От няколко дни нод32 започна да изписва за проблем с файла C:\WINDOWS\system32\SYSLIB32.DLL и го дава като Win32/Sality.H вирус. Започна и да ми дава проблем със всяко .exe на програмите,на инсталирани и такива за инсталация нода ми реже дори и хрома. DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 6.0.2900.5512 Run by Georgi at 12:13:18 on 2012-02-18 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.2047.1324 [GMT 2:00] . AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ============== Running Processes ================ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\alg.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\VMSnap23.exe C:\WINDOWS\Domino.exe C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Update\GoogleUpdate.~01 C:\WINDOWS\Datecs\Flex2K.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\USB all-in-one game controller\GM_DevUpdate.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Chrome\Application\chrome.~01 C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Chrome\Application\chrome.~01 C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Chrome\Application\chrome.~01 C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Chrome\Application\chrome.~01 C:\Documents and Settings\Georgi\Local Settings\Application Data\Google\Chrome\Application\chrome.~01 C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll uRun: [Google Update] "c:\documents and settings\georgi\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun mRun: [soundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [soundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray mRun: [bigDogPath323VMSnap] c:\windows\VMSnap23.exe mRun: [bigDogPath323Domino] c:\windows\Domino.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\georgi\startm~1\programs\startup\gm_dev~1.lnk - c:\program files\usb all-in-one game controller\GM_DevUpdate.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\windows\datecs\Flex2K.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\viarai~1.lnk - c:\program files\via\raid\raid_tool.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe TCP: NameServer = 88.203.162.129 192.168.0.1 TCP: Interfaces\{3FA859A8-1D12-42AF-AAC8-D8CEB5D625FB} : DHCPNameServer = 88.203.162.129 192.168.0.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Notify: AtiExtEvent - Ati2evxx.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\georgi\application data\mozilla\firefox\profiles\w4qjt19c.default\ FF - plugin: c:\documents and settings\georgi\local settings\application data\google\update\1.3.21.99\npGoogleUpdate3.dll . ============= SERVICES / DRIVERS =============== . R0 Vax347b;Vax347b;c:\windows\system32\drivers\Vax347b.sys [2012-2-13 159616] R0 Vax347s;Vax347s;c:\windows\system32\drivers\Vax347s.sys [2012-2-13 5248] R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2012-2-13 77312] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-12-21 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-12-21 94872] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2011-1-12 810144] R2 StarWindService;StarWind iSCSI Service;c:\program files\alcohol soft\alcohol 120\starwind\StarWindService.exe [2005-4-2 217600] R3 GMFilter;GMFilter HID Filter Driver;c:\windows\system32\drivers\GMFilter.sys [2012-2-13 19840] R3 vmfilter323;323 filter service, Normal;c:\windows\system32\drivers\vmfilter323.sys [2012-2-13 476672] R3 ZSMC326;CANYON USB PC Camera;c:\windows\system32\drivers\usbvm323.sys [2012-2-13 260224] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-1-31 158856] . =============== Created Last 30 ================ . 2012-02-18 09:43:19 -------- d-----w- c:\program files\ESET 2012-02-18 08:33:32 -------- d-----w- c:\documents and settings\georgi\application data\ESET 2012-02-17 20:27:27 -------- d-----w- c:\windows\system32\wbem\repository\FS 2012-02-17 20:27:27 -------- d-----w- c:\windows\system32\wbem\Repository 2012-02-17 20:05:09 4608 ------w- c:\windows\system32\trz18EF.tmp 2012-02-17 19:57:45 -------- d-----w- c:\program files\AVAST Software 2012-02-17 19:57:45 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software 2012-02-17 15:57:34 -------- d-----w- c:\documents and settings\georgi\application data\Wise Registry Cleaner 2012-02-17 15:55:26 -------- d-----w- c:\program files\Wise Registry Cleaner 2012-02-15 17:51:56 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\ctor.dll 2012-02-15 17:51:56 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iscript.dll 2012-02-15 17:51:56 180224 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iuser.dll 2012-02-15 17:51:55 749568 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iKernel.dll 2012-02-15 17:51:55 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\DotNetInstaller.exe 2012-02-15 17:51:53 192644 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\iGdi.dll 2012-02-15 17:51:52 323716 ----a-w- c:\program files\common files\installshield\professional\runtime\10\50\intel32\setup.dll 2012-02-13 19:12:46 -------- d-----w- c:\documents and settings\georgi\application data\ParetoLogic 2012-02-13 19:12:46 -------- d-----w- c:\documents and settings\georgi\application data\DriverCure 2012-02-13 19:12:35 -------- d-----w- c:\program files\ParetoLogic 2012-02-13 19:12:35 -------- d-----w- c:\documents and settings\all users\application data\ParetoLogic 2012-02-13 19:02:08 -------- d-----w- c:\windows\XSxS 2012-02-13 19:02:08 -------- d-----w- c:\program files\Xenocode . ==================== Find3M ==================== . 