Не мога да инсталирам антивирусна - Sality - Премахване на зловреден софтуер - Kaldata.com

10 януари 201313 г.

Здравейте имам вирус който не ми дава да инсталирам антивирусна и да ползвам някой подобни програми. Task Manager е изключен и не мога да го включа. Ето логовете от ДДС

Attach

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-09-30.01)

.

Microsoft Windows XP Professional

Boot Device: DeviceHarddiskVolume1

Install Date: 9/1/2012 6:52:16 AM

System Uptime: 1/10/2013 8:21:36 AM (4 hours ago)

.

Motherboard: FUJITSU SIEMENS | | AMILO Pa 1510

Processor: AMD Turion 64 X2 Mobile Technology TL-50 | Socket M2/S1G1 | 1596/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 21 GiB total, 7.459 GiB free.

D: is FIXED (NTFS) - 91 GiB total, 10.815 GiB free.

E: is CDROM ()

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description: Modem Device on High Definition Audio Bus

Device ID: HDAUDIOFUNC_02&VEN_1057&DEV_3055&SUBSYS_17340000&REV_10074&22F7A6FE&0&0001

Manufacturer:

Name: Modem Device on High Definition Audio Bus

PNP Device ID: HDAUDIOFUNC_02&VEN_1057&DEV_3055&SUBSYS_17340000&REV_10074&22F7A6FE&0&0001

Service:

.

==== System Restore Points ===================

.

RP153: 1/9/2013 3:48:42 AM - System Checkpoint

RP154: 1/10/2013 4:48:18 AM - System Checkpoint

RP155: 1/10/2013 11:21:37 AM - OTL Restore Point - 1/10/2013 11:21:32 AM

.

==== Installed Programs ======================

.

7-Zip 9.20

Adobe Acrobat 5.0

Adobe AIR

Adobe Flash Player 11 Plugin

AIMP3

Ask Toolbar

Atheros Client Installation Program

ATI - Software Uninstall Utility

ATI Catalyst Control Center

ATI Catalyst Registration

ATI Display Driver

ATI Parental Control & Encoder

AVG 2012

Bau-Simulator 2012 Version 1.0

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

ccc-core-preinstall

ccc-core-static

ccc-utility

CCC Help English

ConvertHelper 2.2

Cool WMV To MP3 Converter 1.0

Counter-Strike 1.6

Cutting 3 version 1.31

DAEMON Tools Pro

Driver Genius Professional Edition

Favorite-Games 5.20

Fishing Northern Europe

FlexType 2K

Foxit PDF Creator Toolbar Updater

Foxit Reader

Free MP3 Converter

Funmoods

GOM Player

Google Chrome

GTA San Andreas

GTAIII

Heroes of Might and Magic® III Complete

High Definition Audio Driver Package - KB888111

Hospital Haste

Hotfix for Windows XP (KB909394)

Hotfix for Windows XP (KB926239)

HTC BMP USB Driver

HTC Driver Installer

HTC Sync

Java 7 Update 9

Java Auto Updater

K-Lite Mega Codec Pack 9.2.0

KitchenDraw 5.0

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 4 Client Profile

Microsoft ActiveSync

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Mobile Translator

Mozilla Firefox 15.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVC80_x86_v2

MSVC90_x86

MSXML 4.0 SP3 Parser

MSXML 6.0 Parser

Nokia Connectivity Cable Driver

Nokia Ovi Suite

Nokia Ovi Suite Software Updater

O2Micro Flash Memory Card Windows Driver V2.04

Odyssey Client for Fujitsu Siemens Computers

Ovi Desktop Sync Engine

OviMPlatform

Pazera Free FLV to AVI Converter 1.5

PC Connectivity Solution

PC Sync Manager

Realtek High Definition Audio Driver

Serious Sam The Second Encounter

Skins

Skype™ 6.0

uTorrentControl_v2 Toolbar

WebFldrs XP

Winamp

Winamp Detector Plug-in

Windows Installer 3.1 (KB893803)

Windows Media Format 11 runtime

WMV To MP3 Converter 1.00

YouTube Downloader 3.0.0.0

µTorrent

.

==== Event Viewer Messages From Past Week ========

.

1/5/2013 6:11:14 PM, error: Dhcp [1002] - The IP address lease 192.168.1.7 for the Network Card with network address 00C0A8CA9031 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

1/5/2013 3:09:00 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service helpsvc with arguments "" in order to run the server: {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}

1/4/2013 8:19:51 PM, error: Service Control Manager [7001] - The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

1/4/2013 8:19:51 PM, error: Service Control Manager [7001] - The AVGIDSAgent service depends on the AVGIDSDriver service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

1/4/2013 8:18:38 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

.

==== End Of File ===========================

DDS

DDS (Ver_2011-09-30.01) - NTFS_x86

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 10.9.2

Run by Jack at 12:06:36 on 2013-01-10

Microsoft Windows XP Professional 5.1.2600.2.1251.1.1033.18.894.158 [GMT 1:00]

.

AV: AVG Internet Security 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

============== Running Processes ================

.

C:WINDOWSsystem32Ati2evxx.exe

C:Program FilesFujitsu Siemens ComputersOdyssey Client for Fujitsu Siemens ComputersodClientService.exe

C:Program FilesAVGAVG2012avgwdsvc.exe

C:Program FilesJavajre7binjqs.exe

C:WINDOWSsystem32o2flash.exe

C:Program FilesHTCInternet Pass-ThroughPassThruSvr.exe

C:WINDOWSsystem32Ati2evxx.exe

C:WINDOWSExplorer.EXE

C:WINDOWSRTHDCPL.EXE

C:Program FilesFujitsu Siemens ComputersOdyssey Client for Fujitsu Siemens ComputersOdTray.exe

C:Program FilesuTorrentuTorrent.exe

C:Program FilesSkypePhoneSkype.exe

C:Program FilesDatecsFlexType 2KFType2K.exe

C:Documents and SettingsJackLocal SettingsApplication DataGoogleChromeApplicationchrome.exe

C:Program FilesDAEMON Tools ProDTShellHlp.exe

C:Documents and SettingsJackMy DocumentsDownloadsOTL.exe

C:WINDOWSsystem32spider.exe

C:WINDOWSnotepad.exe

C:Documents and SettingsJackLocal SettingsApplication DataGoogleChromeApplicationchrome.exe

C:WINDOWSsystem32wbemwmiprvse.exe

C:WINDOWSsystem32svchost.exe -k DcomLaunch

C:WINDOWSsystem32svchost.exe -k rpcss

C:WINDOWSSystem32svchost.exe -k netsvcs

C:WINDOWSsystem32svchost.exe -k NetworkService

C:WINDOWSsystem32svchost.exe -k LocalService

C:WINDOWSsystem32svchost.exe -k netsvcs

C:WINDOWSSystem32svchost.exe -k HTTPFilter

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://btsearch.name

uDefault_Page_URL = hxxp://www.v9.com/?utm_source=b&utm_medium=umz-2&from=umz-2&uid=WDC_WD1200BEVS-07LAT0_WD-WXEX0658735487354&ts=1354303094

mStart Page = hxxp://www.v9.com/?utm_source=b&utm_medium=umz-2&from=umz-2&uid=WDC_WD1200BEVS-07LAT0_WD-WXEX0658735487354&ts=1354303094

mDefault_Page_URL = hxxp://www.v9.com/?utm_source=b&utm_medium=umz-2&from=umz-2&uid=WDC_WD1200BEVS-07LAT0_WD-WXEX0658735487354&ts=1354303094

mSearchAssistant = hxxp://search.v9.com/web/?q={searchTerms}

mCustomizeSearch = hxxp://search.v9.com/web/?q={searchTerms}

uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - c:program filesask.comGenericAskToolbar.dll

uURLSearchHooks: uTorrentControl_v2 Toolbar: {7473b6bd-4691-4744-a82b-7854eb3d70b6} - c:program filesutorrentcontrol_v2prxtbuTor.dll

uURLSearchHooks: YouTube Downloader: {031afb00-725a-4ede-9d27-a2b5fac89e9a} - c:documents and settingsjackYouTube Downloader.dll

mURLSearchHooks: YouTube Downloader: {031afb00-725a-4ede-9d27-a2b5fac89e9a} - c:documents and settingsjackYouTube Downloader.dll

BHO: YouTube Downloader: {031afb00-725a-4ede-9d27-a2b5fac89e9a} - c:documents and settingsjackYouTube Downloader.dll

BHO: AcroIEHlprObj Class: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:program filesadobeacrobat 5.0readeractivexAcroIEHelper.ocx

BHO: Funmoods Helper Object: {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - c:program filesfunmoods1.5.23.22bhescort.dll

