Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Win32: Chydo отново

werz
в Премахване на зловреден софтуер

Featured Replies

Извинявам се ,че пиша от тази тема,но цъкна ли на раздела ме изхвърля и не мога да си направя нова

Extras.Txt

OTL.Txt

Редактирано от werz (преглед на промените)

Аз прехвърлих темата Ви. Вече се чудя какви заглавия да слагам за този вирус. ;)

Трябва да ходя на работа, така че ще помогне някой от екипа който първи се освободи.

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете това:

:OTL

PRC - [2009/12/30 14:04:57 | 00,745,472 | ---- | M] () -- C:\Documents and Settings\werz\Local Settings\Temp\ygkoclq.exe

PRC - [2009/12/30 14:04:48 | 00,577,536 | RHS- | M] () -- C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe

SRV - File not found [On_Demand | Stopped] -- -- (SQLAgent$SONY_MEDIAMGR)

SRV - File not found [On_Demand | Stopped] -- -- (MSSQL$SONY_MEDIAMGR)

SRV - File not found [On_Demand | Stopped] -- -- (iPod Service)

SRV - File not found [Auto | Stopped] -- -- (ATKKeyboardService)

IE - HKU\S-1-5-21-1177238915-2077806209-682003330-1003\..\URLSearchHook: - Reg Error: Key error. File not found

O3 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.

O3 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O3 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

O3 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.

O4 - HKLM..\Run: [ewkywperfadmlndqi] C:\Documents and Settings\werz\Local Settings\Temp\ewkywperfadmlndqi.exe ()

O4 - HKLM..\Run: [KernelFaultCheck] File not found

O4 - HKLM..\Run: [semumzipxmj] C:\WINDOWS\System32\ngvkjdthwswggjaohl.exe ()

O4 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003..\Run: [pepavlxhskkqml] C:\WINDOWS\System32\ewkywperfadmlndqi.exe ()

O4 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003..\Run: [semumzipxmj] C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe ()

O4 - HKLM..\RunOnce: [pclunbltcsqu] C:\WINDOWS\System32\ewkywperfadmlndqi.exe ()

O4 - HKLM..\RunOnce: [xoboldrdqkmustiu] C:\Documents and Settings\werz\Local Settings\Temp\lgxopldtkioachaqlrky.exe ()

O4 - HKU\.DEFAULT..\RunOnce: [Microsoft Windows Update 32] File not found

O4 - HKU\S-1-5-18..\RunOnce: [Microsoft Windows Update 32] File not found

O4 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003..\RunOnce: [pclunbltcsqu] C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe ()

O4 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003..\RunOnce: [siugctgrdwxebbp] C:\WINDOWS\System32\awogifyphgnadjduqxrgw.exe ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: ocmwqfqzjazez = ewkywperfadmlndqi.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: xipwnzhnui = C:\DOCUME~1\werz\LOCALS~1\Temp\awogifyphgnadjduqxrgw.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\S-1-5-21-1177238915-2077806209-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found

O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe File not found

O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/C/8/0C8EDFAB-30BC-4792-898E-2DABE27B2C4D/mp43dmo.CAB (Reg Error: Key error.)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Value error. - Reg Error: Value error. File not found

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found

O32 - AutoRun File - [2009/12/29 23:58:55 | 00,000,859 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009/12/29 23:58:56 | 00,000,833 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]

O32 - AutoRun File - [2009/12/29 23:58:59 | 00,000,828 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]

O33 - MountPoints2\{3a4ec8c8-79d0-11de-8684-00173133d735}\Shell - "" = AutoRun

O33 - MountPoints2\{3a4ec8c8-79d0-11de-8684-00173133d735}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{572a514d-3ff3-11de-862e-00173133d735}\Shell - "" = AutoRun

O33 - MountPoints2\{572a514d-3ff3-11de-862e-00173133d735}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{572a514e-3ff3-11de-862e-00173133d735}\Shell - "" = AutoRun

O33 - MountPoints2\{572a514e-3ff3-11de-862e-00173133d735}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{b3e62c12-8680-11dd-85d2-00173133d735}\Shell - "" = AutoRun

O33 - MountPoints2\{b3e62c12-8680-11dd-85d2-00173133d735}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{b3e62c12-8680-11dd-85d2-00173133d735}\Shell\AutoRun\command - "" = H:\autorun.exe -- File not found

[2009/12/30 14:08:47 | 00,000,280 | -H-- | M] () -- C:\WINDOWS\rwxyjprrsaqmynqqvlomltybgn.tuf

[2009/12/30 14:08:47 | 00,000,280 | -H-- | M] () -- C:\Program Files\rwxyjprrsaqmynqqvlomltybgn.tuf

