Имам проблем с вируси

20 август 200917 г.

Темата ти беше за коша - грешен раздел, неясно заглавие, flood... Прочети правилата и ги спазвай в бъдеще, ако не искаш темите и постовете ти да бъдат трити!

iovi

днес сканирах с IObit Security 360 и ми откри вируси, но не знам как да ги премахна

IObit Security 360

OS:Windows XP

Version:0.3.1.20

Define Version:1127

Time:20.8.2009 г. 13:16:51

Win32.Aliser.8364, File, C:\System Volume Information\_restore{0D6C6DA3-C2E6-45D6-A9E8-64AC3FC19B6A}\RP568\A0192085.exe, 12-528

Win32.Aliser.8364, File, C:\System Volume Information\_restore{0D6C6DA3-C2E6-45D6-A9E8-64AC3FC19B6A}\RP568\A0192086.exe, 12-528

Win32.Polip.A, File, E:\System Volume Information\_restore{0D6C6DA3-C2E6-45D6-A9E8-64AC3FC19B6A}\RP568\A0192087.exe, 12-68

Logfile of IObit HijackScan v0.2.0.0

Scan saved at 13:22:20, on 2009-8-20

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\csrss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\IObit\IObit Security 360\IS360srv.exe

C:\windows\Explorer.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\windows\system32\nvsvc32.exe

C:\windows\System32\TUProgSt.exe

C:\windows\system32\svchost.exe

C:\windows\System32\alg.exe

C:\windows\system32\RUNDLL32.EXE

C:\windows\RTHDCPL.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\IObit\IObit Security 360\IS360tray.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

C:\windows\system32\ctfmon.exe

C:\windows\system32\wuauclt.exe

C:\windows\system32\svchost.exe

C:\Program Files\IObit\IObit Security 360\is360.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\windows\system32\NOTEPAD.EXE

C:\Program Files\Microsoft Office\Office12\OIS.EXE

C:\windows\system32\NOTEPAD.EXE

C:\Program Files\IObit\IObit Security 360\a_hijackscan.exe

O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: - {BA0BB009-26EF-485B-B9E6-4D05A7DEA005} - C:\WINDOWS\system32\src32toolbar.dll

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [nwiz] nwiz.exe /install

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [Alcmtr] ALCMTR.EXE

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\Software\Microsoft\Windows\CurrentVersion\Run\: [iObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe

O9 - Extra button: iMacros Web Automation - {0483894E-2422-45E0-8384-021AFF1AF3CD} -

O9 - Extra button: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

O9 - Extra button: Изпрати към OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} -

O9 - Extra button: Изпрати към OneNote - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} -

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Expression\Office12\REFIEBAR.DLL

O9 - Extra button: PDF Download - Options - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\PROGRA~1\Microsoft Expression\Office12\REFIEBAR.DLL

O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}Java Plug-in 1.6.0_06 - http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}Java Plug-in 1.6.0_06 - http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}Java Plug-in 1.6.0_06 - http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab

O23 - Service: McAfee Application Installer Cleanup (0060981233937232) - Unknown - C:\DOCUME~1\user\LOCALS~1\Temp\0060981233937232mcinst.exe C:\Program Files\COMMON~1\McAfee\Installer\cleanup.ini

O23 - Service: ABBYY FineReader 9.0 PE Licensing Service - ABBYY (BIT Software) - C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ESET HTTP Server - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe

O23 - Service: PDAgent - Unknown - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe

O23 - Service: PDEngine - Unknown - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) - Unknown - C:\Program Files\CyberLink\Shared files\RichVideo.exe

O23 - Service: SiSoftware Deployment Agent Service - Unknown - E:\New Folder (4)\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe

O23 - Service: TuneUp Drive Defrag Service - TuneUp Software - C:\windows\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service - TuneUp Software - C:\windows\System32\TUProgSt.exe

20 август 200917 г.

@stonit,привет!

Бъркате последователността!

Моля, внимателно и последователно изпълнете стъпките дадени в Системата ми е инфектирана - Какво да правя сега?

20 август 200917 г.

Автор

@stonit,привет!

Бъркате последователността!
Моля, внимателно и последователно изпълнете стъпките дадени в Системата ми е инфектирана - Какво да правя сега?

направих сканиране и ето ги и логовете

Malwarebytes' Anti-Malware 1.40

Версия на базата от данни: 2634

Windows 5.1.2600 Service Pack 3

20.8.2009 г. 22:33:28

mbam-log-2009-08-20 (22-33-22).txt

Тип сканиране: Пълно сканиране (C:\|D:\|E:\|)

Сканирани обекти: 258269

Изминало време: 36 minute(s), 3 second(s)

Заразени процеси в паметта: 0

Заразени модули в паметта: 0

Заразени ключове в регистратурата: 2

Заразени стойности в регистратурата: 0

Заразени информационни обекти в регистратурата: 0

Заразени папки: 0

Заразени файлове: 1

Заразени процеси в паметта:

(Не бяха открити заплахи)

Заразени модули в паметта:

(Не бяха открити заплахи)

Заразени ключове в регистратурата:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba0bb009-26ef-485b-b9e6-4d05a7dea005} (Trojan.BHO.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{ba0bb009-26ef-485b-b9e6-4d05a7dea005} (Trojan.BHO.H) -> No action taken.

