Pomcy!-sprawdzenie loga

Jestem nowy na tym forum
Proszę o sprawdzenie poniższego loga.Kompa strasznie muli.Z gówy wielkie dzięki

Kod:

Logfile of HijackThis v1.99.1
Scan saved at 15:49:40, on 2006-10-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:Program FilesMozilla Firefoxfirefox.exe
C:Program FilesWinRARWinRAR.exe
C:DOCUME~1DOMINI~1USTAWI~1TempRar$EX00.391HijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre1.5.0_08inssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:Program FilesYahoo!CompanionInstallscpnyt.dll
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [avast!] D:programsAvast4ashDisp.exe
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre1.5.0_08injusched.exe"
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [ABBYY Community Agent] C:PROGRA~1SPRINT~1.0OFSprintCAgent.exe
O4 - HKLM..Run: [Ashampoo FireWall] "C:Program FilesAshampooAshampoo FireWallFireWall.exe" -TRAY
O4 - HKLM..Run: [Ashampoo AntiSpyWare Guard] C:Program FilesAshampooAshampoo AntiSpyWareAntiSpyWareGuard.exe
O4 - HKCU..Run: [Gadu-Gadu] "C:Program FilesGadu-Gadugg.exe" /tray
O4 - HKCU..Run: [SpybotSD TeaTimer] C:Program FilesSpybot - Search & DestroyTeaTimer.exe
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O10 - Unknown file in Winsock LSP: c:program filesashampooashampoo firewallspi.dll
O10 - Unknown file in Winsock LSP: c:program filesashampooashampoo firewallspi.dll
O10 - Unknown file in Winsock LSP: c:program filesashampooashampoo firewallspi.dll
O10 - Unknown file in Winsock LSP: c:program filesashampooashampoo firewallspi.dll
O10 - Unknown file in Winsock LSP: c:program filesashampooashampoo firewallspi.dll
O10 - Unknown file in Winsock LSP: c:program filesashampooashampoo firewallspi.dll
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5A09E43F-A0A7-4ABF-AF80-11367CF1DC8F} - http://mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:programsAvast4aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - D:programsAvast4ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - D:programsAvast4ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - D:programsAvast4ashWebSv.exe" /service (file missing)
O23 - Service: AVK Service (AVKService) - Unknown owner - C:Program FilesG DATAAntiVirenKit InternetSecurityAVKAVKService.exe (file missing)
O23 - Service: Strażnik AVK (AVKWCtl) - Unknown owner - C:Program FilesG DATAAntiVirenKit InternetSecurityAVKAVKWCtl.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:Program Filesewido anti-spyware 4.0guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:Program FilesCommon FilesInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32
vsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:Program FilesCommon FilesPCSuiteServicesServiceLayer.exe

Aha sorki zapomniałem dodać,że log był robiony a trybie awaryjnym z obsługą sieci (bo w trybie normalnym nie moge odpacić kompa).

Log czysty. Prosułbym o dodanie jeszcze jednego loga.

Zrób loga z Silent Runners. Ściągasz go na kompa, uruchamiasz i dajesz no i czekasz na komunikat done. Wklejasz zawartośc na forum

http://www.silentrunners.org/Silent%20Runners.vbs

Ściągnij to i zrób scan

https://www.instalki.pl/programy/downlo ... yware.html

Hmm ale skoro jest w trybie awaryjnym to on chyba zaduzo tam nie pokaze

Hmm ale skoro jest w trybie awaryjnym to on chyba zaduzo tam nie pokaze

Właśnie w trybie awaryjnym wirusy mają ograniczone możliwości krycia

Hmm ale skoro jest w trybie awaryjnym to on chyba zaduzo tam nie pokaze

Właśnie w trybie awaryjnym wirusy mają ograniczone możliwości krycia

Mozliwe

Ok jakoś mi sie udało odpalić kompa w trybie normalnym.Daje loga z Silent Runners.Pragram Ewido anti-spyware wykrywa obce obiekty i niby je usuwa,ale po chwili dzieje sie to samo(muli kompa).Próbowałem skanować jeszcze raz znowu je wykrył.Są w C:Documents and SettingsNazwa mojego profiluCookies

