Здравейте. За да не пускам нова тема, имам същия проблем! Анти вироса ми е алвира и засече 2 вироса. Преди това същия файл посочен от 1 пост го свалих, и така започнаха мизериите.Праща се самичък на всички те ми абонати на скайп, и даже друга програма за чат ''ексфире".Скайпа няколко пъти блокира.Оставих за малко пц-то и като доидох алвирата се е активирала,вирус засича в тази директория "c:\users\public\mdm.exe" - сложих го в карантината и го изтъркъх. С какво да проверя дали се е справила и 2рия вирус с какво и него да премахна? Трябвали да преинсталирам уина? Благодаря предварително.Ако сам объркал нещо извинявам се. Ето рапорта от Алвира: Avira AntiVir Personal Report file date: 24 февруари 2012 г. 21:02 Scanning for 3497648 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - Free Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows 7 Windows version : (Service Pack 1) [6.1.7601] Boot mode : Normally booted Username : SYSTEM Computer name : SPASKATA-PC Version information: BUILD.DAT : 10.2.0.707 36070 Bytes 25.1.2012 г. 13:11:00 AVSCAN.EXE : 10.3.0.7 484008 Bytes 12.1.2012 г. 19:46:44 AVSCAN.DLL : 10.0.5.0 47464 Bytes 12.1.2012 г. 19:46:44 LUKE.DLL : 10.3.0.5 45416 Bytes 12.1.2012 г. 19:46:45 LUKERES.DLL : 10.0.0.1 12648 Bytes 10.2.2010 г. 22:40:49 AVSCPLR.DLL : 10.3.0.7 119656 Bytes 12.1.2012 г. 19:46:45 AVREG.DLL : 10.3.0.9 88833 Bytes 12.1.2012 г. 19:46:45 VBASE000.VDF : 7.10.0.0 19875328 Bytes 6.11.2009 г. 08:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 г. 14:15:47 VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 г. 19:46:44 VBASE003.VDF : 7.11.21.238 4472832 Bytes 1.2.2012 г. 12:18:51 VBASE004.VDF : 7.11.21.239 2048 Bytes 1.2.2012 г. 12:20:26 VBASE005.VDF : 7.11.21.240 2048 Bytes 1.2.2012 г. 12:20:26 VBASE006.VDF : 7.11.21.241 2048 Bytes 1.2.2012 г. 12:20:26 VBASE007.VDF : 7.11.21.242 2048 Bytes 1.2.2012 г. 12:20:27 VBASE008.VDF : 7.11.21.243 2048 Bytes 1.2.2012 г. 12:20:32 VBASE009.VDF : 7.11.21.244 2048 Bytes 1.2.2012 г. 12:20:32 VBASE010.VDF : 7.11.21.245 2048 Bytes 1.2.2012 г. 12:20:32 VBASE011.VDF : 7.11.21.246 2048 Bytes 1.2.2012 г. 12:20:32 VBASE012.VDF : 7.11.21.247 2048 Bytes 1.2.2012 г. 12:20:32 VBASE013.VDF : 7.11.22.33 1486848 Bytes 3.2.2012 г. 14:52:53 VBASE014.VDF : 7.11.22.56 687616 Bytes 3.2.2012 г. 14:53:30 VBASE015.VDF : 7.11.22.92 178176 Bytes 6.2.2012 г. 23:10:29 VBASE016.VDF : 7.11.22.154 144896 Bytes 8.2.2012 г. 13:51:36 VBASE017.VDF : 7.11.22.220 183296 Bytes 13.2.2012 г. 01:56:32 VBASE018.VDF : 7.11.23.34 202752 Bytes 15.2.2012 г. 16:29:55 VBASE019.VDF : 7.11.23.98 126464 Bytes 17.2.2012 г. 20:08:07 VBASE020.VDF : 7.11.23.150 148480 Bytes 20.2.2012 г. 17:29:32 VBASE021.VDF : 7.11.23.224 172544 Bytes 23.2.2012 г. 16:47:20 VBASE022.VDF : 7.11.23.225 2048 Bytes 23.2.2012 г. 16:47:21 VBASE023.VDF : 7.11.23.226 2048 Bytes 23.2.2012 г. 16:47:21 VBASE024.VDF : 7.11.23.227 2048 Bytes 23.2.2012 г. 16:47:21 VBASE025.VDF : 7.11.23.228 2048 Bytes 23.2.2012 г. 16:47:22 VBASE026.VDF : 7.11.23.229 2048 Bytes 23.2.2012 г. 16:47:22 VBASE027.VDF : 7.11.23.230 2048 Bytes 23.2.2012 г. 16:47:22 VBASE028.VDF : 7.11.23.231 2048 Bytes 23.2.2012 г. 16:47:23 VBASE029.VDF : 7.11.23.232 2048 Bytes 23.2.2012 г. 16:47:23 VBASE030.VDF : 7.11.23.233 2048 Bytes 23.2.2012 г. 16:47:23 VBASE031.VDF : 7.11.23.248 67072 Bytes 24.2.2012 г. 16:47:26 Engineversion : 8.2.10.8 AEVDF.DLL : 8.1.2.2 106868 Bytes 12.1.2012 г. 19:46:44 AESCRIPT.DLL : 8.1.4.7 442746 Bytes 24.2.2012 г. 16:48:30 AESCN.DLL : 8.1.8.2 131444 Bytes 27.1.2012 г. 20:06:25 AESBX.DLL : 8.2.4.5 434549 Bytes 12.1.2012 г. 19:46:44 AERDL.DLL : 8.1.9.15 639348 Bytes 12.1.2012 г. 19:46:44 AEPACK.DLL : 8.2.16.3 799094 Bytes 10.2.2012 г. 13:53:38 AEOFFICE.DLL : 8.1.2.25 201084 Bytes 12.1.2012 г. 19:46:44 AEHEUR.DLL : 8.1.4.0 4436342 Bytes 24.2.2012 г. 16:48:25 AEHELP.DLL : 8.1.19.0 254327 Bytes 20.1.2012 г. 13:22:51 AEGEN.DLL : 8.1.5.21 409971 Bytes 4.2.2012 г. 14:53:48 AEEXP.DLL : 8.1.0.23 70005 Bytes 24.2.2012 г. 16:48:30 AEEMU.DLL : 8.1.3.0 393589 Bytes 28.3.2011 г. 14:15:19 AECORE.DLL : 8.1.25.4 201079 Bytes 13.2.2012 г. 12:03:11 AEBB.DLL : 8.1.1.0 53618 Bytes 28.3.2011 г. 14:15:19 AVWINLL.DLL : 10.0.0.0 19304 Bytes 28.3.2011 г. 14:15:31 AVPREF.DLL : 10.0.3.2 44904 Bytes 12.1.2012 г. 19:46:44 AVREP.DLL : 10.0.0.10 174120 Bytes 12.1.2012 г. 19:46:45 AVARKT.DLL : 10.0.26.1 255336 Bytes 12.1.2012 г. 19:46:44 AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 12.1.2012 г. 19:46:44 SQLITE3.DLL : 3.6.19.0 355688 Bytes 17.6.2010 г. 13:27:22 AVSMTP.DLL : 10.0.0.17 63848 Bytes 28.3.2011 г. 14:15:30 NETNT.DLL : 10.0.0.0 11624 Bytes 28.3.2011 г. 14:15:39 RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 12.1.2012 г. 19:46:43 RCTEXT.DLL : 10.0.64.0 97640 Bytes 12.1.2012 г. 19:46:43 Configuration settings for the scan: Jobname.............................: avguard_async_scan Configuration file..................