BHO: Proxy Help: {F386E548-C533-472E-8C61-C026FB14FEA9} - c:windowssystem32Newtabs_v9.dll

TB: YouTube Downloader: {031afb00-725a-4ede-9d27-a2b5fac89e9a} - c:documents and settingsjackYouTube Downloader.dll

TB: Funmoods Toolbar: {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - c:program filesfunmoods1.5.23.22escorTlbr.dll

uRun: [uTorrent] "c:program filesutorrentuTorrent.exe" /MINIMIZED

uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"

mRun: [KernelFaultCheck] c:windowssystem32dumprep 0 -k

mRun: [OdTray.exe] "c:program filesfujitsu siemens computersodyssey client for fujitsu siemens computersOdTray.exe"

mRun: [MSConfig] c:windowspchealthhelpctrbinariesMSCONFIG.EXE /auto

StartupFolder: c:docume~1alluse~1startm~1programsstartupflexty~1.lnk - c:program filesdatecsflextype 2kFType2K.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:323

uPolicies-Explorer: NoDriveAutoRun = dword:67108863

uPolicies-Explorer: NoDrives = dword:0

uPolicies-System: DisableTaskMgr = dword:1

uPolicies-System: DisableRegistryTools = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:0

mPolicies-System: EnableInstallerDetection = dword:0

mPolicies-System: EnableSecureUIAPaths = dword:0

mPolicies-System: EnableVirtualization = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

mPolicies-System: EnableLUA = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:323

mPolicies-Explorer: NoDriveAutoRun = dword:67108863

mPolicies-System: DisableTaskMgr = dword:1

mPolicies-System: DisableRegistryTools = dword:1

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:program filesmicrosoft activesyncINetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:program filesmicrosoft activesyncINetRepl.dll

TCP: NameServer = 192.168.1.1

TCP: Interfaces{53915159-AACF-40EB-A22F-48A644A6512C} : DHCPNameServer = 192.168.1.1

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:program filesavgavg2012avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll

Notify: AtiExtEvent - Ati2evxx.dll

Notify: OdysseyClient - odyEvent.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:documents and settingsjackapplication datamozillafirefoxprofiles4tsg7yr5.default

FF - prefs.js: browser.search.selectedEngine - Search

FF - prefs.js: browser.startup.homepage - hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786

FF - prefs.js: keyword.URL - hxxp://btsearch.name/results.php?q=

FF - plugin: c:documents and settingsjacklocal settingsapplication datagoogleupdate1.3.21.123npGoogleUpdate3.dll

FF - plugin: c:program filesjavajre7binplugin2npjp2.dll

FF - plugin: c:windowssystem32macromedflashNPSWF32_11_5_502_135.dll

FF - plugin: c:windowssystem32npDeployJava1.dll

FF - plugin: c:windowssystem32npptools.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.funmoods.hmpg - true

FF - user.js: extensions.funmoods.hmpgUrl - hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786

FF - user.js: extensions.funmoods.dfltSrch - true

FF - user.js: extensions.funmoods.srchPrvdr - Search

FF - user.js: extensions.funmoods.dnsErr - true

FF - user.js: extensions.funmoods_i.newTab - true

FF - user.js: extensions.funmoods.newTabUrl - hxxp://searchfunmoods.com/?f=2&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786

FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://searchfunmoods.com/?f=3&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786&q=

FF - user.js: extensions.funmoods.id - 00C0A8CA90315815

FF - user.js: extensions.funmoods.instlDay - 15674

FF - user.js: extensions.funmoods.vrsn - 1.5.23.22

FF - user.js: extensions.funmoods.vrsni - 1.5.23.22

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.225:48:31

FF - user.js: extensions.funmoods.prtnrId - funmoods

FF - user.js: extensions.funmoods.prdct - funmoods

FF - user.js: extensions.funmoods.aflt - download

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods.tlbrId - base

FF - user.js: extensions.funmoods.instlRef - download

FF - user.js: extensions.funmoods.dfltLng -

FF - user.js: extensions.funmoods.excTlbr - false

FF - user.js: extensions.funmoods.autoRvrt - false

FF - user.js: extensions.funmoods.envrmnt - production

FF - user.js: extensions.funmoods.isdcmntcmplt - true

FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHX;AVGIDSHX;c:windowssystem32driversavgidshx.sys [2012-4-19 24896]

R0 O2MDRDR;O2MDRDR;c:windowssystem32driverso2media.sys [2006-2-28 34880]

R0 O2SDRDR;O2SDRDR;c:windowssystem32driverso2sd.sys [2006-2-21 29056]

R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [2012-7-26 237408]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:windowssystem32driversavgmfx86.sys [2011-12-23 41040]

R1 Avgtdix;AVG TDI Driver;c:windowssystem32driversavgtdix.sys [2012-8-25 301920]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:windowssystem32driversdtsoftbus01.sys [2012-9-1 242240]

R2 avgwd;AVG WatchDog;c:program filesavgavg2012avgwdsvc.exe [2012-2-14 193288]

R2 PassThru Service;Internet Pass-Through Service;c:program fileshtcinternet pass-throughPassThruSvr.exe [2011-9-15 88576]

R3 asc3360pr;asc3360pr;??c:windowssystem32driversrthmie.sys --> c:windowssystem32driversrthmie.sys [?]

S1 eusk2par;EUTRON SmartKey Parallel Driver;c:windowssystem32driverseusk2par.sys [2012-11-18 24786]

S2 AVGIDSAgent;AVGIDSAgent;c:program filesavgavg2012avgidsagent.exe [2012-8-13 5245560]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384]

S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2012-10-19 234672]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-10-4 250808]

S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [2012-9-1 1691480]

S3 htcnprot;HTC NDIS Protocol Driver;c:windowssystem32drivershtcnprot.sys [2010-6-23 21248]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:program filesmcafee security scan3.0.207McCHSvc.exe [2011-6-17 306640]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:windowsmicrosoft.netframeworkv4.0.30319wpfWPFFontCache_v0400.exe [2010-3-18 753504]

S4 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys --> c:windowssystem32driversavgidsdriverx.sys [?]

S4 AVGIDSFilter;AVGIDSFilter;c:windowssystem32driversavgidsfilterx.sys --> c:windowssystem32driversavgidsfilterx.sys [?]

S4 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys --> c:windowssystem32driversavgidsshimx.sys [?]

S4 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [2012-1-31 31952]

.

=============== Created Last 30 ================

.

2013-01-07 14:38:20 103344 ----a-w- c:program filesmozilla firefoxpluginsnppdf32.dll

2013-01-07 14:38:16 270336 ----a-w- c:program filesinternet explorerpluginsNPDocBox.dll

2013-01-07 14:38:16 103344 ------w- c:program filesinternet explorerpluginsnppdf32.dll

2013-01-07 14:38:16 -------- d-----w- c:windowsProfiles

2013-01-07 14:38:14 -------- d-----w- c:windowssystem32Adobe

2013-01-07 14:36:14 -------- d-----w- c:program filescommon files3DO Shared

2013-01-07 14:36:14 -------- d-----w- c:program files3DO

2013-01-05 15:46:10 -------- d-----w- c:program filesFujitsu Siemens Computers

2013-01-05 15:46:10 -------- d-----w- c:program filescommon filesFunk Software

2013-01-05 15:45:47 -------- d-----w- C:fsc.tmp

2013-01-05 15:10:06 -------- d-----w- c:program filesGOG.com

2013-01-01 05:07:35 -------- d-----w- c:documents and settingsjacklocal settingsapplication dataIdentities

2012-12-25 13:01:23 31616 -c--a-w- c:windowssystem32dllcacheusbccgp.sys

2012-12-25 13:01:23 31616 ----a-w- c:windowssystem32driversusbccgp.sys

2012-12-23 17:49:41 -------- d-----r- c:program filesSkype

.

==================== Find3M ====================

.

2013-01-05 15:46:23 532558 ----a-w- c:windowssystem32odGinaLibrary.dll

2013-01-05 15:46:23 139330 ----a-w- c:windowssystem32odyGina.dll

2013-01-05 15:46:23 106496 ----a-w- c:windowssystem32odyEvent.dll

2012-12-13 02:42:18 697272 ----a-w- c:windowssystem32FlashPlayerApp.exe

2012-12-13 02:42:17 73656 ----a-w- c:windowssystem32FlashPlayerCPLApp.cpl

2012-11-19 05:52:09 558133 ----a-w- c:windowssystem32sqlite3.dll

2012-11-18 22:05:12 14336 ----a-w- c:windowssystem32driversTrueSight.sys

2012-11-13 15:59:10 93672 ----a-w- c:windowssystem32WindowsAccessBridge.dll

2012-11-13 15:59:09 143872 ----a-w- c:windowssystem32javacpl.cpl

2012-11-13 15:59:08 821736 ----a-w- c:windowssystem32npDeployJava1.dll

2012-11-13 15:59:08 746984 ----a-w- c:windowssystem32deployJava1.dll

2012-11-06 11:56:32 446464 ----a-w- c:documents and settingsjackYouTube Downloader.dll

.

