Proszę o sprawdzenie Loga z HijackThis i ComoboFix

[konradlfc]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:26: VIRUS ALERT!, on 2008-10-06
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: QXK Olive - {9009E6C8-6562-4A84-94CC-A8C560974871} - C:\WINDOWS\nkefbltdwrf.dll
O3 - Toolbar: dkwqgnbe - {4D80831C-F0AC-4793-B3B5-A4DAB9F869EB} - C:\WINDOWS\dkwqgnbe.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O15 - Trusted Zone: http://mks.com.pl
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8A92F4A-B9C7-4D62-BB8C-9CABA2FC31D6}: NameServer = 192.168.100.100
O21 - SSODL: xgpsarbm - {CAAB06F3-5ED0-48F1-AC46-B81E5CA9BC96} - C:\WINDOWS\xgpsarbm.dll
O21 - SSODL: neksolda - {31419F6C-39DA-41F5-AD19-E042E1C24F1F} - C:\WINDOWS\neksolda.dll
O23 - Service: Application Driver Auto Removal Service (01) (appdrvrem01) - Protection Technology - C:\WINDOWS\System32\appdrvrem01.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4086 bytes



ComoboFix:

ComboFix 08-10-05.10 - Liverpool 2008-10-06 18:29:33.5 - NTFSx86
Uruchomiony z: C:\Documents and Settings\Liverpool\Pulpit\ComboFix.exe
* Resident AV is active


UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
/wow section nieukończony

((((((((((((((((((((((((( Pliki utworzone od 2008-09-06 do 2008-10-06 )))))))))))))))))))))))))))))))
.

2008-10-06 18:25 . 2008-10-06 18:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-10-06 13:29 . 2008-10-06 13:29 2,915,944 --a------ C:\WINDOWS\system32\drivers\appdrv01.sys
2008-10-06 13:29 . 2008-10-06 13:29 304,528 --a------ C:\WINDOWS\system32\appdrvrem01.exe
2008-10-06 13:18 . 2008-10-06 14:10 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-06 13:03 . 2008-10-06 06:56 389,120 --a------ C:\WINDOWS\nkefbltdwrf.dll
2008-10-06 13:03 . 2008-10-06 06:56 368,640 --a------ C:\WINDOWS\xgpsarbm.dll
2008-10-06 13:03 . 2008-10-06 06:56 339,968 --a------ C:\WINDOWS\neksolda.dll
2008-10-06 13:03 . 2008-10-06 06:56 212,992 --a------ C:\WINDOWS\dkwqgnbe.dll
2008-10-06 13:03 . 2008-10-06 06:56 98,304 --a------ C:\WINDOWS\ekqd.exe
2008-10-06 13:03 . 2008-10-06 06:56 86,016 --a------ C:\WINDOWS\fkebanrw.exe
2008-10-06 10:53 . 2008-10-06 10:53 279,712 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-10-06 10:53 . 2008-10-06 10:53 25,888 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-10-06 10:50 . 2008-10-06 15:23 <DIR> d-------- C:\WINDOWS\Logs
2008-09-27 13:27 . 2008-10-06 15:23 <DIR> d-------- C:\Program Files\SopCast
2008-09-27 10:17 . 2008-09-27 10:26 204 --a------ C:\WINDOWS\struct~.ini
2008-09-27 10:15 . 2008-09-27 10:15 <DIR> d-------- C:\Program Files\VideoLAN
2008-09-27 10:15 . 2008-09-27 10:16 <DIR> d-------- C:\Documents and Settings\Liverpool\Dane aplikacji\vlc
2008-09-25 10:39 . 2008-10-06 13:37 <DIR> d-------- C:\Program Files\BearShare
2008-09-22 20:31 . 2008-09-27 11:16 <DIR> d-------- C:\Documents and Settings\Liverpool\DoctorWeb
2008-09-21 14:55 . 2008-09-21 14:55 <DIR> d-------- C:\Documents and Settings\Liverpool\Dane aplikacji\Media Player Classic
2008-09-21 14:41 . 2006-12-10 23:32 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-09-21 14:41 . 2008-06-08 23:58 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll
2008-09-21 14:38 . 2008-09-21 14:38 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-09-21 14:36 . 2001-10-31 10:14 1,650,688 --a------ C:\WINDOWS\system32\mplva6.dll
2008-09-21 14:35 . 2008-09-21 14:36 <DIR> d-------- C:\Program Files\ACE Mega CoDecS Pack
2008-09-21 14:35 . 2004-05-25 16:06 417,792 --a------ C:\WINDOWS\system32\ac3filter.cpl
2008-09-20 21:05 . 2008-09-20 21:05 <DIR> d-------- C:\Program Files\Sports Interactive
2008-09-20 17:06 . 2008-09-20 17:26 <DIR> d-------- C:\Program Files\Common Files\Real
2008-09-20 16:13 . 2008-09-20 16:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\TVU Networks
2008-09-20 15:52 . 2008-09-20 15:52 <DIR> d-------- C:\Program Files\xp-AntiSpy
2008-09-20 15:35 . 2008-09-20 17:06 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-09-16 21:31 . 2008-10-06 13:37 1,631 --a------ C:\WINDOWS\wininit.ini
2008-09-16 20:51 . 2008-09-27 13:22 <DIR> d-------- C:\Documents and Settings\Liverpool\Dane aplikacji\ppStream
2008-09-16 20:50 . 2008-09-16 20:50 <DIR> d-------- C:\Program Files\Common Files\Synacast
2008-09-16 20:50 . 2008-09-16 20:50 <DIR> d-------- C:\Documents and Settings\Liverpool\Dane aplikacji\PPMate
2008-09-13 12:42 . 2008-09-21 15:06 <DIR> d-------- C:\Documents and Settings\Liverpool\Dane aplikacji\TVU Networks
2008-09-13 12:40 . 2008-09-13 12:40 <DIR> d-------- C:\Documents and Settings\Liverpool\LocalLow