"Silent Runners.vbs", revision 49, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCUSoftwareMicrosoftWindowsCurrentVersionRun {++}
"Gadu-Gadu" = ""C:Program FilesGadu-Gadugg.exe" /tray" ["Gadu-Gadu Sp. z oo"]
"SpybotSD TeaTimer" = "C:Program FilesSpybot - Search & DestroyTeaTimer.exe" ["Safer Networking Limited"]
"MSMSGS" = ""C:Program FilesMessengermsmsgs.exe" /background" [MS]
"Skype" = ""C:Program FilesSkypePhoneSkype.exe" /nosplash /minimized" ["Skype Technologies S.A."]

HKLMSoftwareMicrosoftWindowsCurrentVersionRun {++}
"NvCplDaemon" = "RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"avast!" = "D:programsAvast4ashDisp.exe" [null data]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
"SunJavaUpdateSched" = ""C:Program FilesJavajre1.5.0_08injusched.exe"" ["Sun Microsystems, Inc."]
"NvMediaCenter" = "RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit" [MS]
"ABBYY Community Agent" = "C:PROGRA~1SPRINT~1.0OFSprintCAgent.exe" ["ABBYY (BIT Software)"]
"Ashampoo FireWall" = ""C:Program FilesAshampooAshampoo FireWallFireWall.exe" -TRAY" [null data]
"Ashampoo AntiSpyWare Guard" = "C:Program FilesAshampooAshampoo AntiSpyWareAntiSpyWareGuard.exe" [null data]

HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects
{02478D38-C3F9-4EFB-9B51-7695ECA05670}(Default) = (no title provided)
{HKLM...CLSID} = "Yahoo! Toolbar Helper"
InProcServer32(Default) = "C:Program FilesYahoo!CompanionInstallscpnyt.dll" ["Yahoo! Inc."]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}(Default) = (no title provided)
{HKLM...CLSID} = "AcroIEHlprObj Class"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}(Default) = (no title provided)
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "C:PROGRA~1SPYBOT~1SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}(Default) = (no title provided)
{HKLM...CLSID} = "SSVHelper Class"
InProcServer32(Default) = "C:Program FilesJavajre1.5.0_08inssv.dll" ["Sun Microsystems, Inc."]

HKLMSoftwareMicrosoftWindowsCurrentVersionShell ExtensionsApproved
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
{HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
InProcServer32(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
{HKLM...CLSID} = "HyperTerminal Icon Ext"
InProcServer32(Default) = "C:WINDOWSSystem32hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
{HKLM...CLSID} = "DesktopContext Class"
InProcServer32(Default) = "C:WINDOWSsystem32
vcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
{HKLM...CLSID} = "Desktop Explorer"
InProcServer32(Default) = "C:WINDOWSSystem32
vshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
{HKLM...CLSID} = (no title provided)
InProcServer32(Default) = "C:WINDOWSSystem32
vshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
{HKLM...CLSID} = "nView Desktop Context Menu"
InProcServer32(Default) = "C:WINDOWSSystem32
vshell.dll" ["NVIDIA Corporation"]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
{HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook"
InProcServer32(Default) = "C:PROGRA~1MICROS~2OfficeOLKFSTUB.DLL" [MS]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
{HKLM...CLSID} = "avast"
InProcServer32(Default) = "D:programsAvast4ashShell.dll" ["ALWIL Software"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]
"{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "PhoneBrowser"
{HKLM...CLSID} = "Nokia Phone Browser"
InProcServer32(Default) = "C:Program FilesNokiaNokia PC Suite 6PhoneBrowser.dll" ["Nokia"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
{HKLM...CLSID} = "NVIDIA CPL Extension"
InProcServer32(Default) = "C:WINDOWSSystem32
vcpl.dll" ["NVIDIA Corporation"]
"{A155339D-CCCD-4714-85EB-3754B804C9DF}" = "a-squared Free Context Menu Shell Extension"
{HKLM...CLSID} = "a-squared Free Context Menu"
InProcServer32(Default) = "C:PROGRA~1A-SQUA~1A2FREE~1.DLL" ["Emsi Software GmbH"]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
{HKLM...CLSID} = "Portable Media Devices Menu"
InProcServer32(Default) = "C:WINDOWSsystem32Audiodev.dll" [MS]

HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
<<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
{HKLM...CLSID} = "CShellExecuteHookImpl Object"
InProcServer32(Default) = "C:Program Filesewido anti-spyware 4.0shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLMSystemCurrentControlSetControlSession Manager
<<!>> "BootExecute" = "autocheck autochk *"| [file not found]

HKLMSoftwareClassesFoldershellexColumnHandlers
{F9DB5320-233E-11D1-9F84-707F02C10627}(Default) = "PDF Column Info"
{HKLM...CLSID} = "PDF Shell Extension"
InProcServer32(Default) = "C:Program FilesAdobeAcrobat 7.0ActiveXPDFShell.dll" ["Adobe Systems, Inc."]

HKLMSoftwareClasses*shellexContextMenuHandlers
avast(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
{HKLM...CLSID} = "avast"
InProcServer32(Default) = "D:programsAvast4ashShell.dll" ["ALWIL Software"]
ewido anti-spyware(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
{HKLM...CLSID} = "CContextScan Object"
InProcServer32(Default) = "C:Program Filesewido anti-spyware 4.0context.dll" ["Anti-Malware Development a.s."]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]

HKLMSoftwareClassesDirectoryshellexContextMenuHandlers
ewido anti-spyware(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
{HKLM...CLSID} = "CContextScan Object"
InProcServer32(Default) = "C:Program Filesewido anti-spyware 4.0context.dll" ["Anti-Malware Development a.s."]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]

HKLMSoftwareClassesFoldershellexContextMenuHandlers
a2FreeContMenu(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"
{HKLM...CLSID} = "a-squared Free Context Menu"
InProcServer32(Default) = "C:PROGRA~1A-SQUA~1A2FREE~1.DLL" ["Emsi Software GmbH"]
avast(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
{HKLM...CLSID} = "avast"
InProcServer32(Default) = "D:programsAvast4ashShell.dll" ["ALWIL Software"]
WinRAR(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
{HKLM...CLSID} = "WinRAR"
InProcServer32(Default) = "C:Program FilesWinRAR arext.dll" [null data]

HKLMSoftwareClassesAllFilesystemObjectsshellexContextMenuHandlers
a2FreeContMenu(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"
{HKLM...CLSID} = "a-squared Free Context Menu"
InProcServer32(Default) = "C:PROGRA~1A-SQUA~1A2FREE~1.DLL" ["Emsi Software GmbH"]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCUSoftwareMicrosoftInternet ExplorerDesktopGeneral
"Wallpaper" = "C:WINDOWSsystem32configsystemprofileUstawienia lokalneDane aplikacjiMicrosoftWallpaper1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCUControl PanelDesktop
"Wallpaper" = "C:Documents and SettingsDominik aUstawienia lokalneDane aplikacjiMicrosoftWallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCUControl PanelDesktop
"SCRNSAVE.EXE" = "C:WINDOWSSystem32logon.scr" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLMSystemCurrentControlSetServicesWinsock2ParametersNameSpace_Catalog5Catalog_Entries {++}
000000000001LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]
000000000002LibraryPath = "%SystemRoot%System32winrnr.dll" [MS]
000000000003LibraryPath = "%SystemRoot%System32mswsock.dll" [MS]

Transport Service Providers

HKLMSystemCurrentControlSetServicesWinsock2ParametersProtocol_Catalog9Catalog_Entries {++}
0000000000##PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:Program FilesAshampooAshampoo FireWallspi.dll [null data], 01 - 05, 15
%SystemRoot%system32mswsock.dll [MS], 06 - 14, 16 - 18
%SystemRoot%system32 svpsp.dll [MS], 19 - 20


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCUSoftwareMicrosoftInternet ExplorerToolbarWebBrowser
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"
{HKLM...CLSID} = "Yahoo! Toolbar"
InProcServer32(Default) = "C:Program FilesYahoo!CompanionInstallscpnyt.dll" ["Yahoo! Inc."]

