Wielkie dzięki za odpowiedź.

Skończyło się na instalacji nowego systemu. Związane to było z inwestycją planowaną od dawna.
Mogę teraz spać spokojnie :wink:

Zaznacz w HJ i usun:

R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = localhost
R3 – Default URLSearchHook is missing
O1 – Hosts: 64.91.255.87 www.dcsresearch.com
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~2.DLL,NewDotNetStartup –s
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZNxdm926
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O16 – DPF: {88D969C0–F192–11D4–A65F–0040963251E5} (XML DOM Document 4.0) – file://C:Documents and SettingsgelUstawienia lokalneTempEI40_msxml4.cab

gel:

Mój problem jest podobny, dotyczy jednak trojana svchost.exe

Cos mogla sie pod niego podczepic ale to juz innna kwestia
svchost.exe to nie proces trojana a systemowy
Moga rowiez wystepowac podobne nazwy np svhost itp
wtedy ten proces jest co najmniej podejrzany

Jakies konkretne oznaki działalnosci domniemanego trojana ??

Mój problem jest podobny, dotyczy jednak trojana svchost.exe. Dzidostwo nie daje się rozpoznać, czyli usunąć przez: avast! Antivirus, Ad–Aware SE Personal, a2 StartCenter, ats1, Spybot – Search & Destroy.

Jestem bezsilny, strony otwierają się za 5–10 razem, komp muli niemiłosiernie.

Oto mój log z hijackthis'a wygląda następująco:

