Здравейте. От вчера забелязах,че на моменти процесора ми достига стойности близки до 100% или 100%,при което компютъра ми временно забива.Търсих из нета и разбрах,че има няколко възможни причини за това.Едната е да съм лепнал гадина,а другата е въпросния svchost.exe.Имам 6 такива процеса и това ми пречи на процесора.Преди няколко дни бях сканирал с Avira,Nod 32.Не намериха нищо,а преди малко направих един quick scan с MBAM,но нямаше гадини. Изчетох доста неща,включително и няколко теми в kaldata,но не намерих решение.В нета пишеше,че може би се появяват заради ъпдейтите на windows или нещо такова.Четох някакви неща за програмка от сайта на Microsoft наречена Process Explorer,но така и не разбрах как да си оправя проблема.Накрая дадох End process на едно от 6 те и процесора ми вече не е толкова натоварен,но предполагам,че при следващото включване на компа пак ще се пусне.Какво да направя за да спра това натоварване напълно?Преди две седмици преинсталирах уина.

Редактирано 11 октомври 201015 г. от jamc (преглед на промените)

Здравейте,

Ще ви помоля да се запознаете с правилата на раздела:

Системата ми е инфектирана - Какво да правя сега?

Второ в зависимост от това къде са разположени (стандартно в C:\Windows\system32) са си напълно легитимни и изпълняват функцията на възли между отделните услуги в Операционната Система. Колкото повече услуги имате стартирани, толкова повече нараства и броя на тези процеси...Аз съм с Windows 7 x64 и имам 11 броя.

Мерси за темата.Ще я видя.Това значи ли,че натоварването може да не се дължи на гадина или някой от тези процеси?Компютърът ми не е първа младост,но преди няколко дни това го нямаше.

В наши дни всичко е възможно...изпълнете условията от темата и колегите ще Ви проверят за гадини. Възможно е да е някой червей от сорта на Conficker или просто инжектиран зловреден код в легитимния процес. Ако не бъде установена зараза, по метода на изключването ще знаем, че причината е другаде. Поздрави !

И докато колегите те проверяват за гадини, ти набързо провери дали не си минал в PIO режим.

Ето лога от MBAM

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4795

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

10/8/2010 9:08:51 AM

mbam-log-2010-10-08 (09-08-51).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 279700

Time elapsed: 1 hour(s), 19 minute(s), 34 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Лог от DDS.txt

DDS (Ver_10-10-10.03) - NTFSx86

Run by user at 9:11:46.62 on Fri 10/08/2010

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_21

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.447.117 [GMT 3:00]

AV: ESET NOD32 Antivirus 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ActiveArmor Firewall *disabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

============== Running Processes ===============

D:\WINDOWS\system32\nvsvc32.exe

D:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

D:\WINDOWS\System32\svchost.exe -k netsvcs

D:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\RTHDCPL.EXE

D:\WINDOWS\system32\RUNDLL32.EXE

D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

D:\WINDOWS\system32\ctfmon.exe

svchost.exe

D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

D:\Program Files\Java\jre6\bin\jqs.exe

D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

D:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

D:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

D:\WINDOWS\system32\wuauclt.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\WINDOWS\system32\notepad.exe

D:\Documents and Settings\user\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

mWinlogon: SfcDisable=-99 (0xffffff9d)

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - d:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - d:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - d:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - d:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: StylerToolBar: {d2f8f919-690b-4ea2-9fa7-a203d1e04f75} - d:\program files\styler\tb\StylerTB.dll

uRun: [ctfmon.exe] d:\windows\system32\ctfmon.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [nwiz] d:\program files\nvidia corporation\nview\nwiz.exe /installquiet

mRun: [NvMediaCenter] RUNDLL32.EXE d:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [NvCplDaemon] RUNDLL32.EXE d:\windows\system32\NvCpl.dll,NvStartup

mRun: [egui] "d:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

dRunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32

IE: &???????????? ??? Microsoft Excel - d:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: Download Using &BitSpirit - c:\program files\bitspirit\bsurl.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - d:\progra~1\micros~1\office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - d:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~1\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - d:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - d:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - d:\progra~1\common~1\skype\SKYPE4~1.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - d:\windows\system32\wpdshserviceobj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - d:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - d:\docume~1\user\applic~1\mozilla\firefox\profiles\cybzfzyd.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.bg