2012-02-18 09:41:32 4608 ---ha-w- c:\windows\system32\SYSLIB32.DLL 2012-02-13 17:20:24 6912 ----a-w- c:\windows\fonts\ID10B4.tmp 2012-02-13 17:20:23 68848 ----a-w- c:\windows\fonts\ID10B2.tmp 2012-02-13 16:54:10 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-02-13 16:25:13 0 ----a-w- c:\windows\ativpsrm.bin 2012-02-13 16:06:59 20747 ----a-w- c:\windows\system32\drivers\AegisP.sys 2012-02-07 18:00:00 79360 ----a-w- c:\windows\system32\ff_vfw.dll 2012-01-08 13:55:51 91376 ----a-r- c:\windows\system32\bcmwlcoi.dll 2012-01-08 13:55:51 3551232 ----a-r- c:\windows\system32\bcmihvui.dll 2012-01-08 13:55:51 2494968 ----a-r- c:\windows\system32\drivers\BCMWL6.SYS 2012-01-08 13:55:50 3862528 ----a-r- c:\windows\system32\bcmihvsrv.dll 2011-12-21 18:14:02 151552 ----a-w- c:\windows\system32\ac3acm.acm . ============= FINISH: 12:13:41,93 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-09-30.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume2 Install Date: 2/13/2012 5:57:24 PM System Uptime: 2/18/2012 11:40:27 AM (1 hours ago) . Motherboard: ASUSTeK Computer INC. | | A7V880 Processor: AMD Athlon 2200+ | SOCKET462 | 1800/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 16 GiB total, 8.66 GiB free. D: is FIXED (NTFS) - 61 GiB total, 5.979 GiB free. E: is CDROM () F: is CDROM () G: is FIXED (NTFS) - 75 GiB total, 12.686 GiB free. H: is CDROM (CDFS) . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP1: 2/13/2012 6:00:00 PM - System Checkpoint RP2: 2/13/2012 6:06:38 PM - Installed ASUS WLAN Card Utilities/Driver RP3: 2/13/2012 6:09:43 PM - ESET NOD32 Antivirus е инсталиран RP4: 2/13/2012 6:12:02 PM - Installed VIA Integrated Setup Wizard RP5: 2/13/2012 6:32:08 PM - Installed SoundMAX RP6: 2/13/2012 6:32:19 PM - Installed SoundMAX RP7: 2/13/2012 6:43:37 PM - Инсталиран CANYON USB PC Camera RP8: 2/13/2012 7:11:18 PM - Installed Microsoft Office Professional Edition 2003 RP9: 2/13/2012 7:37:23 PM - Installed Alcohol 120% RP10: 2/13/2012 9:02:46 PM - Before uninstalling iFly Jets - The 737NG for FS2004 RP11: 2/13/2012 9:15:31 PM - Before uninstalling ParetoLogic PC Health Advisor RP12: 2/15/2012 7:52:17 PM - Installed PMDG747_400 Queen of the Skies RP13: 2/15/2012 7:58:00 PM - Installed PMDG_747-400_Sound_Update RP14: 2/17/2012 1:20:00 PM - System Checkpoint RP15: 2/17/2012 5:33:04 PM - ESET NOD32 Antivirus е премахнат RP16: 2/17/2012 5:36:26 PM - Installed ESET NOD32 Antivirus RP17: 2/17/2012 9:49:42 PM - Removed ESET NOD32 Antivirus RP18: 2/17/2012 9:57:45 PM - avast! Free Antivirus Setup RP19: 2/17/2012 10:10:29 PM - Before uninstalling avast! Free Antivirus RP20: 2/17/2012 10:25:45 PM - Restore Operation RP21: 2/18/2012 9:43:20 AM - ESET NOD32 Antivirus е премахнат RP22: 2/18/2012 10:31:50 AM - Installed ESET Smart Security RP23: 2/18/2012 10:36:00 AM - Removed ESET Smart Security RP24: 2/18/2012 11:43:14 AM - ESET NOD32 Antivirus е инсталиран . ==== Installed Programs ====================== . Adobe Flash Player 11 Plugin Adobe Reader 7.0 AMD APP SDK Runtime AMD Catalyst Install Manager ASUS WLAN Card Utilities/Driver BS.Player PRO CANYON USB PC Camera Catalyst Control Center Catalyst Control Center - Branding Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-utility CCC Help English ESET NOD32 Antivirus FlexType 2K Google Chrome K-Lite Codec Pack 8.3.2 (Full) Microsoft .NET Framework 2.0 Microsoft Flight Simulator 2004 A Century of Flight Microsoft Office Professional Edition 2003 Mozilla Firefox 10.0.1 (x86 bg) Nero 6 Ultra Edition PMDG_747-400_Sound_Update PMDG747_400 Queen of the Skies PowerDVD SA Dictionary 2004 Datacenter Skype™ 5.8 SoundMAX TNod User & Password Finder USB all-in-one game controller VIA Integrated Setup Wizard WebFldrs XP Winamp (remove only) WinRAR archiver µTorrent . ==== Event Viewer Messages From Past Week ======== . 2/18/2012 10:33:00 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 002215EC91C8. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. 2/16/2012 11:34:22 AM, error: Service Control Manager [7038] - The SSDPSRV service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: Access is denied. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 2/16/2012 11:34:22 AM, error: Service Control Manager [7000] - The SSDP Discovery Service service failed to start due to the following error: The service did not start due to a logon failure. 2/14/2012 10:34:49 AM, error: Service Control Manager [7038] - The ALG service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: Access is denied. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). 2/14/2012 10:34:49 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not start due to a logon failure. 2/13/2012 6:22:17 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.MFC. Reference error message: The referenced assembly is not installed on your system. . 2/13/2012 6:22:17 PM, error: SideBySide [59] - Generate Activation Context failed for C:\Program Files\ATI\CIM\Bin\SetACL.exe.Manifest. Reference error message: The operation completed successfully. . 2/13/2012 6:22:17 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.MFC could not be found and Last Error was The referenced assembly is not installed on your system. 2/13/2012 6:05:45 PM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC80.CRT. Reference error message: The referenced assembly is not installed on your system. . 2/13/2012 6:05:45 PM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\bcmihvui.dll. Reference error message: The operation completed successfully. . 2/13/2012 6:05:45 PM, error: SideBySide [32] - Dependent Assembly Microsoft.VC80.CRT could not be found and Last Error was The referenced assembly is not installed on your system. . ==== End Of File ===========================