Logfile of HijackThis v1.98.2
Scan saved at 10:31:52, on 2004–10–10
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
E:PROGRAMYOvernetOvernet.exe
C:Program FilesJavaj2re1.4.2_01injusched.exe
C:Program FilesQuickTimeqttask.exe
C:PROGRA~1ALWILS~1Avast4ashDisp.exe
C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe
C:Program FilesAnalog DevicesSoundMAXSmax4.exe
C:Program FilesWinampwinampa.exe
C:PROGRA~1DIETK~1DietK.exe
C:WINDOWSSystem32 undll32.exe
C:Program FilesMessengermsmsgs.exe
E:Gadu–Gadugg.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesMicrotekScanWizard 5ScannerFinder.exe
C:Program FilesAlwil SoftwareAvast4aswUpdSv.exe
C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
C:Program FilesWinZipWZQKPICK.EXE
C:Program FilesAlwil SoftwareAvast4ashServ.exe
C:WINDOWSsystem32driversKodakCCS.exe
C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe
C:WINDOWSSystem32 vsvc32.exe
C:Program FilesKerioPersonal Firewallpersfw.exe
C:Program FilesKazaa Lite K++Kazaa.kpp
C:WINDOWSSystem32ScsiAccess.EXE
C:Program FilesAnalog DevicesSoundMAXSMAgent.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesOpera7Opera.exe
E:PROGRAMYhijackHijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.onet.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page_bak = http://www.onet.pl/
R1 – HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = localhost
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – Default URLSearchHook is missing
O1 – Hosts: 64.91.255.87 www.dcsresearch.com
O2 – BHO: AcroIEHlprObj Class – {06849E9F–C8D7–4D59–B87D–784B7D6BE0B3} – C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx
O2 – BHO: (no name) – {53707962–6F74–2D53–2644–206D7942484F} – C:PROGRA~1SPYBOT~1SDHelper.dll
O2 – BHO: IeCatch2 Class – {A5366673–E8CA–11D3–9CD9–0090271D075B} – C:Program FilesFlashGetjccatch.dll
O3 – Toolbar: FlashGet Bar – {E0E899AB–F487–11D5–8D29–0050BA6940E3} – C:PROGRA~1FLASHGETfgiebar.dll
O3 – Toolbar: &Radio – {8E718888–423F–11D2–876E–00A0C9082467} – C:WINDOWSSystem32msdxm.ocx
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [Overnet] E:PROGRAMYOvernetOvernet.exe –t
O4 – HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavaj2re1.4.2_01injusched.exe
O4 – HKLM..Run: [NeroCheck] C:WINDOWSSystem32NeroCheck.exe
O4 – HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" –atboottime
O4 – HKLM..Run: [FineReader7NewsReaderPro] C:Program FilesABBYY FineReader 7.0 Professional EditionAbbyyNewsReader.exe
O4 – HKLM..Run: [avast!] C:PROGRA~1ALWILS~1Avast4ashDisp.exe
O4 – HKLM..Run: [ashMaiSv] C:PROGRA~1ALWILS~1Avast4ashmaisv.exe
O4 – HKLM..Run: [TDS3] C:Program FilesTDS3TDS–3.exe
O4 – HKLM..Run: [SoundMAXPnP] C:Program FilesAnalog DevicesSoundMAXSMax4PNP.exe
O4 – HKLM..Run: [SoundMAX] "C:Program FilesAnalog DevicesSoundMAXSmax4.exe" /tray
O4 – HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe
O4 – HKLM..Run: [DietK] C:PROGRA~1DIETK~1DietK.exe
O4 – HKLM..Run: [New.net Startup] rundll32 C:PROGRA~1NEWDOT~1NEWDOT~2.DLL,NewDotNetStartup –s
O4 – HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 – HKCU..Run: [Gadu–Gadu] "E:Gadu–Gadugg.exe" /tray
O4 – HKCU..Run: [CTFMON.EXE] C:WINDOWSSystem32ctfmon.exe
O4 – Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE
O4 – Global Startup: Microtek Scanner Finder.lnk = C:Program FilesMicrotekScanWizard 5ScannerFinder.exe
O4 – Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 – Global Startup: InterVideo WinCinema Manager.lnk = C:Program FilesInterVideoCommonBinWinCinemaMgr.exe
O4 – Global Startup: WinZip Quick Pick.lnk = C:Program FilesWinZipWZQKPICK.EXE
O8 – Extra context menu item: &Search – http://bar.mywebsearch.com/menusearch.html?p=ZNxdm926
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O8 – Extra context menu item: Ściągnij przy pomocy FlashGet'a – C:Program FilesFlashGetjc_link.htm
O8 – Extra context menu item: Ściągnij wszystko przy pomocy FlashGet'a – C:Program FilesFlashGetjc_all.htm
O9 – Extra button: (no name) – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra 'Tools' menuitem: Sun Java Console – {08B0E5C0–4FCB–11CF–AAA5–00401C608501} – C:WINDOWSSystem32msjava.dll
O9 – Extra button: Related – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra 'Tools' menuitem: Show &Related Links – {c95fe080–8f5d–11d2–a20b–00aa003c157a} – C:WINDOWSweb elated.htm
O9 – Extra button: FlashGet – {D6E814A0–E0C5–11d4–8D29–0050BA6940E3} – C:Program FilesFlashGetflashget.exe
O9 – Extra 'Tools' menuitem: &FlashGet – {D6E814A0–E0C5–11d4–8D29–0050BA6940E3} – C:Program FilesFlashGetflashget.exe
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O10 – Hijacked Internet access by New.Net
O12 – Plugin for .cbs: C:Program FilesOpera7PLUGINSNPFgc1.dll
O12 – Plugin for .exe: C:Program FilesOpera7PLUGINSNPFgc1.dll
O12 – Plugin for .png: C:Program FilesInternet ExplorerPLUGINS pqtplugin5.dll
O12 – Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O12 – Plugin for .zip: C:Program FilesOpera7PLUGINSNPFgc1.dll
O16 – DPF: {88D969C0–F192–11D4–A65F–0040963251E5} (XML DOM Document 4.0) – file://C:Documents and SettingsgelUstawienia lokalneTempEI40_msxml4.cab
O16 – DPF: {9A9307A0–7DA4–4DAF–B042–5009F29E09E1} (ActiveScan Installer Class) – http://www.pandasoftware.es/activescan/as/asinst.cab
O16 – DPF: {C2FCEF52–ACE9–11D3–BEBD–00105AA9B6AE} (Symantec RuFSI Registry Information Class) – http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 – DPF: {E7544C6C–CFD6–43EA–B4E9–360CEE20BDF7} (MainControl Class) – http://skaner.mks.com.pl/SkanerOnline.cab