FF - plugin: d:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: d:\program files\mozilla firefox\plugins\npwachk.dll

---- FIREFOX POLICIES ----

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;d:\windows\system32\drivers\ehdrv.sys [2010-7-29 115008]

R1 epfwtdir;epfwtdir;d:\windows\system32\drivers\epfwtdir.sys [2010-8-3 95896]

R2 ekrn;ESET Service;d:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-8-12 810144]

S3 GGSAFERDriver;GGSAFER Driver;\??\d:\program files\garena\plugins\ui\safedrv.sys --> d:\program files\garena\plugins\ui\safedrv.sys [?]

=============== Created Last 30 ================

2010-10-08 00:13:57 -------- d-----w- d:\docume~1\user\applic~1\Malwarebytes

2010-10-08 00:13:26 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys

2010-10-08 00:13:24 20952 ----a-w- d:\windows\system32\drivers\mbam.sys

2010-10-08 00:13:24 -------- d-----w- d:\docume~1\alluse~1\applic~1\Malwarebytes

2010-10-08 00:13:23 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware

2010-10-07 13:26:44 -------- d-----w- d:\program files\Vista Drive Icon

2010-10-07 13:23:01 -------- d-----w- d:\docume~1\user\applic~1\IconTweaker

2010-10-07 13:23:01 -------- d-----w- d:\docume~1\alluse~1\applic~1\IconTweaker

2010-10-07 13:22:59 -------- d-----w- d:\program files\IconTweaker

2010-10-07 13:21:00 -------- d-----w- d:\docume~1\user\applic~1\Styler

2010-10-07 13:20:16 -------- d-----w- d:\program files\Styler

2010-10-06 16:47:19 -------- d--h--w- D:\ece7e58b62e0905e8742851b35

2010-10-06 14:58:02 -------- d-----w- d:\documents and settings\user\.thumbnails

2010-10-05 21:31:03 -------- d-----w- d:\docume~1\user\applic~1\yess

2010-10-05 18:16:10 -------- d-----w- d:\windows\system32\appmgmt

2010-10-05 17:52:06 -------- d-----w- d:\program files\ESET

2010-10-05 16:03:15 -------- d-----w- d:\windows\system32\NtmsData

2010-10-04 02:41:29 -------- d-----w- d:\program files\Disktrix

2010-10-04 02:39:29 -------- d-----w- d:\docume~1\user\applic~1\IObit

2010-10-04 02:39:28 -------- d-----w- d:\program files\IObit

2010-09-30 15:38:59 62744 ----a-w- d:\windows\system32\xinput1_2.dll

2010-09-30 15:36:10 -------- d--h--w- d:\windows\msdownld.tmp

2010-09-29 22:10:27 12160 ----a-w- d:\windows\system32\drivers\mouhid.sys

2010-09-29 22:10:25 14592 ----a-w- d:\windows\system32\drivers\kbdhid.sys

2010-09-29 22:09:51 5728 ----a-w- d:\windows\system32\drivers\WmVirHid.sys

2010-09-29 22:09:51 44288 ----a-w- d:\windows\system32\drivers\WmXlCore.sys

2010-09-29 22:09:51 10144 ----a-w- d:\windows\system32\drivers\WmBEnum.sys

2010-09-29 22:09:50 -------- d-----w- d:\program files\common files\Logitech

2010-09-29 22:09:31 57344 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll

2010-09-29 22:09:31 5632 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe

2010-09-29 22:09:31 237568 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll

2010-09-29 22:09:31 155648 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll

2010-09-29 22:09:30 696320 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll

2010-09-29 22:09:30 282756 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll

2010-09-29 22:09:30 163972 ----a-w- d:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll

2010-09-29 21:37:43 -------- d-----w- d:\docume~1\user\applic~1\BSplayer PRO

2010-09-29 21:37:26 -------- d-----w- d:\program files\Webteh

2010-09-29 20:18:42 2388176 ----a-w- d:\windows\system\d3dx9_30.dll

2010-09-29 16:10:42 -------- d-----w- d:\docume~1\user\applic~1\XnView

2010-09-29 16:10:01 -------- d-----w- d:\program files\XnView

2010-09-29 16:05:32 -------- d-----w- d:\program files\CCleaner

2010-09-29 08:24:47 -------- d-----w- d:\documents and settings\user\.gimp-2.6

2010-09-29 08:22:52 -------- d-----w- d:\program files\GIMP-2.0

2010-09-29 06:22:51 -------- d-----w- d:\docume~1\alluse~1\applic~1\POP3Profiles

2010-09-29 06:17:39 69714 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\ctor.dll

