Uruchom HijackThis
Do a system scan only
w okienku programu pokaże się log
zaznacz kratki przy podanych wpisach
klikasz
Fix checked- Kod: Zaznacz wszystko
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
Wylecz pamięci przenośne
Flash Disinfector lub sformatuj
Uruchom OTL
w oknie
Custom Scans/Fixes wklej:
:OTL
PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
MOD - [2009-12-12 22:54:17 | 00,074,810 | RHS- | M] () -- C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\cvasds1.dll
O4 - HKLM..\Run: [RavTimeXP] C:\WINDOWS\Mstray.exe File not found
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found
O4 - HKCU..\Run: [cdoosoft] C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\herss.exe ()
O32 - AutoRun File - [2009-12-13 00:43:23 | 00,000,051 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-12-13 00:43:23 | 00,000,051 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-12-13 00:43:23 | 00,000,051 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-12-13 00:43:23 | 00,000,051 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-12-13 00:43:23 | 00,000,051 | RHS- | M] () - G:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-12-13 00:43:28 | 00,000,051 | RHS- | M] () - K:\autorun.inf -- [ FAT32 ]
:Files
C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\cvasds1.dll
C:\Documents and Settings\Admin\Ustawienia lokalne\Temp\herss.exe
C:\Documents and Settings\Admin\Dane aplikacji\.#
C:\hx.exe
D:\hx.exe
E:\hx.exe
F:\hx.exe
G:\hx.exe
K:\hx.exe
C:\WINDOWS\Mstray.exe
:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""
:Commands
[emptytemp]
[start explorer]
[Reboot]
Klikasz
Run Fix. Dajesz log z usuwania + nowy log z OTL