Odinstaluj
Winamp ToolbarWylecz pamięci przenośne
Flash Disinfector lub sformatuj
Uruchom HijackThis

Do a system scan only

w okienku programu pokaże się log

zaznacz kratki przy podanych wpisach

klikasz
Fix checked- Kod: Zaznacz wszystko
F2 - REG:system.ini: UserInit=userinit.exe,EXPLORER.EXE
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [EXPLORER.EXE] EXPLORER.EXE
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Uruchom OTL

w oknie
Custom Scans/Fixes wklej:
:OTL
PRC - [2008-04-14 21:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
MOD - [2009-12-28 12:41:45 | 00,082,432 | RHS- | M] () -- C:\Documents and Settings\Mariusz\Ustawienia lokalne\Temp\cvasds0.dll
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O4 - HKCU..\Run: [cdoosoft] C:\Documents and Settings\Mariusz\Ustawienia lokalne\Temp\herss.exe ()
O4 - HKCU..\Run: [wsctf.exe] File not found
O4 - HKCU..\Run: [ares] C:\Program Files\Ares\Ares.exe File not found
O32 - AutoRun File - [2009-12-28 13:06:49 | 00,000,063 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
:Files
C:\Documents and Settings\Mariusz\Ustawienia lokalne\Temp\cvasds0.dll
C:\Documents and Settings\Mariusz\Ustawienia lokalne\Temp\herss.exe
C:\WINDOWS\system32\EXPLORER.EXE
C:\imghyva6.exe
D:\imghyva6.exe
E:\imghyva6.exe
:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
:Commands
[emptytemp]
[reboot]
Klikasz
Run Fix. Dajesz log z usuwania + nowy log z OTL