2010-09-29 06:17:39 274432 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\iscript.dll

2010-09-29 06:17:39 184320 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\iuser.dll

2010-09-29 06:17:38 753664 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\iKernel.dll

2010-09-29 06:17:38 5632 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\DotNetInstaller.exe

2010-09-29 06:17:30 331908 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\setup.dll

2010-09-29 06:17:30 200836 ----a-w- d:\program files\common files\installshield\professional\runtime\11\00\intel32\iGdi.dll

2010-09-29 04:26:29 -------- d-----w- d:\program files\Nero9 Portable

2010-09-29 04:25:08 -------- d-----w- d:\docume~1\user\locals~1\applic~1\Xenocode

2010-09-28 21:27:24 -------- d-----w- d:\docume~1\alluse~1\applic~1\Blizzard Entertainment

2010-09-28 15:22:41 1892184 ----a-w- d:\windows\system32\D3DX9_42.dll

2010-09-28 15:22:40 3426072 ----a-w- d:\windows\system32\d3dx9_32.dll

2010-09-28 15:22:37 2414360 ----a-w- d:\windows\system32\d3dx9_31.dll

2010-09-28 15:22:25 -------- d-----w- d:\windows\Logs

2010-09-28 15:22:08 -------- d-----w- d:\program files\Winamp Detect

2010-09-28 15:10:37 -------- d-----w- d:\program files\uTorrent

2010-09-28 15:10:18 -------- d-----w- d:\docume~1\user\applic~1\uTorrent

2010-09-28 06:59:49 -------- d-----w- d:\docume~1\user\applic~1\.minecraft

2010-09-28 06:57:06 73728 ----a-w- d:\windows\system32\javacpl.cpl

2010-09-28 06:57:06 423656 ----a-w- d:\windows\system32\deployJava1.dll

2010-09-28 06:57:06 423656 ----a-w- d:\program files\mozilla firefox\plugins\npdeployJava1.dll

2010-09-28 06:35:40 36864 ----a-w- d:\windows\system32\drivers\AmdK8.sys

2010-09-28 06:23:54 75776 ------w- d:\windows\system32\dllcache\strmfilt.dll

2010-09-28 06:23:54 25088 ------w- d:\windows\system32\dllcache\httpapi.dll

2010-09-28 06:23:53 265728 ------w- d:\windows\system32\dllcache\http.sys

2010-09-28 03:19:57 -------- d-----w- d:\docume~1\alluse~1\applic~1\NVIDIA Corporation

2010-09-28 03:19:52 232968 ----a-w- d:\windows\system32\nvdrsdb0.bin

2010-09-28 03:19:49 232968 ----a-w- d:\windows\system32\nvdrsdb1.bin

2010-09-28 03:19:49 1 ----a-w- d:\windows\system32\nvdrssel.bin

2010-09-28 03:18:48 61440 ----a-w- d:\windows\system32\OpenCL.dll

2010-09-28 03:18:46 4595712 ----a-w- d:\windows\system32\nvcuda.dll

2010-09-28 03:18:46 2914408 ----a-w- d:\windows\system32\nvcuvid.dll

2010-09-28 03:18:46 2506344 ----a-w- d:\windows\system32\nvcuvenc.dll

2010-09-28 03:18:45 2195030 ----a-w- d:\windows\system32\nvdata.bin

2010-09-28 03:18:45 10260480 ----a-w- d:\windows\system32\nvcompiler.dll

2010-09-28 03:18:37 -------- d-----w- D:\NVIDIA

2010-09-28 01:04:05 -------- d-----w- d:\windows\system32\Lang

2010-09-28 00:58:54 16049664 ------r- d:\windows\RTHDCPL.exe

==================== Find3M ====================

2010-08-17 13:17:06 58880 ----a-w- d:\windows\system32\spoolsv.exe

2010-08-02 04:52:40 95048 ----a-w- d:\windows\system32\UDBDef.exe

2010-07-22 15:49:15 590848 ----a-w- d:\windows\system32\rpcrt4.dll

2010-07-22 05:57:20 5120 ----a-w- d:\windows\system32\xpsp4res.dll

============= FINISH: 9:12:59.84 ===============

Лог от Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-10-10.03)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 9/27/2010 11:50:07 PM

System Uptime: 10/8/2010 7:47:08 AM (2 hours ago)

Motherboard: | | K8NF6G-VSTA

Processor: AMD Sempron Processor 3000+ | CPUSocket | 1808/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 15 GiB total, 9.281 GiB free.

