSPrint.html
O8 – Extra context menu item: Easy–WebPrint Preview – res://d:\Programy\Canon\Easy–WebPrint\Resource.dll/RC_Preview.html
O8 – Extra context menu item: Easy–WebPrint Print – res://d:\Programy\Canon\Easy–WebPrint\Resource.dll/RC_Print.html
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 – Extra button: eBay – Homepage – {EF79EAC5–3452–4E02–B8BD–BA4C89F1AC7A} – d:\Programy\IrfanView\Ebay\Ebay.htm (file missing)
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119707905921
O16 – DPF: {92ECE6FA–AC2E–4042–BFAE–0C8608E52A43} (SignActivX Control) – https://www.bph.pl/pi/components/SignActivX.cab
O17 – HKLM\System\CCS\Services\Tcpip\..\{AE13CBE7–9CCA–4F82–BB60–E709FD13A796}: NameServer = 194.204.159.1,194.204.152.34,212.191.132.126,193.110.121.20
O20 – Winlogon Notify: policies – C:\WINDOWS\system32\gpl8l33u1.dll
O23 – Service: Ati HotKey Poller – ATI Technologies Inc. – C:\WINDOWS\system32\Ati2evxx.exe
O23 – Service: ATI Smart – Unknown owner – C:\WINDOWS\system32\ati2sgag.exe
O23 – Service: NOD32 Kernel Service (NOD32krn) – Unknown owner – d:\Programy\Eset\nod32krn.exe
O23 – Service: Webroot Spy Sweeper Engine (svcWRSSSDK) – Webroot Software, Inc. – d:\Programy\Webroot\Spy Sweeper\WRSSSDK.exe

Wazne jest chyba to ze wpisu:

O20 – Winlogon Notify: policies – C:\WINDOWS\system32\gpl8l33u1.dll

nie da sie usunac, a plik dll po kazdym uruchomieniu kompa zmienia swoja nazwe. To chyba tu jest pies pogrzebany. Jak sie z tym uporac?