============= FINISH: 12:07:05.64 ===============

Благодаря предварително

Редактирано 12 януари 201313 г. от B-boy[StyLe] (преглед на промените)

10 януари 201313 г.

Мда...както се и очакваше...
Имате си Sality:

R3 asc3360pr;asc3360pr;??c:windowssystem32driversrthmie.sys --> c:windowssystem32driversrthmie.sys [?]

Можем да пробваме да го почистим, но не очаквайте чудеса. Това е полиморфен бацил и често почистването е загуба на време.
При такива бацили се препоръчва формат с изтриване на всички дялове и преинсталация. Да опитаме да спасим поне останалите дялове, а дяла на Windows по-всяка вероятност трябва да бъде поне преинсталиран:

1. Спрете Autorun функцията.
Изтеглете и стартирайте следния файл
Стартирайте го и се съгласете с лицензионното споразумение.
Натиснете Next и изчакайте да си свърпи работата.

2. Спрете System Restore функцията.

Щракнете с десен бутон върху My Computer, после следвайте следните стъпки: Properties -> System restore и сложете отметката пред Turn System Restore on all drives. Натиснете Apply.

3. Изтеглете SalityKiller и го запазете на десктопа.
Изключете интернет достъпа и след това сканирайте с него по описания по-надолу начин:

Изтеглете SalityKiller и го разархивирайте на десктопа.
Отворете Start => Run => въведете командата "%userprofile%desktopsalitykiller" -l c:report.txt
Изчакайте проверката да завърши.
Публикувайте съдържанието на лог файла C:report.txt в следващия си пост.

4.Направете една проверка с Kaspersky Virus Removal Tool
След като изтеглите инструмента, изключете достъпа до интернет.
Уверете се, че System restore опцията е изключена!

След като стартирате инструмента, отидете до Settings (Иконата, която прилича на звездичка) сложете отметка пред My Computer.

От опциите за почистване изберете Disinfect => но не избирайте delete if disinfection fails.

Върнете се до Automatic Scan и натиснете Start Scanning.

Ако по време на сканирането ви попита за дадено действие изберете skip.
След като приключи проверката изберете Report (Иконата която прилича на листче) => Detected Threats изберете SAVE и запазете документа на десктопа.

Kопирайте съдържанието му в следващия си пост.
Затворете инструмента - това ще до деинсталира автоматично.

10 януари 201313 г.

Автор

1-вото го направих но не ми дава да изтегля SalityKiller i Kaspersky. От няколко сайта пробвах но нестава. Даже и прикачените картинки не ми ги отваря, защото гледам че съдържат "Kaspersky" :?

Едит

И 2-рото го направих моя грешка

Редактирано 10 януари 201313 г. от Дечо (преглед на промените)

10 януари 201313 г.

Защо само първото...направете първите две точки.

А иначе SalityKiller го качих тук

Инструмента на Касперски ще го кача след малко...пуснете сега да сканирате със SalityKiller, както съм описал в предишните си инструкции и публикувайте лог файла.

10 януари 201313 г.

Автор

И от тука не ми го намира. Изписва ми че няма такъв url.... :?

10 януари 201313 г.

Автор

Намерих програмата. Ето го лога

17:22:22:937 2024 scanning threads ...

17:22:24:171 2024 Infected thread was killed in process ati2evxx.exe with PID 1520

17:22:24:296 2024 Infected thread was killed in process explorer.exe with PID 1656

17:22:25:281 2024 Infected thread was killed in process RTHDCPL.EXE with PID 1556

17:22:27:125 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:140 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:203 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:250 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:281 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:312 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:343 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:375 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:406 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:437 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:515 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:562 2024 Infected thread was killed in process uTorrent.exe with PID 776

17:22:27:890 2024 Infected thread was killed in process Skype.exe with PID 2116

17:22:27:937 2024 Infected thread was killed in process Skype.exe with PID 2116

17:22:31:359 2024 Infected thread was killed in process FType2K.exe with PID 2252

17:22:31:843 2024 Infected thread was killed in process DTShellHlp.exe with PID 2604

17:22:31:859 2024 Infected thread was killed in process DTShellHlp.exe with PID 2604

17:22:32:953 2024 Infected thread was killed in process avgemcx.exe with PID 2240

17:22:32:968 2024 Infected thread was killed in process avgemcx.exe with PID 2240

17:22:32:984 2024 Infected thread was killed in process avgemcx.exe with PID 2240

17:22:33:000 2024 Infected thread was killed in process avgemcx.exe with PID 2240

17:22:41:515 2024 Infected thread was killed in process odClientMgr.exe with PID 2568

17:22:41:625 2024 Infected thread was killed in process OdTray.exe with PID 2160

17:22:55:046 2024

17:22:55:046 2024 scanning processes ...

17:22:55:359 2024 C:Program FilesuTorrentuTorrent.exe infected Virus.Win32.Sality.aa ...17:22:55:656 2024 terminated

17:22:55:828 2024 C:Program FilesuTorrentuTorrent.exe infected Virus.Win32.Sality.aa ...17:22:55:828 2024 cured

17:22:55:921 2024 C:Program FilesDatecsFlexType 2KFType2K.exe infected Virus.Win32.Sality.aa ...17:22:56:234 2024 terminated

17:22:56:421 2024 C:Program FilesDatecsFlexType 2KFType2K.exe infected Virus.Win32.Sality.aa ...17:22:56:421 2024 cured

17:22:56:515 2024 C:Program FilesDAEMON Tools ProDTShellHlp.exe infected Virus.Win32.Sality.aa ...17:22:56:828 2024 terminated

17:22:57:000 2024 C:Program FilesDAEMON Tools ProDTShellHlp.exe infected Virus.Win32.Sality.aa ...17:22:57:000 2024 cured

17:22:57:234 2024 C:Program FilesAVGAVG2012avgemcx.exe infected Virus.Win32.Sality.aa ...17:22:57:546 2024 terminated

17:22:57:734 2024 C:Program FilesAVGAVG2012avgemcx.exe infected Virus.Win32.Sality.aa ...17:22:57:734 2024 cured

17:22:57:859 2024 C:Program FilesFujitsu Siemens ComputersOdyssey Client for Fujitsu Siemens ComputersodClientMgr.exe infected Virus.Win32.Sality.aa ...17:22:58:171 2024 terminated

17:22:58:343 2024 C:Program FilesFujitsu Siemens ComputersOdyssey Client for Fujitsu Siemens ComputersodClientMgr.exe infected Virus.Win32.Sality.aa ...17:22:58:343 2024 cured

17:22:58:484 2024 C:Program FilesFujitsu Siemens ComputersOdyssey Client for Fujitsu Siemens Computersodtray.exe infected Virus.Win32.Sality.aa ...17:22:58:781 2024 terminated

17:22:58:984 2024 C:Program FilesFujitsu Siemens ComputersOdyssey Client for Fujitsu Siemens Computersodtray.exe infected Virus.Win32.Sality.aa ...17:22:58:984 2024 cured

17:22:58:984 2024

17:22:58:984 2024 fixing registry ...

17:22:58:984 2000

Monitoring thread started

17:22:58:984 2024 SalityRegCure: Restoring general registry keys

17:22:59:000 2024 SalityRegCure: Fixing system.ini

17:22:59:000 2024

17:22:59:000 2024 scanning drives ...

17:22:59:000 2024 scanning C: ...

