От 3-4 дена насам изкочи някакъв вирус в компютъра ми който непрекъснато го кара да забива през 1-2 минути и с всякакви антивирусни от А до Я пробвах да го премахна, но уви дори не показва че нещо яде компа.. Надявам се да помогнете по някъв начин защото вмомента нямам възможност да го преинсталирам!

Здравейте..!А защо и как решихте че това е вирус...?Системата ми е инфектирана - Какво да правя сега? (точка 5).Очаквам дневници от програмата DDS...!

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Administrator at 18:43:10 on 2012-03-21 Microsoft Windows XP Professional 5.1.2600.3.1251.359.1033.18.767.502 [GMT 2:00] . . ============== Running Processes ================ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\FsUsbExService.Exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Samsung\Kies\KiesTrayAgent.exe C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe C:\Program Files\Networx-BG\Helper\Helper.exe C:\Program Files\Datecs\FlexType 2K\FType2K.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\msdtc.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\system32\svchost.exe -k DcomLaunch C:\WINDOWS\system32\svchost.exe -k rpcss C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\System32\svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.bg/ mStart Page = about:blank BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [KiesHelper] c:\program files\samsung\kies\KiesHelper.exe /s uRun: [KiesTrayAgent] c:\program files\samsung\kies\KiesTrayAgent.exe uRun: [KiesPDLR] c:\program files\samsung\kies\external\firmwareupdate\KiesPDLR.exe uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [NetworxHelper] c:\program files\networx-bg\helper\Helper.exe uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe" mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\flexty~1.lnk - c:\program files\datecs\flextype 2k\FType2K.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - <orphaned> IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: Interfaces\{925A3D2F-5BF2-4051-B4D9-B4A355BA2499} : NameServer = 212.25.58.229 212.25.58.2 Handler: skype-ie-addon-data - <Clsid value has no data> Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll . ============= SERVICES / DRIVERS =============== . R0 BtHidBus;Bluetooth HID Bus Service;c:\windows\system32\drivers\BtHidBus.sys [2009-1-7 20744] R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-11-16 101720] R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2011-4-3 233472] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-3-20 652360] R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2011-4-3 36608] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-3-20 20464] R4 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys --> c:\windows\system32\drivers\avgntflt.sys [?] R4 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys --> c:\windows\system32\drivers\avkmgr.sys [?] S2 gupdate;Ус»уі° Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-9-26 136176] S3 ADASPROT;SYSTWEAKASO;\??\c:\program files\advanced system optimizer 3\adasprot32.sys --> c:\program files\advanced system optimizer 3\adasprot32.sys [?] S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\drivers\btnetBus.sys [2008-12-7 30088] S3 cpuz132;cpuz132;\??\c:\docume~1\admini~1\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\admini~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?] S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2011-4-3 20032] S3 ESLvnic1;ESLvnic Virtual Network 32 Bit;c:\windows\system32\drivers\ESLvnic.sys [2010-11-3 24504] S3 GGSAFERDriver;GGSAFER Driver;\??\d:\igri\warcraft iii\garena messenger\room\safedrv.sys --> d:\igri\warcraft iii\garena messenger\room\safedrv.sys [?] S3 gupdatem;Ус»уі° Ѕ° Google рєту°»ё·°цёя (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-9-26 136176] S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\drivers\IvtBtBus.sys [2008-7-2 26248] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336] . =============== Created Last 30 ================ . 2012-03-21 06:03:12 -------- d-----w- c:\program files\Avira 2012-03-20 19:44:53 20464 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-03-20 19:44:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2012-03-20 05:16:33 -------- d-----w- c:\program files\AVAST Software 2012-03-20 05:16:33 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software 2012-03-17 19:56:34 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Halfbrick 2012-03-17 19:55:58 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Intel 2012-03-15 20:06:35 98816 ----a-w- c:\windows\sed.exe 2012-03-15 20:06:35 256000 ----a-w- c:\windows\PEV.exe 2012-03-15 20:06:35 208896 ----a-w- c:\windows\MBR.exe 2012-03-15 19:42:10 -------- d-----w- c:\documents and settings\administrator\application data\SpeedyPC Software 2012-03-15 19:41:35 -------- d-----w- c:\documents and settings\all users\application data\SpeedyPC Software 2012-03-15 19:34:52 -------- d-----w- c:\documents and settings\administrator\application data\ParetoLogic 2012-03-15 19:34:52 -------- d-----w- c:\documents and settings\administrator\application data\DriverCure 2012-03-15 19:32:57 -------- d-----w- c:\documents and settings\all users\application data\ParetoLogic 2012-03-15 19:00:11 -------- d-----w- c:\program files\Spybot - Search & Destroy 2012-03-15 19:00:11 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy 2012-02-25 08:31:49 274288 ----a-w- c:\windows\system32\mucltui.dll 2012-02-25 08:31:49 215920 ----a-w- c:\windows\system32\muweb.dll 2012-02-25 08:31:49 16736 ----a-w- c:\windows\system32\mucltui.dll.mui . ==================== Find3M ==================== . 2012-02-25 08:31:50 414368 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-02-03 09:22:18 1860096 ----a-w- c:\windows\system32\win32k.sys 2012-01-11 19:06:47 3072 ------w- c:\windows\system32\iacenc.dll 2012-01-10 19:18:43 12872 -c--a-w- c:\windows\system32\bootdelete.exe 2012-01-09 16:20:25 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2012-01-08 20:19:50 1409 -c--a-w- c:\windows\system32\tmpB3FE2.FOT 2011-12-30 15:03:08 21336 -c--a-w- c:\windows\system32\RegistryDefragBootTime.exe 2003-04-15 17:27:18 793536 -c--a-w- c:\program files\wmpcdcs8.exe 2002-12-11 20:11:50 4085904 -c--a-w- c:\program files\wmfdist.exe . ============= FINISH: 18:45:23,20 =============== Понеже изписва че е много дълъг коментара , реших да го прикача.