[2009/12/30 14:08:47 | 00,000,280 | -H-- | M] () -- C:\Documents and Settings\werz\Local Settings\Application Data\rwxyjprrsaqmynqqvlomltybgn.tuf

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\ysiyytkzpmrcdhzoinf.exe

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\xoboldrdqkmustiu.exe

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\rohadbvnggocgniaxfaqhh.exe

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\ngvkjdthwswggjaohl.exe

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\lgxopldtkioachaqlrky.exe

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\ewkywperfadmlndqi.exe

[2009/12/30 14:07:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\awogifyphgnadjduqxrgw.exe

[2009/12/30 14:05:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\ysiyytkzpmrcdhzoinf.exe

[2009/12/30 14:05:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\rohadbvnggocgniaxfaqhh.exe

[2009/12/30 14:05:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\ngvkjdthwswggjaohl.exe

[2009/12/30 14:05:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\lgxopldtkioachaqlrky.exe

[2009/12/30 14:05:05 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\awogifyphgnadjduqxrgw.exe

[2009/12/30 14:05:04 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\xoboldrdqkmustiu.exe

[2009/12/30 14:05:04 | 00,577,536 | RHS- | M] () -- C:\WINDOWS\System32\ewkywperfadmlndqi.exe

[2009/12/30 03:04:10 | 00,002,402 | -H-- | M] () -- C:\WINDOWS\System32\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk

[2009/12/30 03:04:10 | 00,002,402 | -H-- | M] () -- C:\WINDOWS\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk

[2009/12/30 03:04:10 | 00,002,402 | -H-- | M] () -- C:\Program Files\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk

[2009/12/30 03:04:10 | 00,002,402 | -H-- | M] () -- C:\Documents and Settings\werz\Local Settings\Application Data\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk

[2009/12/30 03:04:10 | 00,000,280 | -H-- | M] () -- C:\WINDOWS\System32\rwxyjprrsaqmynqqvlomltybgn.tuf

[2009/12/30 03:03:46 | 00,000,316 | -H-- | M] () -- C:\WINDOWS\System32\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru

[2009/12/30 03:03:46 | 00,000,316 | -H-- | M] () -- C:\WINDOWS\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru

[2009/12/30 03:03:46 | 00,000,316 | -H-- | M] () -- C:\Program Files\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru

[2009/12/30 03:03:46 | 00,000,316 | -H-- | M] () -- C:\Documents and Settings\werz\Local Settings\Application Data\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru

[2009/12/29 23:42:41 | 00,000,203 | -H-- | M] () -- C:\WINDOWS\System32\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk

[2009/12/29 23:42:41 | 00,000,203 | -H-- | M] () -- C:\WINDOWS\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk

[2009/12/29 23:42:41 | 00,000,203 | -H-- | M] () -- C:\Program Files\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk

[2009/12/29 23:42:41 | 00,000,203 | -H-- | M] () -- C:\Documents and Settings\werz\Local Settings\Application Data\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk

[2009/12/29 23:37:09 | 00,004,248 | -H-- | M] () -- C:\WINDOWS\System32\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal

[2009/12/29 23:37:09 | 00,004,248 | -H-- | M] () -- C:\WINDOWS\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal

[2009/12/29 23:37:09 | 00,004,248 | -H-- | M] () -- C:\Program Files\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal

[2009/12/29 23:37:09 | 00,004,248 | -H-- | M] () -- C:\Documents and Settings\werz\Local Settings\Application Data\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal

:services

yqlzm

kaibhgdrx

:files

C:\Documents and Settings\werz\Local Settings\Temp\ygkoclq.exe

C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe

C:\WINDOWS\system32\trlxtsd.dll

C:\Program Files\Common Files\svchost.exe

:reg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"2264:TCP"=-

:Commands

[purity]

[emptytemp]

[resethosts]

[Reboot]

Натиснете бутона Run Fix

Ще се създаде лог файл. Копирайте го в следващия си пост.

  • Автор

Много мерси за помоща.Вируса е изключително гаден.Ето го и лог файла

All processes killed

========== OTL ==========

No active process named ygkoclq.exe was found!

No active process named xoboldrdqkmustiu.exe was found!

Service SQLAgent$SONY_MEDIAMGR stopped successfully!

Service SQLAgent$SONY_MEDIAMGR deleted successfully!

Service MSSQL$SONY_MEDIAMGR stopped successfully!

Service MSSQL$SONY_MEDIAMGR deleted successfully!

Service iPod Service stopped successfully!

Service iPod Service deleted successfully!

Service ATKKeyboardService stopped successfully!

Service ATKKeyboardService deleted successfully!

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ewkywperfadmlndqi deleted successfully.