17:23:09:640 2024 C:ComboFixiexplore.exe infected Virus.Win32.Sality.aa ...17:23:09:640 2024 cured

17:23:10:312 2024 C:ComboFixNircmdB.exe infected Virus.Win32.Sality.aa ...17:23:10:312 2024 cured

17:23:11:750 2024 C:ComboFixSF.exe infected Virus.Win32.Sality.aa ...17:23:11:750 2024 cured

17:23:13:031 2024 C:ComboFixWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe infected Virus.Win32.Sality.aa ...17:23:13:031 2024 cured

17:23:13:484 2024 C:Documents and SettingsAll UsersApplication DataAdobeAIH.1e3ecf87259196555d847bcb3618b5a129b090fdinstall_flash_player.exe infected Virus.Win32.Sality.aa ...17:23:13:484 2024 cured

17:23:13:796 2024 C:Documents and SettingsAll UsersApplication DataAdobeAIH.1e3ecf87259196555d847bcb3618b5a129b090fdSecurityScan_Release.exe infected Virus.Win32.Sality.aa ...17:23:13:796 2024 cured

17:23:14:078 2024 C:Documents and SettingsAll UsersApplication DataAnti-phishing Domain Advisoruninstall.exe infected Virus.Win32.Sality.aa ...17:23:14:078 2024 cured

17:23:34:421 2024 C:Documents and SettingsAll UsersApplication DataMFADataSelfUpdavgmfapx.exe infected Virus.Win32.Sality.aa ...17:23:34:421 2024 cured

17:23:34:750 2024 C:Documents and SettingsAll UsersApplication DataMFADataSelfUpdavgrunasx.exe infected Virus.Win32.Sality.aa ...17:23:34:750 2024 cured

17:23:37:031 2024 C:Documents and SettingsAll UsersApplication DataMFADataSelfUpdsetup.exe infected Virus.Win32.Sality.aa ...17:23:37:031 2024 cured

17:23:38:921 2024 C:Documents and SettingsAll UsersApplication DataNokiaInstallerCacheProductCache{D5878294-C113-43c5-A24F-FC333C52015A}{7C41450A-4442-43F4-8DCA-BE04CC70A5EE}InstallerCommonCustomActionspcswpc.exe infected Virus.Win32.Sality.aa ...17:23:38:921 2024 cured

17:23:39:109 2024 C:Documents and SettingsAll UsersApplication DataNokiaInstallerCacheProductCache{D5878294-C113-43c5-A24F-FC333C52015A}{7C41450A-4442-43F4-8DCA-BE04CC70A5EE}InstallerCommonCustomActionsRun_XML6_SP1.exe infected Virus.Win32.Sality.aa ...17:23:39:109 2024 cured

17:23:39:296 2024 C:Documents and SettingsAll UsersApplication DataNokiaInstallerCacheProductCache{D5878294-C113-43c5-A24F-FC333C52015A}{7C41450A-4442-43F4-8DCA-BE04CC70A5EE}InstallerCommonCustomActionsWMF11Runx86.exe infected Virus.Win32.Sality.aa ...17:23:39:296 2024 cured

17:23:40:140 2024 C:Documents and SettingsAll UsersApplication DataNokiaInstallerCacheProductCache{D5878294-C113-43c5-A24F-FC333C52015A}{7C41450A-4442-43F4-8DCA-BE04CC70A5EE}InstallerInstallerServiceExec.exe infected Virus.Win32.Sality.aa ...17:23:40:140 2024 cured

17:23:40:359 2024 C:Documents and SettingsAll UsersApplication DataNokiaInstallerCacheProductCache{D5878294-C113-43c5-A24F-FC333C52015A}{7C41450A-4442-43F4-8DCA-BE04CC70A5EE}InstallerIsPinned.exe infected Virus.Win32.Sality.aa ...17:23:40:359 2024 cured

17:23:59:406 2024 C:Documents and SettingsJackApplication DataOpenCandyE4FF7788DD494AEC8D26419C6D65C2F0TuneUpUtilities2012_en-US-p2v0.exe infected Virus.Win32.Sality.aa ...17:23:59:406 2024 cured

17:24:06:921 2024 C:Documents and SettingsJackLocal SettingsApplication DataConduitCT3220468uTorrentControl_v2AutoUpdateHelper.exe infected Virus.Win32.Sality.aa ...17:24:06:921 2024 cured

17:24:07:562 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleChromeApplication21.0.1180.89chrome_frame_helper.exe infected Virus.Win32.Sality.aa ...17:24:07:562 2024 cured

17:24:08:031 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleChromeApplication21.0.1180.89flashplayerapp.exe infected Virus.Win32.Sality.aa ...17:24:08:031 2024 cured

17:24:14:984 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleChromeApplication22.0.1229.92chrome_frame_helper.exe infected Virus.Win32.Sality.aa ...17:24:14:984 2024 cured

17:25:11:421 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleUpdate1.3.21.123googleupdatesetup.exe infected Virus.Win32.Sality.aa ...17:25:11:421 2024 cured

17:25:12:046 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleUpdateDownload{430FD4D0-B729-4F61-AA34-91526481799D}1.3.21.125googleupdateb6998767.exe infected Virus.Win32.Sality.aa ...17:25:12:046 2024 cured

17:25:12:296 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleUpdateDownload{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}23.0.1271.6423.0.1271.64_22.0.1229.94_chrome_updater.exe infected Virus.Win32.Sality.aa ...17:25:12:296 2024 cured

17:25:12:515 2024 C:Documents and SettingsJackLocal SettingsApplication DataGoogleUpdateDownload{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}23.0.1271.6423.0.1271.64_chrome_installer.exe infected Virus.Win32.Sality.aa ...17:25:12:515 2024 cured

17:25:18:421 2024 C:Documents and SettingsJackLocal Settingstempnsm31B.tmpBI.exe infected Virus.Win32.Sality.aa ...17:25:18:421 2024 cured

17:25:18:750 2024 C:Documents and SettingsJackLocal Settingstempnsm31B.tmpDownloadACC.exe infected Virus.Win32.Sality.aa ...17:25:18:750 2024 cured

17:25:19:046 2024 C:Documents and SettingsJackLocal Settingstempnsm31B.tmpProxyInstaller.exe infected Virus.Win32.Sality.aa ...17:25:19:046 2024 cured

17:25:26:578 2024 C:Documents and SettingsJackLocal Settingstemp_ISTMP2.DIR_ISTMP0.DIRShFolder.Exe infected Virus.Win32.Sality.aa ...17:25:26:578 2024 cured

17:25:33:609 2024 C:Documents and SettingsJackMy DocumentsDownloadsdds.exe infected Virus.Win32.Sality.aa ...17:25:33:609 2024 cured

17:25:36:546 2024 C:Documents and SettingsJackMy DocumentsDownloadsMP3ConverterInstallzipMP3Converter.Me(Setup)setup.exe infected Virus.Win32.Sality.aa ...17:25:36:546 2024 cured

17:25:59:531 2024 C:KDsdiline.exe infected Virus.Win32.Sality.aa ...17:25:59:531 2024 cured

17:26:00:421 2024 C:KDunwise.exe infected Virus.Win32.Sality.aa ...17:26:00:437 2024 cured

17:26:00:875 2024 C:Program Files3DOgameup.exe infected Virus.Win32.Sality.aa ...17:26:00:875 2024 cured

17:26:01:562 2024 C:Program Files3DOSupportsupport.exe infected Virus.Win32.Sality.aa ...17:26:01:562 2024 cured

17:26:01:828 2024 C:Program Files3DOSupportSysInfo.exe infected Virus.Win32.Sality.aa ...17:26:01:828 2024 cured

17:26:02:203 2024 C:Program Files7-Zip7z.exe infected Virus.Win32.Sality.aa ...17:26:02:203 2024 cured

17:26:02:421 2024 C:Program Files7-Zip7zFM.exe infected Virus.Win32.Sality.aa ...17:26:02:421 2024 cured

17:26:02:609 2024 C:Program Files7-Zip7zG.exe infected Virus.Win32.Sality.aa ...17:26:02:609 2024 cured

17:26:03:234 2024 C:Program Files7-ZipUninstall.exe infected Virus.Win32.Sality.aa ...17:26:03:234 2024 cured

17:26:03:750 2024 C:Program FilesAdobeAcrobat 5.0ReaderAcroRd32.exe infected Virus.Win32.Sality.aa ...17:26:03:750 2024 cured

17:26:11:453 2024 C:Program FilesAMDDual-Core Optimizeramd_dc_opt.exe infected Virus.Win32.Sality.aa ...17:26:11:453 2024 cured

17:26:11:968 2024 C:Program FilesAsk.comprecache.exe infected Virus.Win32.Sality.aa ...17:26:11:968 2024 cured

17:26:12:468 2024 C:Program FilesAsk.comsaupdate.exe infected Virus.Win32.Sality.aa ...17:26:12:468 2024 cured

17:26:12:781 2024 C:Program FilesAsk.comUpdaterUpdater.exe infected Virus.Win32.Sality.aa ...17:26:12:781 2024 cured

17:26:13:046 2024 C:Program FilesAsk.comupdatetask.exe infected Virus.Win32.Sality.aa ...17:26:13:046 2024 cured

17:26:14:343 2024 C:Program FilesATI TechnologiesATI.ACEatishlx.exe infected Virus.Win32.Sality.aa ...17:26:14:343 2024 cured

17:26:19:531 2024 C:Program FilesATI TechnologiesATI.ACECore-Implementationlog.exe infected Virus.Win32.Sality.aa ...17:26:19:531 2024 cured

17:26:19:828 2024 C:Program FilesATI TechnologiesATI.ACECore-PreInstallatishlx.exe infected Virus.Win32.Sality.aa ...17:26:19:828 2024 cured