Заразени стойности в регистратурата:

(Не бяха открити заплахи)

Заразени информационни обекти в регистратурата:

(Не бяха открити заплахи)

Заразени папки:

(Не бяха открити заплахи)

Заразени файлове:

C:\WINDOWS\system32\src32toolbar.dll (Trojan.BHO.H) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:45:05, on 20.8.2009 г.

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.21073)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\csrss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\IObit\IObit Security 360\IS360srv.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\windows\system32\nvsvc32.exe

C:\windows\Explorer.EXE

C:\windows\System32\TUProgSt.exe

C:\windows\System32\alg.exe

C:\windows\system32\svchost.exe

C:\windows\system32\RUNDLL32.EXE

C:\windows\RTHDCPL.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\IObit\IObit Security 360\IS360tray.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe

C:\windows\system32\ctfmon.exe

C:\windows\system32\svchost.exe

C:\windows\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

E:\PORTABLE\picpick\picpick.exe

C:\HiJackThis\Kaldata.exe.exe

C:\windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.a...&tbid=60076

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: (no name) - {BA0BB009-26EF-485B-B9E6-4D05A7DEA005} - C:\WINDOWS\system32\src32toolbar.dll

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [iObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: &Експортиране към Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MOIPRO~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: iOpus iMacros - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\windows\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: iMacros Web Automation - {0483894E-2422-45E0-8384-021AFF1AF3CD} - C:\windows\system32\shdocvw.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: Изпрати към OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Изпрати към OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll

O9 - Extra button: (no name) - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - (no file)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Expression\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\windows\system32\shdocvw.dll

O9 - Extra 'Tools' menuitem: PDF Download - Options - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\windows\system32\shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{F03B972A-981C-4AF8-ACAA-7AA2997E11F8}: NameServer = 213.16.56.1 213.16.56.9

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: McAfee Application Installer Cleanup (0060981233937232) (0060981233937232mcinstcleanup) - Unknown owner - C:\DOCUME~1\user\LOCALS~1\Temp\0060981233937232mcinst.exe (file missing)

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe

O23 - Service: PDAgent - Unknown owner - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (file missing)

O23 - Service: PDEngine - Unknown owner - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (file missing)

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe (file missing)

O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - Unknown owner - E:\New Folder (4)\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe (file missing)

O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\windows\System32\TuneUpDefragService.exe

O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\windows\System32\TUProgSt.exe

--

End of file - 9350 bytes

Редактирано 20 август 200917 г. от stonit (преглед на промените)

20 август 200917 г.

Здравейте,stonit

Моля, имайте предвид следното:

1.Аз ще Ви помагам само за почистването на вашата система от зловреден софтуер. За всякакви други проблеми, моля създайте нова тема в съответния форум и опишете детайлно проблема Ви.

2.Решението се отнася само за този проблем и само на този компютър.

3.Следвайте инструкциите ми стриктно, докато не Ви кажа, че системата Ви е напълно чиста. Това, че симптомите са изчезнали, не значи че всичко е наред.

4.Ако не разбирате нещо, моля Ви попитайте ме, а не рискувайте. По-добре е малко да се позабавим, отколкото да усложним нещата.

5.Цялата кореспонденция минава през тази тема, не създавайте нова тема и не използвайте друга тема за тази цел.

И така да започваме:

Стъпка-1

Спиране на System Restore: Десен бутон на My Computer => Properties => System Restore => слагате отметка пред Turn Off System Restore all hard drives -->потвърждавате

Стъпка-2

Изтеглете ATF Cleaner

Запазете го на вашия десктоп.

Кликнете два пъти върху ATF-Cleaner.exe , за да стартирате програмата.
Кликнете на Select All, който се намира в най-долната част на списъка.
Кликнете на бутона Empty Selected.

Ако използвате браузъра Mozilla Firefox, направете следното:

Кликнете върху Firefox, който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Ако използвате браузъра Opera, направете следното:

Кликнете върху Opera който се намира в началото и изберете Select All от списъка.
Кликнете на бутона Empty Selected.
Бележка: Ако искате да съхраните запазените пароли, моля кликнете на No от новопоявилия се прозорец.

Кликнете на бутона Exit, който се намира в главното меню, за да затворите програмата.

Стъпка-3

Моля, отворете HijackThis, и изберете Do a system scan only.

Сложете отметки на следните редове:

O9 - Extra button: (no name) - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - (no file)

O9 - Extra button: (no name) - {AD9E6088-E00B-42f9-9F0C-8480525D234E} - C:\windows\system32\shdocvw.dll

O23 - Service: McAfee Application Installer Cleanup (0060981233937232) (0060981233937232mcinstcleanup) - Unknown owner - C:\DOCUME~1\user\LOCALS~1\Temp\0060981233937232mcinst.exe (file missing)

След това, затворете всички отворени прозорци, освен този на HiJackThis, и изберете Fix checked.

Стъпка-4

Потвърдете изтриване на откритите заплахи от Malwarebytes' Anti-Malware

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

След като приключите,т.е. изпълните всичките стъпки,ще ви помоля за още един лог от HijackThis тук.

20 август 200917 г.

Автор

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:23:36, on 21.8.2009 г.