Adware.... jak je usunąć?

[fredziak]

nie mogę usunąć tych wirusów: Adware-DFC, Adware-SAHAgent, Adware-
SAHAgent.ini, Adware-WinAd, Dialer-Generic


skanowałam wieloma programami polecanymi na tym forum: jeden czy dwa
tylko skanowały - nie usuwały, inne takie jak Spyware Doctor,
SuperAntiSpyware wyszukały naprawdę dużo różnego świństwa i usuneły
je.

na koniec sprawdziłam wszystko jeszcze raz McAfee i wychodzi że mam
takie właśnie wirusy: Adware-DFC, Adware-SAHAgent, Adware-
SAHAgent.ini, Adware-WinAd, Dialer-Generic, a są na
C:\_RESTORE/ARCHIVE/FS793.CAB
nie mogę tych wirusów usunąć, ani poddać kwarantannie i wyskakuje
komunikat że dysk jest chroniony przed zapisem

wklejam loga

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:27:12, on 2007-12-29
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCSHLD9X.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\OASCLNT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCTSKSHD.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPLPR.EXE
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE
C:\PROGRAM FILES\SAGEM WIFI MANAGER\WLANUTL.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
szukaj.wp.pl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=3c00&lc=0415&s=search&ap=b204
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
about:blank
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-
BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-
CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar2.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-
905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth]
C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access
Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access
Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program
Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program
Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [WOOKIT] C:\PROGRAM FILES\NEOSTRADA
TP\NeostradaTP.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\SYSTEM\hpztsb04.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1
\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1
\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1
\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [MCTskShd] C:\PROGRA~1
\MCAFEE.COM\AGENT\mctskshd.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr]
C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711
\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547
\KB918547.EXE
O4 - HKLM\..\RunServices: [McShld9x] C:\Program
Files\McAfee.com\VSO\mcshld9x.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\PROGRAM FILES\SPYWARE
DOCTOR\SWDOCTOR.EXE" /Q
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] "C:\PROGRAM
FILES\SPYWARE DOCTOR\SWDOCTOR.EXE" /Q (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [QRIA] (User 'Default user')
O4 - .DEFAULT Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB
adapter.lnk = C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
(User 'Default user')
O4 - Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk =
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: &Translate English Word -
res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: Cached Snapshot of Page -
res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM
FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page into English -
res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine
Advantage Validation Tool) - go.microsoft.com/fwlink/?
linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com
Operating System Class) -
download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr
Class) -
download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
--
End of file - 5907 bytes

dodam jeszcze tylko że komp bardzo wolno chodzi , długo się
uruchamia, zawiesza się, wyłacza się często przeglądarka i wogóle
jakiś taki zamulony jest

[fredziak]

wklejam jeszcze ten log - może się przyda


"Silent Runners.vbs", revision 55, www.silentrunners.org/
Operating System: Windows Me (Millennium Edition)
Output limited to non-default values, except where indicated
by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Spyware Doctor" = ""C:\PROGRAM FILES\SPYWARE
DOCTOR\SWDOCTOR.EXE" /Q" ["PC Tools Research Pty Ltd"]

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"QRIA" = dword:0x00000000

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"internat.exe" = "internat.exe" [MS]
"ScanRegistry" = "C:\WINDOWS\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\WINDOWS\taskmon.exe" [MS]
"PCHealth" = "C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s" [MS]
"SystemTray" = "SysTray.Exe" [MS]
"LoadPowerProfile" = "Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme" [MS]
"CPQEASYACC" = "C:\Program Files\Compaq\Easy Access Button
Support\cpqeadm.exe" ["Compaq Computer Corporation"]
"EACLEAN" = "C:\Program Files\Compaq\Easy Access Button
Support\eaclean.exe" ["Compaq Computer Corporation"]
"CPQInet" = "c:\compaq\CPQInet\CpqInet.exe" ["Compaq Computer
Corporation"]
"SynTPLpr" = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
["Synaptics, Inc."]
"SynTPEnh" = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
["Synaptics, Inc."]
"WOOKIT" = "C:\PROGRAM FILES\NEOSTRADA TP\NeostradaTP.exe" [file not
found]
"HPDJ Taskbar Utility" = "C:\WINDOWS\SYSTEM\hpztsb04.exe" ["HP"]
"NWEReboot" = (empty string) [file not found]
"VSOCheckTask" = ""C:\PROGRA~1
\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask" ["McAfee, Inc."]
"MCAgentExe" = "C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe" ["McAfee,
Inc"]
"MCUpdateExe" = "C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE"
["McAfee, Inc"]
"MCTskShd" = "C:\PROGRA~1\MCAFEE.COM\AGENT\mctskshd.exe" ["McAfee,
Inc"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"LoadPowerProfile" = "Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme" [MS]
"SchedulingAgent" = "mstask.exe" [MS]
"*StateMgr" = "C:\WINDOWS\System\Restore\StateMgr.exe" [MS]
"KB891711" = "C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE" [MS]
"KB918547" = "C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE" [MS]
"McShld9x" = "C:\Program Files\McAfee.com\VSO\mcshld9x.exe"
["McAfee, Inc."]