D: is FIXED (NTFS) - 175 GiB total, 121.845 GiB free.

G: is CDROM ()

H: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP8: 9/28/2010 12:09:26 AM - Software Distribution Service 3.0

RP9: 9/28/2010 3:58:35 AM - Installed Realtek High Definition Audio Driver

RP10: 9/28/2010 9:56:40 AM - Installed Java 6 Update 21

RP11: 9/28/2010 6:22:32 PM - Installed DirectX

RP12: 9/29/2010 9:18:18 AM - Installed Prince of Persia The Two Thrones

RP13: 9/29/2010 9:22:51 AM - Installed Prince of Persia The Two Thrones

RP14: 9/30/2010 1:09:44 AM - Installed Logitech Gaming Software

RP15: 9/30/2010 6:38:48 PM - Installed DirectX

RP16: 10/4/2010 2:48:26 PM - Installed Microsoft Visual C++ 2005 Redistributable

RP17: 10/5/2010 8:52:03 PM - Installed ESET NOD32 Antivirus

RP18: 10/5/2010 8:57:59 PM - Installed Steam

RP19: 10/5/2010 9:16:04 PM - Removed Steam

RP20: 10/5/2010 9:17:03 PM - Installed Steam

RP21: 10/7/2010 4:20:15 PM - Installed Styler

RP22: 10/7/2010 4:40:15 PM - Removed Steam

RP23: 10/8/2010 3:00:50 AM - Software Distribution Service 3.0

RP24: 10/8/2010 3:37:49 AM - Software Distribution Service 3.0

==== Installed Programs ======================

µTorrent

2007 Microsoft Office Suite Service Pack 2 (SP2)

Adobe Flash Player 10 Plugin

Advanced SystemCare 3

BS.Player PRO

CCleaner

Counter-Strike 1.6: New Era

Disktrix UltimateDefrag

ESET NOD32 Antivirus

GIMP 2.6.10

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB976002-v5)

Hotfix for Windows XP (KB981793)

IconTweaker 1.12

Java Auto Updater

Java 6 Update 21

Jed's Half-Life Model Viewer 1.3.6

Logitech Gaming Software

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Halo

Microsoft Office Access MUI (Bulgarian) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (Bulgarian) 2007

Microsoft Office Groove MUI (Bulgarian) 2007

Microsoft Office InfoPath MUI (Bulgarian) 2007

Microsoft Office OneNote MUI (Bulgarian) 2007

Microsoft Office Outlook MUI (Bulgarian) 2007

Microsoft Office PowerPoint MUI (Bulgarian) 2007

Microsoft Office Proof (Bulgarian) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Russian) 2007

Microsoft Office Proofing (Bulgarian) 2007

Microsoft Office Publisher MUI (Bulgarian) 2007

Microsoft Office Shared MUI (Bulgarian) 2007

Microsoft Office Word MUI (Bulgarian) 2007

Microsoft Software Update for Web Folders (Bulgarian) 12

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mozilla Firefox (3.6.10)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

NVIDIA nView Desktop Manager

Prince of Persia T2T

Prince of Persia The Two Thrones

Realtek High Definition Audio Driver

Resident Evil 4 1.10

Security Update for 2007 Microsoft Office System (KB2277947)

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for 2007 Microsoft Office System (KB982312)

Security Update for 2007 Microsoft Office System (KB982331)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB982308)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office Outlook 2007 (KB2288953)

Security Update for Microsoft Office PowerPoint 2007 (KB982158)

Security Update for Microsoft Office Publisher 2007 (KB982124)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2251419)

Security Update for Windows Internet Explorer 7 (KB2183461)

Security Update for Windows Internet Explorer 7 (KB938127-v2)