17:26:20:031 2024 C:Program FilesATI TechnologiesATI.ACECore-PreInstallcccinstall.exe infected Virus.Win32.Sality.aa ...17:26:20:031 2024 cured

17:26:20:562 2024 C:Program FilesATI TechnologiesATI.ACECore-Staticatishlx.exe infected Virus.Win32.Sality.aa ...17:26:20:562 2024 cured

17:26:20:843 2024 C:Program FilesATI TechnologiesATI.ACECore-StaticCCC.exe infected Virus.Win32.Sality.aa ...17:26:20:843 2024 cured

17:26:21:031 2024 C:Program FilesATI TechnologiesATI.ACECore-Staticcccinstall.exe infected Virus.Win32.Sality.aa ...17:26:21:031 2024 cured

17:26:21:406 2024 C:Program FilesATI TechnologiesATI.ACECore-Staticinstallshell.exe infected Virus.Win32.Sality.aa ...17:26:21:406 2024 cured

17:26:21:750 2024 C:Program FilesATI TechnologiesATI.ACECore-StaticMOM.exe infected Virus.Win32.Sality.aa ...17:26:21:750 2024 cured

17:26:24:921 2024 C:Program FilesATI TechnologiesATI.ACEdeveloperconsole.exe infected Virus.Win32.Sality.aa ...17:26:24:921 2024 cured

17:26:25:187 2024 C:Program FilesATI TechnologiesATI.ACEdxstress.exe infected Virus.Win32.Sality.aa ...17:26:25:187 2024 cured

17:26:30:343 2024 C:Program FilesATI TechnologiesATI.ACEGraphics-Full-Existingdxstress.exe infected Virus.Win32.Sality.aa ...17:26:30:343 2024 cured

17:26:30:687 2024 C:Program FilesATI TechnologiesATI.ACEGraphics-Full-Existingmmloaddrv.exe infected Virus.Win32.Sality.aa ...17:26:30:687 2024 cured

17:26:31:343 2024 C:Program FilesATI TechnologiesATI.ACEGraphics-Previews-Commoncccdspreview.exe infected Virus.Win32.Sality.aa ...17:26:31:343 2024 cured

17:26:31:593 2024 C:Program FilesATI TechnologiesATI.ACEGraphics-Previews-Commonmmaceprev.exe infected Virus.Win32.Sality.aa ...17:26:31:593 2024 cured

17:26:39:187 2024 C:Program FilesATI TechnologiesATI.ACElog.exe infected Virus.Win32.Sality.aa ...17:26:39:187 2024 cured

17:26:41:109 2024 C:Program FilesATI TechnologiesATI.ACEpreview.exe infected Virus.Win32.Sality.aa ...17:26:41:109 2024 cured

17:26:41:359 2024 C:Program FilesATI TechnologiesATI.ACEpreview_fs.exe infected Virus.Win32.Sality.aa ...17:26:41:359 2024 cured

17:26:45:921 2024 C:Program FilesATI TechnologiesATI.ACEthunk.exe infected Virus.Win32.Sality.aa ...17:26:45:921 2024 cured

17:26:46:125 2024 C:Program FilesATI TechnologiesATI.ACEToggle.exe infected Virus.Win32.Sality.aa ...17:26:46:125 2024 cured

17:26:46:890 2024 C:Program FilesATI TechnologiesATI.ACEWizard.exe infected Virus.Win32.Sality.aa ...17:26:46:890 2024 cured

17:26:49:828 2024 C:Program FilesATI TechnologiesUninstallAllAtiCimUn.exe infected Virus.Win32.Sality.aa ...17:26:49:828 2024 cured

17:26:50:515 2024 C:Program FilesAVGAVG2012avgcfgex.exe infected Virus.Win32.Sality.aa ...17:26:50:515 2024 cured

17:26:50:828 2024 C:Program FilesAVGAVG2012avgcmgr.exe infected Virus.Win32.Sality.aa ...17:26:50:828 2024 cured

17:26:51:140 2024 C:Program FilesAVGAVG2012avgcremx.exe infected Virus.Win32.Sality.aa ...17:26:51:140 2024 cured

17:26:51:375 2024 C:Program FilesAVGAVG2012avgcsrvx.exe infected Virus.Win32.Sality.aa ...17:26:51:375 2024 cured

17:26:51:640 2024 C:Program FilesAVGAVG2012avgdiagex.exe infected Virus.Win32.Sality.aa ...17:26:51:640 2024 cured

17:26:51:890 2024 C:Program FilesAVGAVG2012avgdumpx.exe infected Virus.Win32.Sality.aa ...17:26:51:890 2024 cured

17:26:52:250 2024 C:Program FilesAVGAVG2012avgidsagent.exe infected Virus.Win32.Sality.aa ...17:26:52:250 2024 cured

17:26:52:531 2024 C:Program FilesAVGAVG2012avgmfapx.exe infected Virus.Win32.Sality.aa ...17:26:52:531 2024 cured

17:26:52:843 2024 C:Program FilesAVGAVG2012avgndisx.exe infected Virus.Win32.Sality.aa ...17:26:52:843 2024 cured

17:26:53:375 2024 C:Program FilesAVGAVG2012avgrsx.exe infected Virus.Win32.Sality.aa ...17:26:53:375 2024 cured

17:26:53:765 2024 C:Program FilesAVGAVG2012avgscanx.exe infected Virus.Win32.Sality.aa ...17:26:53:765 2024 cured

17:26:54:046 2024 C:Program FilesAVGAVG2012avgsrmax.exe infected Virus.Win32.Sality.aa ...17:26:54:062 2024 cured

17:26:54:328 2024 C:Program FilesAVGAVG2012AVGTBInstall.exe infected Virus.Win32.Sality.aa ...17:26:54:328 2024 cured

17:26:54:562 2024 C:Program FilesAVGAVG2012avgui.exe infected Virus.Win32.Sality.aa ...17:26:54:562 2024 cured

17:26:54:828 2024 C:Program FilesAVGAVG2012avguirux.exe infected Virus.Win32.Sality.aa ...17:26:54:828 2024 cured

17:26:55:296 2024 C:Program FilesAVGAVG2012avgwsc.exe infected Virus.Win32.Sality.aa ...17:26:55:296 2024 cured

17:26:56:953 2024 C:Program FilesAVGAVG2012fixcfg.exe infected Virus.Win32.Sality.aa ...17:26:56:953 2024 cured

17:26:57:546 2024 C:Program FilesAVGAVG2012idpfixx.exe infected Virus.Win32.Sality.aa ...17:26:57:546 2024 cured

17:27:00:562 2024 C:Program FilesBau-Simulator 2012Bau-Simulator 2012.exe infected Virus.Win32.Sality.aa ...17:27:00:562 2024 cured

17:27:06:109 2024 C:Program Filesblekkotb_031dtuser.exe infected Virus.Win32.Sality.aa ...17:27:06:109 2024 cured

17:27:06:546 2024 C:Program Filesblekkotb_031uninstall.exe infected Virus.Win32.Sality.aa ...17:27:06:546 2024 cured

17:27:06:921 2024 C:Program FilesCommon FilesAdobe AIRVersions1.0Adobe AIR Application Installer.exe infected Virus.Win32.Sality.aa ...17:27:06:921 2024 cured

17:27:07:234 2024 C:Program FilesCommon FilesAdobe AIRVersions1.0ResourcesAdobe AIR Updater.exe infected Virus.Win32.Sality.aa ...17:27:07:234 2024 cured

17:27:07:765 2024 C:Program FilesCommon FilesAdobe AIRVersions1.0Resourcestemplate.exe infected Virus.Win32.Sality.aa ...17:27:07:765 2024 cured

17:27:08:328 2024 C:Program FilesCommon FilesAVG Secure SearchDriverInstaller12.2.6DriverInstaller.exe infected Virus.Win32.Sality.aa ...17:27:08:328 2024 cured

17:27:09:062 2024 C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriver.exe infected Virus.Win32.Sality.aa ...17:27:09:062 2024 cured

17:27:09:296 2024 C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriver2.exe infected Virus.Win32.Sality.aa ...17:27:09:296 2024 cured

17:27:09:546 2024 C:Program FilesCommon FilesInstallShieldDriver1050Intel 32IDriverT.exe infected Virus.Win32.Sality.aa ...17:27:09:546 2024 cured

17:27:10:015 2024 C:Program FilesCommon FilesInstallShieldDriver9Intel 32IDriver.exe infected Virus.Win32.Sality.aa ...17:27:10:015 2024 cured

17:27:10:265 2024 C:Program FilesCommon FilesInstallShieldDriver9Intel 32IDriver2.exe infected Virus.Win32.Sality.aa ...17:27:10:265 2024 cured