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\
PerUser_CVT_Inis\(Default) = "Instalator systemu Windows — Konwerter
FAT32"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64
C:\WINDOWS\INF\applets1.inf" [MS]
PerUser_Calc_Inis\(Default) = "Instalator systemu Windows —
Kalkulator"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Calc_Inis_remove 64 C:\WINDOWS\INF\applets.inf" [MS]
PerUser_Enable_Inis\(Default) = "Instalator systemu Windows —
Ułatwienia dostępu"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Enable_Inis_remove 64 C:\WINDOWS\INF\enable.inf" [MS]
PerUser_Wingames_Inis\(Default) = "Instalator systemu Windows - gry
klasyczne"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Wingames_Rem_Inis 64 C:\WINDOWS\INF\games.inf" [MS]
PerUser_ZoneGame_Inis\(Default) = "Instalator systemu Windows - Gry
internetowe"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_ZoneGame_Rem_Inis 64 C:\WINDOWS\INF\games.inf" [MS]
PerUser_PBGame_Inis\(Default) = "Instalator systemu Windows - Gry z
pakietu Plus!"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_PBGame_Rem_Inis 64 C:\WINDOWS\INF\games.inf" [MS]
PerUser_Sysmon_Inis\(Default) = "Instalator systemu Windows —
Monitor systemu"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Sysmon_Inis_remove 64 C:\WINDOWS\INF\appletpp.inf" [MS]
PerUser_Sysmeter_Inis\(Default) = "Instalator systemu Windows —
Miernik zasobów"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Sysmeter_Rem_Inis 64 C:\WINDOWS\INF\appletpp.inf" [MS]
PerUser_netwatch_Inis\(Default) = "Instalator systemu Windows —
Monitor sieci"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_netwatch_Rem_Inis 64 C:\WINDOWS\INF\appletpp.inf" [MS]
PerUser_Onlinelnks_Inis\(Default) = "Instalator systemu Windows —
HyperTerminal"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Onlinelnks_Inis_remove 64 C:\WINDOWS\INF\appletpp.inf" [MS]
PerUser_Dialer_Inis\(Default) = "Instalator systemu Windows —
Telefon"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_Dialer_Inis_remove 64 C:\WINDOWS\INF\appletpp.inf" [MS]
PerUser_ClipBrd_Inis\(Default) = "Instalator systemu Windows —
Podgląd schowka"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_ClipBrd_Inis_remove 64 C:\WINDOWS\INF\clip.inf" [MS]
{44BBA842-CC51-11CF-AAFA-00AA00B6015C}\(Default) = "NetMeeting 3.01"
\StubPath = "rundll32.exe
advpack.dll,LaunchINFSection
C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.W95" [MS]
{7790769C-0471-11d2-AF11-00C04FA35D02}\(Default) = "Książka adresowa
5"
\StubPath = ""C:\Program
Files\Outlook
Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /uninstall" [MS]
{7790769C-0471-11d2-AF11-00C04FA35D02}.Restore\(Default) = "Książka
adresowa 5"
\StubPath
= "rundll32.exe advpack.dll,UserUnInstStubWrapper {7790769C-0471-
11d2-AF11-00C04FA35D02}" [MS]
PerUser_DCC_Inis\(Default) = "Instalator systemu Windows —
Bezpośrednie połączenie kablowe"
\StubPath = "rundll.exe
C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection
PerUser_DCC_Inis_remove 64 C:\WINDOWS\INF\rna.inf" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser
Helper Objects\
{AA58ED58-01DD-4d91-8333-CF10577473F7}\(Default) = (no title
provided)
-> {HKLM...CLSID} = "Google Toolbar Helper"
\InProcServer32\(Default) = "c:\program
files\google\googletoolbar2.dll" ["Google Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell
Extensions\Approved\
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Universal Plug and Play
Devices"
-> {HKLM...CLSID} = "Universal Plug and Play Devices"
\InProcServer32\(Default)
= "C:\WINDOWS\SYSTEM\UPNPUI.DLL" [file not found]
"{0A082D00-EC93-11D0-B1E6-80580BC10627}" = "Corel Media Folder Root
Menu Handler"
-> {HKLM...CLSID} = "Corel Media Folder Root Menu Handler"
\InProcServer32\(Default) = "C:\COREL\GRAPHICS8
\PROGRAMS\CMFFLD80.DLL" [file not found]
"{0FBF99C1-4127-11D1-B1E6-C17E96D9180A}" = "Folder To Corel Media
Folder Menu Handler"
-> {HKLM...CLSID} = "Folder To Corel Media Folder Menu Handler"
\InProcServer32\(Default) = "C:\COREL\GRAPHICS8
\PROGRAMS\CMFFLD80.DLL" [file not found]
"{854AF161-1AE1-11D1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\COREL\GRAPHICS8
\PROGRAMS\CMFFLD80.DLL" [file not found]
"{E856F161-1AE5-11d1-AB9B-00C0F00683EB}" = "Corel Media Folder"
-> {HKLM...CLSID} = "Corel Media Folder"
\InProcServer32\(Default) = "C:\COREL\GRAPHICS8
\PRO

[fredziak]

no to znalazłam rozwiązanie mojego problemu



support.microsoft.com/kb/263455/pl