Security Update for Windows Internet Explorer 7 (KB958215)

Security Update for Windows Internet Explorer 7 (KB960714)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Skype Toolbars

Skype™ 4.2

Styler

Unlocker 1.9.0

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office OneNote 2007 (KB980729)

Update for Outlook 2007 Junk Email Filter (kb2291599)

Update for Windows XP (KB2141007)

Update for Windows XP (KB955759)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973815)

Vista Drive Icon 1.4

WebFldrs XP

Winamp

Winamp Application Detect

Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)

WinRAR archiver

Worms Reloaded

XnView 1.97.8

==== Event Viewer Messages From Past Week ========

10/8/2010 8:34:54 AM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk0\D.

10/8/2010 3:24:07 AM, error: Service Control Manager [7031] - The Windows Driver Foundation - User-mode Driver Framework service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

10/7/2010 4:29:22 PM, error: Service Control Manager [7038] - The SSDPSRV service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: Access is denied. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

10/7/2010 4:29:22 PM, error: Service Control Manager [7000] - The SSDP Discovery Service service failed to start due to the following error: The service did not start due to a logon failure.

10/5/2010 6:56:21 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .

10/5/2010 6:56:21 PM, error: SideBySide [59] - Generate Activation Context failed for D:\DOCUME~1\user\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .

10/5/2010 6:56:21 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.

10/4/2010 11:15:09 PM, error: W32Time [34] - The time service has detected that the system time needs to be changed by +124736 seconds. The time service will not change the system time by more than +54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|192.168.1.3:123->207.46.232.182:123) is working properly.

==== End Of File ===========================

Редактирано 12 октомври 201015 г. от jamc (преглед на промените)

Здравей, jamc! Сега ще проверим какво става с Windows. Затова:

Стъпка 1

Start -> Run -> cmd и въведете с Copy/Paste следния текст, маркиран в синьо:

tasklist /svc /fi "imagename eq svchost.exe" >> D:\log.txt

натиснете ENTER. Пуснете съдържанието на D:\log.txt в следващия си коментар.

Стъпка 2

Следвайте следната инструкция за работа с GMER:

• Изтеглете този файл и го разархивирайте на десктопа.
• Временно спрете Интернет и всички работещи програми, както и антивирусната си програма (ако има такава).
• Преименувайте GMER.exe на Tool.exe и го стартирайте.

  Забележки:

  1. Сканирането може да доведе до грешки, затова не предприемайте никакви действия върху редовете маркирани с "<--- ROOKIT" без да имате инструкция за това.

  2. Ако GMER не се стартира или не работи коректно, не предприемайте повторен опит за стартиране. Moже да пробвате и в Safe Mode, но само веднъж.

• Ако бъде открит Rootkit, ще последва въпрос дали желаете пълно сканиране на системата. Изберете NO.
• В десния панел на програмата ще видите какво е проверено, но не променяйте нищо. Убедете се, че на Show All няма отметка.
• Маркирайте всички устройства: C:, D: и пр.
• Натиснете бутона Scan и изчакайте програмата да завърши сканирането.
• Когато завърши сканирането, натиснете бутона Save и запишете (save as) резултатите на десктопа с име: Results.log
• Вече можете да включите Интернет.
• Публикувайте съдържанието на Results.log в следващия си коментар.

Стъпка 3

Следвайте следната инструкция за работа със SystemLook:

Изтеглете SystemLook и запазете програмата на десктопа.

• Кликнете два пъти върху SystemLook.exe, за да стартирате програмата.
• Копирайте съдържанието от цитата по-долу в текстовото поле на програмата:

  :filefind

  *atapi*

• Кликнете на бутона Look, за да започне сканирането.
• Когато сканирането завърши ще се отвори Notepad с резултата от сканирането. После публикувайте лог файла в следващия си коментар.

Стъпка 4

Следвайте следната инструкция за работа с Security Check:

• Изтеглете Security Check (автор: screen317) от тук или от тук и го запишете на десктопа.
• Кликнете два пъти върху SecurityCheck.exe и следвайте инструкциите.
• Когато програмата завърши работата си, ще се отвори един текстов документ: checkup.txt.
• Копирайте съдържанието с Копирай (Copy) на checkup.txt и с Постави (Paste) го поставете в следващия си коментар.