17:27:10:562 2024 C:Program FilesCommon FilesInstallShieldengine6Intel 32IKernel.exe infected Virus.Win32.Sality.aa ...17:27:10:562 2024 cured

17:27:11:593 2024 C:Program FilesCommon FilesJavaJava Updatejaucheck.exe infected Virus.Win32.Sality.aa ...17:27:11:593 2024 cured

17:27:11:796 2024 C:Program FilesCommon FilesJavaJava Updatejaureg.exe infected Virus.Win32.Sality.aa ...17:27:11:796 2024 cured

17:27:12:046 2024 C:Program FilesCommon FilesJavaJava Updatejucheck.exe infected Virus.Win32.Sality.aa ...17:27:12:046 2024 cured

17:27:12:250 2024 C:Program FilesCommon FilesJavaJava Updatejusched.exe infected Virus.Win32.Sality.aa ...17:27:12:250 2024 cured

17:27:12:687 2024 C:Program FilesCommon FilesMicrosoft SharedDWDW20.EXE infected Virus.Win32.Sality.aa ...17:27:12:687 2024 cured

17:27:12:890 2024 C:Program FilesCommon FilesMicrosoft SharedDWDWTRIG20.EXE infected Virus.Win32.Sality.aa ...17:27:12:890 2024 cured

17:27:16:328 2024 C:Program FilesCommon FilesNokiaMPlatformNokiaMServer.exe infected Virus.Win32.Sality.aa ...17:27:16:328 2024 cured

17:27:16:578 2024 C:Program FilesCommon FilesNokiaMPlatformNokiaMTranscodeServer.exe infected Virus.Win32.Sality.aa ...17:27:16:578 2024 cured

17:27:16:906 2024 C:Program FilesCommon FilesNokiaNoAnokiaaserver.exe infected Virus.Win32.Sality.aa ...17:27:16:906 2024 cured

17:27:19:281 2024 C:Program FilesCommon FilesNokiaService LayerAnsl_host_process.exe infected Virus.Win32.Sality.aa ...17:27:19:281 2024 cured

17:27:19:531 2024 C:Program FilesCommon FilesNokiaService LayerAnsl_reinstaller.exe infected Virus.Win32.Sality.aa ...17:27:19:531 2024 cured

17:27:23:812 2024 C:Program FilesConvertHelperffmpeg.exe infected Virus.Win32.Sality.aa ...17:27:23:812 2024 cured

17:27:24:546 2024 C:Program FilesCool WMV To MP3 ConverterCool WMV To MP3 Converter.exe infected Virus.Win32.Sality.aa ...17:27:24:546 2024 cured

17:27:24:781 2024 C:Program FilesCool WMV To MP3 Converterffmpeg.exe infected Virus.Win32.Sality.aa ...17:27:24:781 2024 cured

17:27:26:703 2024 C:Program FilesDAEMON Tools ProDTHelper.exe infected Virus.Win32.Sality.aa ...17:27:26:703 2024 cured

17:27:27:234 2024 C:Program FilesDAEMON Tools ProInstallGadget.exe infected Virus.Win32.Sality.aa ...17:27:27:234 2024 cured

17:27:27:890 2024 C:Program FilesDAEMON Tools Prouninst.exe infected Virus.Win32.Sality.aa ...17:27:27:890 2024 cured

17:27:28:687 2024 C:Program FilesDatecsFlexType 2KLiveLive.exe infected Virus.Win32.Sality.aa ...17:27:28:687 2024 cured

17:27:28:906 2024 C:Program FilesDatecsFlexType 2KRemove.exe infected Virus.Win32.Sality.aa ...17:27:28:906 2024 cured

17:27:29:406 2024 C:Program FilesDatecsFlexType 2KUNWISE.EXE infected Virus.Win32.Sality.aa ...17:27:29:406 2024 cured

17:27:30:406 2024 C:Program FilesDriver-SoftDriverGeniusLiveUpdate.exe infected Virus.Win32.Sality.aa ...17:27:30:406 2024 cured

17:27:30:671 2024 C:Program FilesDriver-SoftDriverGeniusTaskTray.exe infected Virus.Win32.Sality.aa ...17:27:30:671 2024 cured

17:27:31:359 2024 C:Program FilesFavorite-GamesFavorite-Games.exe infected Virus.Win32.Sality.aa ...17:27:31:359 2024 cured

17:27:42:078 2024 C:Program FilesFoxit SoftwareFoxit ReaderFoxit Reader.exe infected Virus.Win32.Sality.aa ...17:27:42:078 2024 cured

17:27:42:312 2024 C:Program FilesFoxit SoftwareFoxit ReaderFoxit Updater.exe infected Virus.Win32.Sality.aa ...17:27:42:312 2024 cured

17:27:42:906 2024 C:Program FilesFoxit SoftwareFoxit ReaderShell ExtensionsFoxitPrevhost.exe infected Virus.Win32.Sality.aa ...17:27:42:906 2024 cured

17:27:46:203 2024 C:Program FilesFree MP3 ConverterMP3_Converter.exe infected Virus.Win32.Sality.aa ...17:27:46:203 2024 cured

17:28:47:562 2024 C:Program FilesFunmoods1.5.23.22funmoodssrv.exe infected Virus.Win32.Sality.aa ...17:28:47:562 2024 cured

17:30:08:203 2024 C:Program FilesGOG.comSerious Sam The Second EncounterBinSeriousSam.exe infected Virus.Win32.Sality.aa ...17:30:08:203 2024 cured

17:30:35:890 2024 C:Program FilesGRETECHGomPlayerGOM.EXE infected Virus.Win32.Sality.aa ...17:30:35:890 2024 cured

17:30:36:218 2024 C:Program FilesGRETECHGomPlayerGomWiz.exe infected Virus.Win32.Sality.aa ...17:30:36:218 2024 cured

17:30:36:468 2024 C:Program FilesGRETECHGomPlayerGrLauncher.exe infected Virus.Win32.Sality.aa ...17:30:36:468 2024 cured

17:30:40:453 2024 C:Program FilesGRETECHGomPlayersrt2smi.exe infected Virus.Win32.Sality.aa ...17:30:40:453 2024 cured

17:30:40:687 2024 C:Program FilesGRETECHGomPlayerUninstall.exe infected Virus.Win32.Sality.aa ...17:30:40:687 2024 cured

17:30:41:843 2024 C:Program FilesHTCHTC Sync 3.0adb.exe infected Virus.Win32.Sality.aa ...17:30:41:843 2024 cured

17:30:42:312 2024 C:Program FilesHTCHTC Sync 3.0AutoplayControl.exe infected Virus.Win32.Sality.aa ...17:30:42:312 2024 cured

17:30:43:156 2024 C:Program FilesHTCHTC Sync 3.0htcUPCTLoader.exe infected Virus.Win32.Sality.aa ...17:30:43:156 2024 cured

17:30:57:265 2024 C:Program FilesHTCHTC Sync 3.0uiHTC.exe infected Virus.Win32.Sality.aa ...17:30:57:265 2024 cured

17:30:57:656 2024 C:Program FilesHTCHTC Sync 3.0UpctUpdate.exe infected Virus.Win32.Sality.aa ...17:30:57:656 2024 cured

17:30:58:000 2024 C:Program FilesHTCInternet Pass-Throughhtcnat.exe infected Virus.Win32.Sality.aa ...17:30:58:000 2024 cured

17:30:58:390 2024 C:Program FilesInstallShield Installation Information{055EE59D-217B-43A7-ABFF-507B966405D8}setup.exe infected Virus.Win32.Sality.aa ...17:30:58:390 2024 cured

17:30:58:796 2024 C:Program FilesInstallShield Installation Information{1735AD57-FD6E-4EB5-A276-56C2574D6412}setup.exe infected Virus.Win32.Sality.aa ...17:30:58:796 2024 cured

17:30:59:656 2024 C:Program FilesInstallShield Installation Information{28006915-2739-4EBE-B5E8-49B25D32EB33}setup.exe infected Virus.Win32.Sality.aa ...17:30:59:656 2024 cured

17:31:00:203 2024 C:Program FilesInstallShield Installation Information{92B94569-6683-4617-8C54-EB27A1B51B30}Setup.exe infected Virus.Win32.Sality.aa ...17:31:00:203 2024 cured

17:31:20:953 2024 C:Program FilesInstallShield Installation Information{9B94BE6F-7CA3-4C40-A266-62667FF746CC}Setup.exe infected Virus.Win32.Sality.aa ...17:31:20:953 2024 cured

17:31:21:484 2024 C:Program FilesInstallShield Installation Information{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}setup.exe infected Virus.Win32.Sality.aa ...17:31:21:484 2024 cured