attach.txt

Това ли е...добре ли прочетохте точка 5 от Системата ми е инфектирана - Какво да правя сега? .Мисля че трябва да има още един дневник..!Освен това имате остатъци от повече от един антивирусен софтуер (Avira + AVAST)...това не е желателно...!

за Avira използвайте - Avira RegistryCleaner

за AVAST използвайте - aswclear5.exe

Е нали го прикачих и отдолу писах че не мога да го копирам понеже е дълго и сайта не позволява дълги коментари.

Да видях....почистете остатъците от антивирусните програми..!

Изтеглете OTL.exe и го запазете на десктопа.

• Стартирайте OTL (ако е необходимо, потвърдете през UAC).
• Направете следните настройки:
• Сложете отметка пред Scan All Users
• Под менюто File Age => изберете 90 days
• Под менюто Standard Registry => променете на ALL
• Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcs
msconfig
safebootminimal
safebootnetwork
%SYSTEMDRIVE%\*.*
%USERPROFILE%\*.*
%USERPROFILE%\Application Data\*.*
%USERPROFILE%\Local Settings\Application Data\*.*
%AllUsersProfile%\*.*
%AllUsersProfile%\Application Data\*.*
%USERPROFILE%\My Documents\*.*
%CommonProgramFiles%\*.*
%PROGRAMFILES%\*.*
%systemroot%\system32\config\systemprofile\*.*
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.*
%windir%\temp*.*
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\GAC_32\*.* /S /MD5
%systemroot%\assembly\GAC_MSIL\*.* /S /MD5
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
/md5start
explorer.exe
lsass.exe
svchost.exe
wininit.exe
winlogon.exe
userinit.exe
atapi.sys
iaStor.sys
serial.sys
disk.sys
volsnap.sys
redbook.sys
i8042prt.sys
afd.sys
netbt.sys
tcpip.sys
ipsec.sys
hlp.dat
/md5stop

• Натиснете маркираният в синьо бутон: Run Scan.
• Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията "прикачени файлове", когато публикувате мнение).

Готово

OTL.Txt

Extras.Txt

Деинсталирайте Комбофикс...защо сте го използвали незнам..!

1.Натиснете Start ==> Run ==> въведете командата Combofix /Uninstall ==> OK

2.Изтеглете OTCleanIt или от тук,стартирайте и натиснете

Стартирайте отново OTL, копирайте (Copy) и поставете (Paste) скриптовия текст от текстовото поле по-долу под колонката Custom Scans/Fixes, като не забравяте да копирате скрипта 1 към 1, както и двете точки преди първия ред на скрипта.

:OTL
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (awdlexja)
@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07BF512B

:Reg

:files

autorun.inf /alldrives
autorun.exe /alldrives
recycler /alldrives
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[clearallrestorepoints]
[emptyflash]
[Reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

Windows ще се рестартира и ще се създаде лог файл. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

Показва ми че нямам инсталиран комбофикс, пък тази последната стъпка изобщо неще да сканира! Колкото и пъти да пусна с същите настройки по-горе и тия кодове само забива компа и нищо..

???

Настройките при изпълнение на скрипта са по подразбиране ...!Когато копираш ,стартираш изпълнението с Run Fix...!