teraz nie wiem co i jak usunąć. Nie wiem nawet jak uruchomić kompa w trybie awaryjnym.
Niestety w takich dziedzinach jestem jeszcze lajkonikiem.
Proszę o wyrozumiałość i pomoc.
Thx

:idea: Udało się w kolejnym skanie nie pojawił się!


Wielkie DZIĘKUJE ! :D

Wyłączyłeś proces w Tasku,
Wyszukałeś ukryte pliki/foldery i usunełeś :?:

Opis świadczy, źe jest to trojan, ale to nie zmienia faktu, źe po przeprowadzeniu update i ponownym usunięciu hijackiem za kaźdym razem po zresetowaniu komp. w skanie ukazuje się ponownie.

Co jest grane? Dlaczego nie idzie usunąć tego dziadostwa?

Po opis i przepis zajrzyj pod http://www.sophos.com.au/virusinfo/analyses/w32rbothr.html. Wejdź w zakładkę Advanced.

Wygląda na to, źe nie zainstalowałeś kilku łatek.

dzięki za szybką pomoc. Tak zrobiłem, po ponownym przeskanowaniu nie było juź "winusb".

Ale rano znowu przeskanowałem i taki efekt:

Logfile of HijackThis v1.97.7
Scan saved at 08:17:48, on 2004–09–10
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSSYSTEM32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSYSTEM32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32DVDRAMSV.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumFirewallPavFires.exe
C:Program FilesPanda SoftwarePanda Antivirus Platinumpavsrv51.exe
C:WINDOWSSystem32snmp.exe
C:PROGRA~1B'SCLI~1Win2KBSCLIP.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAVENGINE.EXE
C:Program FilesCyberLink DVD SolutionPowerDVDPDVDServ.exe
C:Program FilesD–Toolsdaemon.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:PROGRA~1NEOSTR~1CnxMon.exe
C:PROGRA~1NEOSTR~1TaskbarIcon.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:Program FilesGadu–Gadugg.exe
C:WINDOWSSystem32winusb.exe
C:Program FilesLabtec Wireless DesktopMulMouse.exe
C:Program FilesLabtec Wireless DesktopMagicKey.exe
C:Program FilesOpiekunOpiekunTray.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumpavProxy.exe
C:WINDOWSSystem32wuauclt.exe
C:DownloadHijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl/
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: (no name) – {D51C7E20–6800–4AE7–9702–64D9021BFEC1} – C:WINDOWSSystem32OpiekunIE.dll
O2 – BHO: (no name) – {FFFFFEF0–5B30–21D4–945D–000000000000} – C:PROGRA~1STARDO~1SDIEInt.dll
O3 – Toolbar: (no name) – {E0E899AB–F487–11D5–8D29–0050BA6940E3} – (no file)
O3 – Toolbar: Opiekun – {3453E1A9–9D23–4B6B–9222–4A4B5E1002C9} – C:WINDOWSSystem32OpiekunIE.dll
O3 – Toolbar: (no name) – {1E634697–3A49–47CA–89DF–C70E11F5C730} – (no file)
O3 – Toolbar: (no name) – {7A68AF7B–0CA7–40AC–94BF–6AF308B96A65} – (no file)
O4 – HKLM..Run: [B'sCLiP] C:PROGRA~1B'SCLI~1Win2KBSCLIP.exe
O4 – HKLM..Run: [CloneCDElbyCDFL] "C:Program FilesElaborate BytesCloneCDElbyCheck.exe" /L ElbyCDFL
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [RemoteControl] "C:Program FilesCyberLink DVD SolutionPowerDVDPDVDServ.exe"
O4 – HKLM..Run: [DAEMON Tools–1033] "C:Program FilesD–Toolsdaemon.exe" –lang 1033
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WOOTASKBARICON] C:PROGRA~1NEOSTR~1TaskbarIcon.exe
O4 – HKLM..Run: [SCANINICIO] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumInicio.exe"
O4 – HKLM..Run: [APVXDWIN] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE" /s
O4 – HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" –osboot
O4 – HKLM..Run: [saap] c:progra~12findm~1partnersaap.exe
O4 – HKLM..Run: [WIN USB 2.0] winusb.exe
O4 – HKLM..RunServices: [WIN USB 2.0] winusb.exe
O4 – HKCU..Run: [TClockEx] C:Program FilesTClockExTCLOCKEX.EXE
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [WIN USB 2.0] winusb.exe
O4 – Global Startup: Enable Labtec Wireless Desktop.lnk = C:Program FilesLabtec Wireless DesktopMulMouse.exe
O8 – Extra context menu item: Download with Star Downloader – C:Program FilesStarDownloadersdie.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O10 – Broken Internet access because of LSP provider 'olsp.dll' missing
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093555391171
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Ten pierun zaś siedzi...pomocy ?