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_50224525\guard_slideup.avp Logging.............................: Default Primary action......................: interactive Secondary action....................: quarantine Scan master boot sector.............: on Scan boot sector....................: off Process scan........................: on Scan registry.......................: off Search for rootkits.................: off Integrity checking of system files..: off Scan all files......................: All files Scan archives.......................: on Recursion depth.....................: 20 Smart extensions....................: on Macro heuristic.....................: on File heuristic......................: Complete Start of the scan: 24 февруари 2012 г. 21:02 c:\users\public\mdm.exe [DETECTION] Is the TR/Crypt.EPACK.Gen8 Trojan The system restore point was created successfully. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'AlanWake.exe' - '1' Module(s) have been scanned Scan process 'speedfan.exe' - '1' Module(s) have been scanned Scan process 'plugin-container.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'Xfire.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'mdm.exe' - '1' Module(s) have been scanned Module is infected -> <c:\Users\Public\mdm.exe> [DETECTION] Is the TR/Crypt.EPACK.Gen8 Trojan [NOTE] Process 'mdm.exe' was terminated [NOTE] The registration entry <HKEY_USERS\S-1-5-21-3567940217-749211190-5165922-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Firevall Engine> was successfully repaired. [NOTE] The file was moved to the quarantine directory under the name '4a954d38.qua'. Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'uTorrent.exe' - '1' Module(s) have been scanned Scan process 'wmpnetwk.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'RocketDock.exe' - '1' Module(s) have been scanned Scan process 'sidebar.exe' - '1' Module(s) have been scanned Scan process 'VCDDaemon.exe' - '1' Module(s) have been scanned Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'Dwm.exe' - '1' Module(s) have been scanned Scan process 'taskhost.exe' - '1' Module(s) have been scanned Scan process 'nvvsvc.exe' - '1' Module(s) have been scanned Scan process 'nvxdsync.exe' - '1' Module(s) have been scanned Scan process 'conhost.exe' - '1' Module(s) have been scanned Scan process 'TeamViewer_Service.exe' - '1' Module(s) have been scanned Scan process 'avshadow.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'nvvsvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned Starting to scan executable files (registry). c:\users\public\mdm.exe [DETECTION] Is the TR/Crypt.EPACK.Gen8 Trojan [NOTE] The file could not be copied to quarantine! [NOTE] The file does not exist! Starting the file scan: Begin scan in 'C:\Users\Public\mdm.exe' Search path C:\Users\Public\mdm.exe could not be opened! System error [2]: Системата не може да намери указания файл. End of the scan: 24 февруари 2012 г. 21:14 Used time: 12:12 Minute(s) The scan has been done completely. 0 Scanned directories 1054 Files were scanned 2 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 0 files were deleted 0 Viruses and unwanted programs were repaired 1 Files were moved to quarantine 0 Files were renamed 0 Files cannot be scanned 1052 Files not concerned 1 Archives were scanned 0 Warnings 2 Notes

СТЪПКА 1

• Изтеглете Malwarebytes' Anti-Malware оттук и я инсталирайте.
• Стартирайте Malwarebytes' Anti-Malware и отидете на UPDATE и натиснете Check for updates.
• След това се върнете на Scanner изберете Perform FULL Scan, след това кликнете на Scan.
• Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
• Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
• Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
• Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Забележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

СТЪПКА 2

Следвайте стъпките в темата отдолу и публикувайте лог от DDS.

Системата ми е инфектирана - Какво да правя сега?