Много неприятно..!Аз бих ви препоръчал едно сканиране с Kaspersky Virus Removal Tool 2011 за да видим до каква степен е поразена системата ви и има ли смисъл въобще да опитваме лечение:

След като стартирате инструмента, отидете до Settings (Иконата която прилича на звездичка) сложете отметка пред My Computer.

От опциите за почистване изберете Disinfect => но не избирайте delete if disinfection fails.

Върнете се до Automatic Scan и натиснете Start Scanning.

Ако по време на сканирането ви попита за дадено действие изберете skip.

След като приключи проверката изберете Report (Иконата която прилича на листче) => Detected Threats изберете SAVE и запазете документа на десктопа.

Kопирайте съдържанието му в следващия си пост.

Затворете инструмента - това ще до деинсталира автоматично.

Колко време е това сканиране,че минаха 3 часа а ми дава 26 процента? И да питам уиндоуския формат изчиства ли тези неща или те са плъзнали по всички дялове и хардове?

А колко засечени обекта има ..?

И да питам уиндоуския формат изчиства ли тези неща или те са плъзнали по всички дялове и хардове?

Sality проявява апетит към всички файлове с разширения .exe и .scr на всички дялове на дадена система.По скоро трябва да се направи чиста инсталация (Метод 1),с изтриване на всички дялове, формат и инсталация нa Windows.

Понеже хардовете са два значи и двата да форматирам така ли?

Само харда на който е инсталирана операционната система..!

Ако имате ценни файлове, може да ги запишете някъде в нета. Но избягвайте следните файлови разширения: EXE, SCR, ZIP, RAR, 7z, HTM, HTML, PHP, ASP.

п.п Всъщност какъв е проблема за да не изчакате сканирането с Касперски да завърши и да видим резултата..?

Оправих нещата засега,оставих да досканира,изчистих ги,инсталация на уиндоуса и нода спря да се обажда. БЛАГОДАРЯ за отделеното време и помощта!!!

Вие си решавате..!Но аз не мисля че всико е ок при вас...!Но ...както казах ви си решавате..!