C:\Documents and Settings\werz\Local Settings\Temp\ewkywperfadmlndqi.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KernelFaultCheck deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\semumzipxmj deleted successfully.

C:\WINDOWS\system32\ngvkjdthwswggjaohl.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\pepavlxhskkqml deleted successfully.

C:\WINDOWS\system32\ewkywperfadmlndqi.exe moved successfully.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\semumzipxmj deleted successfully.

C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pclunbltcsqu deleted successfully.

File C:\WINDOWS\System32\ewkywperfadmlndqi.exe not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\xoboldrdqkmustiu deleted successfully.

C:\Documents and Settings\werz\Local Settings\Temp\lgxopldtkioachaqlrky.exe moved successfully.

Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Microsoft Windows Update 32 deleted successfully.

Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Microsoft Windows Update 32 not found.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\pclunbltcsqu deleted successfully.

File C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe not found.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\Software\Microsoft\Windows\CurrentVersion\RunOnce\\siugctgrdwxebbp deleted successfully.

C:\WINDOWS\system32\awogifyphgnadjduqxrgw.exe moved successfully.

Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\ocmwqfqzjazez deleted successfully.

C:\WINDOWS\ewkywperfadmlndqi.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\xipwnzhnui deleted successfully.

C:\Documents and Settings\werz\Local Settings\Temp\awogifyphgnadjduqxrgw.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry value HKEY_USERS\S-1-5-21-1177238915-2077806209-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B863453A-26C3-4e1f-A54D-A2CD196348E9}\ not found.

Starting removal of ActiveX control {3334504D-9980-0010-8000-00AA00389B71}

C:\WINDOWS\Downloaded Program Files\mp43dmo.inf moved successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{3334504D-9980-0010-8000-00AA00389B71}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3334504D-9980-0010-8000-00AA00389B71}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3334504D-9980-0010-8000-00AA00389B71}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3334504D-9980-0010-8000-00AA00389B71}\ not found.

File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.

Starting removal of ActiveX control DirectAnimation Java Classes

Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.

File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.

Starting removal of ActiveX control Microsoft XML Parser for Java

Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\ deleted successfully.

C:\autorun.inf moved successfully.

D:\autorun.inf moved successfully.

E:\autorun.inf moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a4ec8c8-79d0-11de-8684-00173133d735}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3a4ec8c8-79d0-11de-8684-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3a4ec8c8-79d0-11de-8684-00173133d735}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3a4ec8c8-79d0-11de-8684-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{572a514d-3ff3-11de-862e-00173133d735}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{572a514d-3ff3-11de-862e-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{572a514d-3ff3-11de-862e-00173133d735}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{572a514d-3ff3-11de-862e-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{572a514e-3ff3-11de-862e-00173133d735}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{572a514e-3ff3-11de-862e-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{572a514e-3ff3-11de-862e-00173133d735}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{572a514e-3ff3-11de-862e-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3e62c12-8680-11dd-85d2-00173133d735}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3e62c12-8680-11dd-85d2-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3e62c12-8680-11dd-85d2-00173133d735}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3e62c12-8680-11dd-85d2-00173133d735}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3e62c12-8680-11dd-85d2-00173133d735}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3e62c12-8680-11dd-85d2-00173133d735}\ not found.

File H:\autorun.exe not found.

C:\WINDOWS\rwxyjprrsaqmynqqvlomltybgn.tuf moved successfully.

C:\Program Files\rwxyjprrsaqmynqqvlomltybgn.tuf moved successfully.

C:\Documents and Settings\werz\Local Settings\Application Data\rwxyjprrsaqmynqqvlomltybgn.tuf moved successfully.

C:\WINDOWS\ysiyytkzpmrcdhzoinf.exe moved successfully.

C:\WINDOWS\xoboldrdqkmustiu.exe moved successfully.

C:\WINDOWS\rohadbvnggocgniaxfaqhh.exe moved successfully.

C:\WINDOWS\ngvkjdthwswggjaohl.exe moved successfully.

C:\WINDOWS\lgxopldtkioachaqlrky.exe moved successfully.

File C:\WINDOWS\ewkywperfadmlndqi.exe not found.

C:\WINDOWS\awogifyphgnadjduqxrgw.exe moved successfully.

C:\WINDOWS\system32\ysiyytkzpmrcdhzoinf.exe moved successfully.

C:\WINDOWS\system32\rohadbvnggocgniaxfaqhh.exe moved successfully.

File C:\WINDOWS\System32\ngvkjdthwswggjaohl.exe not found.

C:\WINDOWS\system32\lgxopldtkioachaqlrky.exe moved successfully.

File C:\WINDOWS\System32\awogifyphgnadjduqxrgw.exe not found.

C:\WINDOWS\system32\xoboldrdqkmustiu.exe moved successfully.