Usun zarowno z loga jak i pozniej z dysku te pliki:

C:WINDOWSSystem32winusb.exe
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKLM..Run: [WIN USB 2.0] winusb.exe
O4 – HKLM..RunServices: [WIN USB 2.0] winusb.exe
O4 – HKCU..Run: [WIN USB 2.0] winusb.exe

szkoda, źe mało po słowiańsku, ale jeśli dobrze zrozumiałem jest to trojan.
Po przeskanowaniu pandą i ad–avarem nie wskazują na obecność wirusa, natomiast tak przedstawia się log z hijack–a:


Logfile of HijackThis v1.97.7
Scan saved at 22:35:22, on 2004–09–09
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSSYSTEM32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSYSTEM32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1B'SCLI~1Win2KBSCLIP.exe
C:Program FilesCyberLink DVD SolutionPowerDVDPDVDServ.exe
C:Program FilesD–Toolsdaemon.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
C:Program FilesThomsonSpeedTouch USBDragdiag.exe
C:WINDOWSSystem32DVDRAMSV.exe
C:PROGRA~1NEOSTR~1CnxMon.exe
C:PROGRA~1NEOSTR~1TaskbarIcon.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumFirewallPavFires.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE
C:Program FilesPanda SoftwarePanda Antivirus Platinumpavsrv51.exe
C:Program FilesCommon FilesRealUpdate_OB ealsched.exe
C:WINDOWSSystem32snmp.exe
C:WINDOWSSystem32winusb.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumAVENGINE.EXE
C:Program FilesGadu–Gadugg.exe
C:Program FilesLabtec Wireless DesktopMulMouse.exe
C:Program FilesOpiekunOpiekunTray.exe
C:Program FilesLabtec Wireless DesktopMagicKey.exe
C:Program FilesPanda SoftwarePanda Antivirus PlatinumpavProxy.exe
C:Program FilesInternet Exploreriexplore.exe
C:DownloadHijackThis.exe