.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 13:23 --------- d-----w C:\Program Files\ESET
2008-10-06 13:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-06 12:12 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-10-05 20:52 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-09-20 08:59 --------- d-----w C:\Program Files\NAPI-PROJEKT
2008-09-02 12:27 --------- d-----w C:\Documents and Settings\Liverpool\Dane aplikacji\Sports Interactive
2008-08-29 17:35 --------- d-----w C:\Program Files\borkow.org
2008-08-26 17:26 --------- d-----w C:\Documents and Settings\Liverpool\Dane aplikacji\Microsoft Games
2008-08-26 16:44 --------- d-----w C:\Program Files\Gadu-Gadu
2008-08-24 20:07 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-19 14:22 --------- d-----w C:\Program Files\Analog Devices
2008-08-18 23:16 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations
2008-08-18 10:55 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-18 10:18 --------- d-----w C:\Documents and Settings\Liverpool\Dane aplikacji\OpenOffice.org2
2008-08-16 15:06 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-08-16 14:39 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-08-14 18:27 --------- d-----w C:\Program Files\MoorHunt
2008-08-11 11:28 --------- d-----w C:\Documents and Settings\Liverpool\Dane aplikacji\Leadertech
2008-08-10 21:16 --------- d-----w C:\Documents and Settings\Liverpool\Dane aplikacji\AdobeUM
2008-08-10 20:54 --------- d-----w C:\Documents and Settings\Liverpool\Dane aplikacji\AdobeAUM
2008-08-02 10:20 797,216 ----a-w C:\WINDOWS\system32\nvcplui.exe
2008-08-02 10:20 453,152 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-08-02 10:20 453,152 ----a-w C:\WINDOWS\system32\nvudisp.exe
2008-08-02 10:20 1,368,064 ----a-w C:\WINDOWS\system32\nvcuda.dll
2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-12 23:11 298,104 ----a-w C:\WINDOWS\system32\imon.dll
.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9009E6C8-6562-4A84-94CC-A8C560974871}]
2008-10-06 06:56 389120 --a------ C:\WINDOWS\nkefbltdwrf.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4D80831C-F0AC-4793-B3B5-A4DAB9F869EB}"= "C:\WINDOWS\dkwqgnbe.dll" [2008-10-06 212992]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 8466432]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 1953792]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-13 949376]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 1953792]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 81920]
"nwiz"="nwiz.exe" [2007-06-28 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xgpsarbm"= {CAAB06F3-5ED0-48F1-AC46-B81E5CA9BC96} - C:\WINDOWS\xgpsarbm.dll [2008-10-06 368640]
"neksolda"= {31419F6C-39DA-41F5-AD19-E042E1C24F1F} - C:\WINDOWS\neksolda.dll [2008-10-06 339968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.sl_anet"= C:\PROGRA~1\ACEMEG~1\SystemS\sl_anet.acm
"vidc.yv12"= yv12vfw.dll
"vidc.iyuv"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= C:\PROGRA~1\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.uyvy"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"msacm.msaudio1"= C:\PROGRA~1\ACEMEG~1\SystemS\MICROS~1\msaud32.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-04 17:01 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Gry\\FM 08\\Instal\\fm.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"C:\\Program Files\\SopCast\\SopCast.exe"=
"D:\\Gry\\FIFA 08\\Instal\\FIFA08.exe"=