17:31:23:140 2024 C:Program FilesJavajre7binjabswitch.exe infected Virus.Win32.Sality.aa ...17:31:23:140 2024 cured

17:31:23:406 2024 C:Program FilesJavajre7binjava.exe infected Virus.Win32.Sality.aa ...17:31:23:406 2024 cured

17:31:23:640 2024 C:Program FilesJavajre7binjavacpl.exe infected Virus.Win32.Sality.aa ...17:31:23:640 2024 cured

17:31:23:921 2024 C:Program FilesJavajre7binjavaw.exe infected Virus.Win32.Sality.aa ...17:31:23:921 2024 cured

17:31:24:140 2024 C:Program FilesJavajre7binjavaws.exe infected Virus.Win32.Sality.aa ...17:31:24:140 2024 cured

17:31:24:640 2024 C:Program FilesJavajre7binjp2launcher.exe infected Virus.Win32.Sality.aa ...17:31:24:640 2024 cured

17:31:25:593 2024 C:Program FilesJavajre7binssvagent.exe infected Virus.Win32.Sality.aa ...17:31:25:593 2024 cured

17:31:25:937 2024 C:Program FilesJavajre7binunpack200.exe infected Virus.Win32.Sality.aa ...17:31:25:937 2024 cured

17:31:31:593 2024 C:Program FilesK-Lite Codec PackToolsdsconfig.exe infected Virus.Win32.Sality.aa ...17:31:31:593 2024 cured

17:31:31:812 2024 C:Program FilesK-Lite Codec PackToolsGraphStudioNext.exe infected Virus.Win32.Sality.aa ...17:31:31:812 2024 cured

17:31:55:515 2024 C:Program FilesMcAfee Security Scan3.0.207McCHSvc.exe infected Virus.Win32.Sality.aa ...17:31:55:515 2024 cured

17:31:55:859 2024 C:Program FilesMcAfee Security Scan3.0.207SSScheduler.exe infected Virus.Win32.Sality.aa ...17:31:55:859 2024 cured

17:31:56:109 2024 C:Program FilesMcAfee Security Scanuninstall.exe infected Virus.Win32.Sality.aa ...17:31:56:109 2024 cured

17:31:56:406 2024 C:Program FilesMessengermsmsgs.exe infected Virus.Win32.Sality.aa ...17:31:56:406 2024 cured

17:31:56:703 2024 C:Program FilesMicrosoft ActiveSyncastu.exe infected Virus.Win32.Sality.aa ...17:31:56:703 2024 cured

17:31:56:968 2024 C:Program FilesMicrosoft ActiveSyncCEAPPMGR.EXE infected Virus.Win32.Sality.aa ...17:31:56:968 2024 cured

17:31:57:500 2024 C:Program FilesMicrosoft ActiveSyncFormInst.exe infected Virus.Win32.Sality.aa ...17:31:57:500 2024 cured

17:31:58:140 2024 C:Program FilesMicrosoft ActiveSyncMobile TranslatorUninstall.exe infected Virus.Win32.Sality.aa ...17:31:58:140 2024 cured

17:31:58:843 2024 C:Program FilesMicrosoft ActiveSyncrapimgr.exe infected Virus.Win32.Sality.aa ...17:31:58:843 2024 cured

17:31:59:375 2024 C:Program FilesMicrosoft ActiveSyncwcescomm.exe infected Virus.Win32.Sality.aa ...17:31:59:375 2024 cured

17:31:59:593 2024 C:Program FilesMicrosoft ActiveSyncWCESMgr.exe infected Virus.Win32.Sality.aa ...17:31:59:593 2024 cured

17:31:59:843 2024 C:Program FilesMicrosoft ActiveSyncWMP10_Update.exe infected Virus.Win32.Sality.aa ...17:31:59:843 2024 cured

17:32:00:562 2024 C:Program FilesMozilla Firefoxcrashreporter.exe infected Virus.Win32.Sality.aa ...17:32:00:562 2024 cured

17:32:00:875 2024 C:Program FilesMozilla Firefoxfirefox.exe infected Virus.Win32.Sality.aa ...17:32:00:875 2024 cured

17:32:01:250 2024 C:Program FilesMozilla Firefoxmaintenanceservice.exe infected Virus.Win32.Sality.aa ...17:32:01:250 2024 cured

17:32:01:484 2024 C:Program FilesMozilla Firefoxmaintenanceservice_installer.exe infected Virus.Win32.Sality.aa ...17:32:01:484 2024 cured

17:32:02:187 2024 C:Program FilesMozilla Firefoxuninstallhelper.exe infected Virus.Win32.Sality.aa ...17:32:02:187 2024 cured

17:32:02:406 2024 C:Program FilesMozilla Firefoxupdater.exe infected Virus.Win32.Sality.aa ...17:32:02:406 2024 cured

17:32:02:640 2024 C:Program FilesMozilla Firefoxwebapp-uninstaller.exe infected Virus.Win32.Sality.aa ...17:32:02:640 2024 cured

17:32:02:875 2024 C:Program FilesMozilla Firefoxwebapprt-stub.exe infected Virus.Win32.Sality.aa ...17:32:02:875 2024 cured

17:32:03:187 2024 C:Program FilesMozilla Maintenance Servicemaintenanceservice_tmp.exe infected Virus.Win32.Sality.aa ...17:32:03:187 2024 cured

17:32:03:468 2024 C:Program FilesMozilla Maintenance ServiceUninstall.exe infected Virus.Win32.Sality.aa ...17:32:03:468 2024 cured

17:32:03:859 2024 C:Program FilesMSNMSNCoreFilesInstallMSN9ComponentsDigcore.exe infected Virus.Win32.Sality.aa ...17:32:03:859 2024 cured

17:32:04:125 2024 C:Program FilesMSNMSNCoreFilesInstallMSN9ComponentsMsncli.exe infected Virus.Win32.Sality.aa ...17:32:04:125 2024 cured

17:32:04:390 2024 C:Program FilesMSNMSNCoreFilesInstallmsnsusii.exe infected Virus.Win32.Sality.aa ...17:32:04:390 2024 cured

17:32:06:218 2024 C:Program FilesNokiaConnectivity Cable Driversetupextcmb.exe infected Virus.Win32.Sality.aa ...17:32:06:218 2024 cured

17:32:06:625 2024 C:Program FilesNokiaNokia Ovi Suite7z.exe infected Virus.Win32.Sality.aa ...17:32:06:625 2024 cured

17:32:07:765 2024 C:Program FilesNokiaNokia Ovi SuiteConnectorsMS Outlook ConnectorMsOutlookApiProxy.exe infected Virus.Win32.Sality.aa ...17:32:07:765 2024 cured

17:32:10:234 2024 C:Program FilesNokiaNokia Ovi SuiteHelpOviSuiteHelp_eng-us.exe infected Virus.Win32.Sality.aa ...17:32:10:234 2024 cured

17:32:13:171 2024 C:Program FilesNokiaNokia Ovi SuiteNokiaOviSuite.exe infected Virus.Win32.Sality.aa ...17:32:13:171 2024 cured

17:32:15:296 2024 C:Program Filespazera-softwareFLV_to_AVI_ConvertertoolsFFmpegffmpeg.exe infected Virus.Win32.Sality.aa ...17:32:15:296 2024 cured

17:32:15:953 2024 C:Program FilesPC Connectivity SolutionDPInst.exe infected Virus.Win32.Sality.aa ...17:32:15:953 2024 cured

17:32:16:343 2024 C:Program FilesPC Connectivity SolutionNclInstaller.exe infected Virus.Win32.Sality.aa ...17:32:16:343 2024 cured

17:32:17:218 2024 C:Program FilesPC Connectivity SolutionServiceLayer.exe infected Virus.Win32.Sality.aa ...17:32:17:218 2024 cured

17:32:17:515 2024 C:Program FilesPC Connectivity SolutionTransportsNclBCBTSrv.exe infected Virus.Win32.Sality.aa ...17:32:17:515 2024 cured

17:32:17:734 2024 C:Program FilesPC Connectivity SolutionTransportsNclIrSrv.exe infected Virus.Win32.Sality.aa ...17:32:17:734 2024 cured

17:32:17:937 2024 C:Program FilesPC Connectivity SolutionTransportsNclIVTBTSrv.exe infected Virus.Win32.Sality.aa ...17:32:17:937 2024 cured

17:32:18:156 2024 C:Program FilesPC Connectivity SolutionTransportsNclMSBTSrv.exe infected Virus.Win32.Sality.aa ...17:32:18:156 2024 cured

17:32:18:484 2024 C:Program FilesPC Connectivity SolutionTransportsNclMSBTSrvEx.exe infected Virus.Win32.Sality.aa ...17:32:18:484 2024 cured