File C:\WINDOWS\System32\ewkywperfadmlndqi.exe not found.

C:\WINDOWS\system32\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk moved successfully.

C:\WINDOWS\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk moved successfully.

C:\Program Files\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk moved successfully.

C:\Documents and Settings\werz\Local Settings\Application Data\pepavlxhskkqmlyixxksbtivkbqbmhxjteww.yxk moved successfully.

C:\WINDOWS\system32\rwxyjprrsaqmynqqvlomltybgn.tuf moved successfully.

C:\WINDOWS\system32\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru moved successfully.

C:\WINDOWS\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru moved successfully.

C:\Program Files\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru moved successfully.

C:\Documents and Settings\werz\Local Settings\Application Data\ewkywperfadmlndqilbmytlbtnfthfynaojmvuw.zru moved successfully.

C:\WINDOWS\system32\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk moved successfully.

C:\WINDOWS\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk moved successfully.

C:\Program Files\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk moved successfully.

C:\Documents and Settings\werz\Local Settings\Application Data\ngvkjdthwswggjaohlcobxqhavodsrlbpeaeoori.ptk moved successfully.

C:\WINDOWS\system32\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal moved successfully.

C:\WINDOWS\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal moved successfully.

C:\Program Files\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal moved successfully.

C:\Documents and Settings\werz\Local Settings\Application Data\siugctgrdwxebbpaqrfoyrhvldtfrnercohip.mal moved successfully.

========== SERVICES/DRIVERS ==========

Service yqlzm stopped successfully!

Service yqlzm deleted successfully!

Service kaibhgdrx stopped successfully!

Service kaibhgdrx deleted successfully!

========== FILES ==========

C:\Documents and Settings\werz\Local Settings\Temp\ygkoclq.exe moved successfully.

File\Folder C:\Documents and Settings\werz\Local Settings\Temp\xoboldrdqkmustiu.exe not found.

File move failed. C:\WINDOWS\system32\trlxtsd.dll scheduled to be moved on reboot.

C:\Program Files\Common Files\svchost.exe moved successfully.

========== REGISTRY ==========

Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2264:TCP deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Guest

User: HelpAssistant

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: SUPPORT_388945a0

User: werz

->Temp folder emptied: 11869263 bytes

->Temporary Internet Files folder emptied: 2016364 bytes

->Java cache emptied: 16122275 bytes

->FireFox cache emptied: 89256980 bytes

->Google Chrome cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 114.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

OTL by OldTimer - Version 3.1.20.1 log created on 01032010_123320

Files\Folders moved on Reboot...

C:\WINDOWS\system32\trlxtsd.dll moved successfully.

C:\WINDOWS\temp\hlktmp moved successfully.

Registry entries deleted on Reboot...

Съжелявам ,че е така но не ми дава да прикачвам файлове с такова разширение

Защото освен Win32.Chydo си имате и един Conficker.

СТЪПКА 1

Изтегли DDS от тук.

Запази го на десктопа.

Изключи защитата в реално време на антивирусната си програма (ако е инсталирана такава).Накрая, стартирай инструмента.

  • Когато DDS приключи успешно анализа на системата ще отвори два лог файла.


  2. DDS.txt
  3. Attach.txt

  • Запази ги на десктопа и след това ги прикачи към следващия си пост.

СТЪПКА 2

Изтегли GMER и го разархивирай на десктопа.

Преди да сканираш се увери, че всички останали работещи програми в момента са изключени и антивирусния софтуер няма да предприема никакви действия по време на сканирането на Gmer. Не използвай компютъра си, докато трае сканирането.

Кликни два пъти пъти върху gmer.exe , за да стартираш програмата.

Тя ще направи начално сканиране за секунди. След като то приключи НЕ натискайте бутона Scan, а избери бутона Copy и постави съдържанието на лог файла в следващия си пост.

    •
    • Харесване 1

    Регистрирайте се или влезете в профила си за да коментирате
    Назад

    Разглеждащи това в момента 0

    • Няма регистрирани потребители разглеждащи тази страница.

    Дарение

    • Подкрепи съществуването на форума - направи дарение
      32%
      Дарени 315 € от нужните 1 000 €

    Бюлетин

    Получавайте известие, когато има важна промяна или новина свързана с форума.
    Абонирайте се

    Профил

    Навигация

    Търсене

    Търсене

    Конфигуриране на push известия в браузъра
    Chrome (Android)
    1. Докоснете иконата на катинар до адресната лента.
    2. Докоснете Разрешения → Известия.
    3. Променете предпочитанията си.
    Chrome (Desktop)
    1. Кликнете върху иконата на катинар в адресната лента.
    2. Изберете Настройки на сайта.
    3. Намерете Известия и коригирайте предпочитанията си.