R1 appdrv01;Application Driver (01);C:\WINDOWS\system32\Drivers\appdrv01.sys [2008-10-06 2915944]
S2 appdrvrem01;Application Driver Auto Removal Service (01);C:\WINDOWS\System32\appdrvrem01.exe svc [ ]
S3 ATE_PROCMON;ATE_PROCMON;C:\Program Files\Anti Trojan Elite\ATEPMon.sys [ ]
S3 RT2400;RT2400 Wireless Driver;C:\WINDOWS\system32\DRIVERS\RT2400.sys [2004-04-22 62848]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

Notify-dimsntfy - (no file)


.
------- Skan uzupełniający -------
.
FireFox -: Profile - C:\Documents and Settings\Liverpool\Dane aplikacji\Mozilla\Firefox\Profiles\n8gkrs02.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.lfc.pl
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 18:29:50
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

skanowanie ukrytych procesów ...

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ...


**************************************************************************
.
Czas ukończenia: 2008-10-06 18:30:32
ComboFix-quarantined-files.txt 2008-10-06 16:30:31

Przed: 6 807 371 776 bajtów wolnych
Po: 6,796,849,152 bajtów wolnych

154 --- E O F --- 2008-07-28 13:37:23

[huber2t]

fix w hiajckthis

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wm ... Ojg5&lid=2
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: QXK Olive - {9009E6C8-6562-4A84-94CC-A8C560974871} - C:\WINDOWS\nkefbltdwrf.dll
O3 - Toolbar: dkwqgnbe - {4D80831C-F0AC-4793-B3B5-A4DAB9F869EB} - C:\WINDOWS\dkwqgnbe.dll
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O21 - SSODL: xgpsarbm - {CAAB06F3-5ED0-48F1-AC46-B81E5CA9BC96} - C:\WINDOWS\xgpsarbm.dll
O21 - SSODL: neksolda - {31419F6C-39DA-41F5-AD19-E042E1C24F1F} - C:\WINDOWS\neksolda.dll

Pobierz ComboFix, ale nie uruchamiaj
Otwórz notatnik i wklej do niego:

Kod: Zaznacz wszystko

File::
C:\WINDOWS\nkefbltdwrf.dll
C:\WINDOWS\xgpsarbm.dll
C:\WINDOWS\neksolda.dll
C:\WINDOWS\dkwqgnbe.dll
C:\WINDOWS\ekqd.exe
C:\WINDOWS\fkebanrw.exe
C:\WINDOWS\system32\drivers\atksgt.sys
C:\WINDOWS\system32\drivers\lirsgt.sys
C:\WINDOWS\system32\drivers\appdrv01.sys
C:\WINDOWS\system32\appdrvrem01.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9009E6C8-6562-4A84-94CC-A8C560974871}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{4D80831C-F0AC-4793-B3B5-A4DAB9F869EB}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=-
"NvMediaCenter"=-
"nwiz"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xgpsarbm"=-
"neksolda"=-

Driver::
ATE_PROCMON
appdrvrem01
appdrv01


Plik zapisz jako CFScript.txt.
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe tak jak tu->

Rozpocznie się usuwanie i powstanie log, który dasz na forum.

Logi dajesz na http://wklej.eu lub na http://wklej.org a w poście dajesz tylko link