R0 – HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.neostrada.pl
R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Neostrada TP
R0 – HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
R3 – URLSearchHook: Search Class – {08C06D61–F1F3–4799–86F8–BE1A89362C85} – C:PROGRA~1NEOSTR~1SEARCH~1.DLL
O2 – BHO: (no name) – {BDF3E430–B101–42AD–A544–FADC6B084872} – C:Program FilesNorton AntiVirusNavShExt.dll (file missing)
O2 – BHO: (no name) – {D51C7E20–6800–4AE7–9702–64D9021BFEC1} – C:WINDOWSSystem32OpiekunIE.dll
O2 – BHO: (no name) – {F4E04583–354E–4076–BE7D–ED6A80FD66DA} – C:WINDOWSSystem32msbe.dll
O2 – BHO: (no name) – {FFFFFEF0–5B30–21D4–945D–000000000000} – C:PROGRA~1STARDO~1SDIEInt.dll
O3 – Toolbar: (no name) – {E0E899AB–F487–11D5–8D29–0050BA6940E3} – (no file)
O3 – Toolbar: Opiekun – {3453E1A9–9D23–4B6B–9222–4A4B5E1002C9} – C:WINDOWSSystem32OpiekunIE.dll
O3 – Toolbar: (no name) – {1E634697–3A49–47CA–89DF–C70E11F5C730} – (no file)
O3 – Toolbar: (no name) – {7A68AF7B–0CA7–40AC–94BF–6AF308B96A65} – (no file)
O4 – HKLM..Run: [B'sCLiP] C:PROGRA~1B'SCLI~1Win2KBSCLIP.exe
O4 – HKLM..Run: [CloneCDElbyCDFL] "C:Program FilesElaborate BytesCloneCDElbyCheck.exe" /L ElbyCDFL
O4 – HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 – HKLM..Run: [RemoteControl] "C:Program FilesCyberLink DVD SolutionPowerDVDPDVDServ.exe"
O4 – HKLM..Run: [DAEMON Tools–1033] "C:Program FilesD–Toolsdaemon.exe" –lang 1033
O4 – HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 –k
O4 – HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 – HKLM..Run: [SpeedTouch USB Diagnostics] "C:Program FilesThomsonSpeedTouch USBDragdiag.exe" /icon
O4 – HKLM..Run: [WooCnxMon] C:PROGRA~1NEOSTR~1CnxMon.exe
O4 – HKLM..Run: [WOOWATCH] C:PROGRA~1NEOSTR~1Watch.exe
O4 – HKLM..Run: [WOOTASKBARICON] C:PROGRA~1NEOSTR~1TaskbarIcon.exe
O4 – HKLM..Run: [SCANINICIO] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumInicio.exe"
O4 – HKLM..Run: [APVXDWIN] "C:Program FilesPanda SoftwarePanda Antivirus PlatinumAPVXDWIN.EXE" /s
O4 – HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" –osboot
O4 – HKLM..Run: [saap] c:progra~12findm~1partnersaap.exe
O4 – HKLM..Run: [WIN USB 2.0] winusb.exe
O4 – HKLM..RunServices: [WIN USB 2.0] winusb.exe
O4 – HKCU..Run: [TClockEx] C:Program FilesTClockExTCLOCKEX.EXE
O4 – HKCU..Run: [Gadu–Gadu] "C:Program FilesGadu–Gadugg.exe" /tray
O4 – HKCU..Run: [WIN USB 2.0] winusb.exe
O4 – Global Startup: Enable Labtec Wireless Desktop.lnk = C:Program FilesLabtec Wireless DesktopMulMouse.exe
O8 – Extra context menu item: Download with Star Downloader – C:Program FilesStarDownloadersdie.htm
O8 – Extra context menu item: E&ksport do programu Microsoft Excel – res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000
O10 – Broken Internet access because of LSP provider 'olsp.dll' missing
O16 – DPF: {6414512B–B978–451D–A0D8–FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093555391171
O16 – DPF: {D27CDB6E–AE6D–11CF–96B8–444553540000} (Shockwave Flash Object) – http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 – HKLMSystemCCSServicesTcpip..{06EC02A0–F04B–4C52–8309–2568703219D5}: NameServer = 194.204.152.34 217.98.63.164


Proszę o pomoc w ewentualnym wskazaniu, co powinienem usunąć.

Pozdrawiam i liczę na wyrozumiałość Norbert.

Tu masz wszystko o tym pliku – http://www.freelists.org/archives/virusinfo/09–2004/msg00001.html

pewnie wir, ale odpal hijackthis i jakiegos dobrego AV + adaware i daj logi.