HKLMSoftwareMicrosoftInternet ExplorerToolbar
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}" = (no title provided)
{HKLM...CLSID} = "Yahoo! Toolbar"
InProcServer32(Default) = "C:Program FilesYahoo!CompanionInstallscpnyt.dll" ["Yahoo! Inc."]

Extensions (Tools menu items, main toolbar menu buttons)

HKLMSoftwareMicrosoftInternet ExplorerExtensions
{FB5F1910-F110-11D2-BB9E-00C04F795683}
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:Program FilesMessengermsmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

avast! Antivirus, avast! Antivirus, ""D:programsAvast4ashServ.exe"" [null data]
avast! iAVS4 Control Service, aswUpdSv, ""D:programsAvast4aswUpdSv.exe"" [null data]
avast! Mail Scanner, avast! Mail Scanner, ""D:programsAvast4ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""D:programsAvast4ashWebSv.exe" /service" ["ALWIL Software"]
NVIDIA Display Driver Service, NVSvc, "C:WINDOWSSystem32
vsvc32.exe" ["NVIDIA Corporation"]
Windows User Mode Driver Framework, UMWdf, "C:WINDOWSsystem32wdfmgr.exe" [MS]


----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 309 seconds, including 14 seconds for message boxes)

Note: detected settings may not have any effect.

HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

"DisableRegistryTools" = (REG_DWORD) hex:0x00000000
{User Configuration|Administrative Templates|System|
Prevent access to registry editing tools}

HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

Przejdź do HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
znajdź po lewej wartośc

shutdownwithoutlogon i
undockwithoutlogon i zmień ich wartości za pomocą modyfikuj z 0x00000001 na 0x00000000

no dobra zmieniełem te wartości i to już jest rozwiązanie całego problemu??? ewido dalej znajduje obce obiekty w tej samej lokalizajcji,ale w pracy kompa znaczna poprawa

Praktycznie na to wygląda. To są pliki tymczasowe ciasteczek. Sądząc z opisu to są one ciasteczkami z reklam. Kiedy odplaisz net pojwaiają się na nowo, ale są nieszkodliwe. A jak z startem systemu, działa tryb normalny??

A tu taki fix na alutostart
start>>uruchom>>msconfig>>uruchamianie>>odchaczykuj podane wpisy:
-SunJavaUpdateSched,
-ABBYY Community Agent tak wogóle to znasz to, wygląda na syf
-MSMSGS,
-nwiz,

Skasuj to przez Hijack

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe

zrobiłem jak napisałeś/łaś,po wyłączenieu w włączeniu kompa(chciałem zobaczć czy trb normalny startuje)pojwił się komunikat,że windows uruchomił się w trybie diagnostycznym i aby uruchamiał się w trybie normalnym trzeba w start msconfig na karcie ogólne kilknąc uruchamianie systemu w trybie normalnym co spowoduej conięcie zmian.
Ewido dalej wykrywa cisteczka.Co robić???[/img]

Spróbujmy tego: start>>uruchom>>msocnfig>>boot.ini odznacz wszystkie zaczhzaczykowane jesli są i w ogółnym wybierz 1 opcje.

zrobiłem ale cisteczka są dalej(tego ABBY to znam to jest od scanera )

Powiedz mi tylko czyt system odpala się prawidłowo. Ciasteczka będą zawsze po otworzeniu Internetu, są nie groźne.

system wystartował dobrze(sprawdzłem tylko raz),ale chcesz mi powiedzeć że ciasteczek sie nie pozbede?(Ewido dalej je wykrywa )