17:32:18:703 2024 C:Program FilesPC Connectivity SolutionTransportsNclRSSrv.exe infected Virus.Win32.Sality.aa ...17:32:18:703 2024 cured

17:32:18:953 2024 C:Program FilesPC Connectivity SolutionTransportsNclToBTSrv.exe infected Virus.Win32.Sality.aa ...17:32:18:953 2024 cured

17:32:19:187 2024 C:Program FilesPC Connectivity SolutionTransportsNclUSBSrv.exe infected Virus.Win32.Sality.aa ...17:32:19:187 2024 cured

17:32:19:812 2024 C:Program FilesPC Sync Managermidisyn.exe infected Virus.Win32.Sality.aa ...17:32:19:828 2024 cured

17:32:20:187 2024 C:Program FilesPC Sync ManagerPhoneSuite.exe infected Virus.Win32.Sality.aa ...17:32:20:187 2024 cured

17:32:20:625 2024 C:Program FilesRealtekAudioDriversKB888111xpsp2.exe infected Virus.Win32.Sality.aa ...17:32:20:625 2024 cured

17:32:20:890 2024 C:Program FilesRealtekAudioDriversRtlUpd.exe infected Virus.Win32.Sality.aa ...17:32:20:890 2024 cured

17:32:21:187 2024 C:Program FilesRealtekAudioDriversWDMAlcmtr.exe infected Virus.Win32.Sality.aa ...17:32:21:187 2024 cured

17:32:24:000 2024 C:Program FilesRealtekAudioDriversWDMRtkAudioService.exe infected Virus.Win32.Sality.aa ...17:32:24:000 2024 cured

17:32:24:390 2024 C:Program FilesRealtekAudioDriversWDMRtlUpd.exe infected Virus.Win32.Sality.aa ...17:32:24:390 2024 cured

17:32:24:687 2024 C:Program FilesRealtekAudioDriversWDMSkyTel.exe infected Virus.Win32.Sality.aa ...17:32:24:687 2024 cured

17:32:24:906 2024 C:Program FilesRealtekAudioDriversWDMSoundMan.exe infected Virus.Win32.Sality.aa ...17:32:24:906 2024 cured

17:32:25:125 2024 C:Program FilesRealtekAudioDriversWDMvncutil.exe infected Virus.Win32.Sality.aa ...17:32:25:125 2024 cured

17:32:25:375 2024 C:Program FilesSkypeUpdaterUpdater.exe infected Virus.Win32.Sality.aa ...17:32:25:375 2024 cured

17:32:25:859 2024 C:Program FilesuTorrentControl_v2uninstall.exe infected Virus.Win32.Sality.aa ...17:32:25:875 2024 cured

17:32:26:078 2024 C:Program FilesuTorrentControl_v2uTorrentControl_v2ToolbarHelper.exe infected Virus.Win32.Sality.aa ...17:32:26:078 2024 cured

17:32:30:609 2024 C:Program FilesWinampUninstWA.exe infected Virus.Win32.Sality.aa ...17:32:30:609 2024 cured

17:32:31:015 2024 C:Program FilesWinamp DetectUninstWaDetect.exe infected Virus.Win32.Sality.aa ...17:32:31:015 2024 cured

17:32:31:562 2024 C:Program FilesWindows Media Playerwmsetsdk.exe infected Virus.Win32.Sality.aa ...17:32:31:562 2024 cured

17:32:32:906 2024 C:Program FilesYouTube DownloaderYouTube Downloader.exe infected Virus.Win32.Sality.aa ...17:32:32:906 2024 cured

17:32:33:156 2024 C:Program FilesYouTube DownloaderYouTube Downloader_Helper.exe infected Virus.Win32.Sality.aa ...17:32:33:156 2024 cured

10 януари 201313 г.

Да, извинявам се...автоматично се е добавил един http, който е направил линка невалиден.

Важното е, че сте си го намерили и сам.

Сега да продължим, защото ще имаме доста работа.

Качих инструмента на Касперски тук - направете една проверка, както съм описал преди.

Спрете интернета по-време на проверката.

11 януари 201313 г.

Автор

Не мога да я изтегля забива на 99.9% и ми дава грешка в мрежата :?

11 януари 201313 г.

Линка си работи, но явно заразата ви се е върнала...

Изтеглете я от чист компютър и я пренесете с флашка до заразената машина.

Ако не се получи ще използваме LiveCD - то на Касперски...досега тази комбинация винаги е сработвала...

Ако пак не стане ще пробваме още две-три неща и ако нищо не помогне ще се наложи формат и преинсталация.

Поздрави!

11 януари 201313 г.

Автор

Дръпнах Kcleaner незнам как го допусна и изтрих доста временни фаилове и след това позволи да отворя AVG и имах свалена Avast и нея инсталирах. AVG намери 22 заразени фаила а Avast -3. И вече можах да изтегля тоя касперски и в момента сканирам. За момента откри 1 фаил но има още доста да сканира. След като приключи ще кача лога.

11 януари 201313 г.

Какъв е този Kcleaner? Мисля, че тотално сте омазали всичко...Не всичко, което намерят антивирусните е за триене...Искам да видя какво са изтрили avast! и какво AVG и какво Kaspersky.

Тотално объркахте и моята стратегия и начин на действие. Тук си има определена последователност на действия!!! Ако няма да спазвате инструкции мисля да приключа своето участие по темата!

11 януари 201313 г.

Автор

http://prikachi.com/images.php?images/380/5726380m.jpg

http://prikachi.com/images.php?images/379/5726379F.jpg

И това е от касперския

Status: Detected (events: 1)

1/11/2013 11:35:38 AM Detected Trojan program Trojan.Win32.Agent.ucbe C:Documents and SettingsJackLocal SettingsApplication DataGoogleChromeApplication21.0.1180.89flashplayerapp.exe High

Ето това е. Кое не е трябвало да заключат антивирусните?

И между другото вече се включва TaskManager преди това не можеше.

Редактирано 11 януари 201313 г. от Дечо (преглед на промените)

11 януари 201313 г.

Имате късмет, че антивирусните в случая не са изтрили важни системни файлове...Sality заразява всички exe и scr файлове и при невъзможност да бъдат излекувани антивирусната ги маркира за изтриване и след това това води до срив в цялата Операционна Система. В случая изтртитите файлове не са били системни за ваш късмет. И да, знам че вече можете да използвате Task Manager и т.н. но отсъствието на симптоми не означава, че проблема е решен. Това е коварен бацил и ни чака още доста работа.

1. Изтеглете прикачения файл и го разархивирайте - delete.zip Стартирайте файла delete.bat и кажете какво съобщение ви се появява на екрана.

2. Изтеглете прикачения файл и го разархивирайте - sr.zip Стартирайте файла sr.reg и потвърдете с YES.

3. Изтеглете прикачения файл и го разархивирайте - disable_dangerous_services_xp.zip Стартирайте файла disable_dangerous_services_xp.reg и потвърдете с YES.

4. Деинсталирайте AVG от Control Panel-a и след това изтеглете и стартирайте този инструмент - AVG Remover(32bit) 2012 за да почистите остатъците.

5. Следвайте инструкциите за работа с Combofix:

1. Изтеглете ComboFix от BleepingComputer (изтеглете я наново и изтрийте вашата версия, защото тя бе заразена).
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:

След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.

3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.

4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.

*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console
*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.

Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.

След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:

5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на ComboFix, моля да прочетете това: Manually restoring the Internet connection section.

6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

11 януари 201313 г.

Автор

12 януари 201313 г.

[*]Отворете notepad и с copy/paste въведете следната информация:

Driver::AVGIDSHXAVGIDSShimMcComponentHostServiceFile::c:documents and settingsAll UsersStart MenuProgramsStartupMcAfee Security Scan Plus.lnkc:windowspssMcAfee Security Scan Plus.lnkCommon StartupFolder::c:documents and settingsJackApplication DataKC Softwaresc:program filesKC Softwaresc:program filesuTorrentControl_v2c:program filesMcAfee Security ScanRegistry::[HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerURLSearchHooks]"{7473b6bd-4691-4744-a82b-7854eb3d70b6}"=-[-HKEY_CLASSES_ROOTclsid{7473b6bd-4691-4744-a82b-7854eb3d70b6}]DDS::uStart Page = hxxp://btsearch.namemStart Page = hxxp://www.v9.com/?utm_source=b&utm_medium=umz-2&from=umz-2&uid=WDC_WD1200BEVS-07LAT0_WD-WXEX0658735487354&ts=1354303094Firefox::FF - ProfilePath - c:documents and settingsJackApplication DataMozillaFirefoxProfiles4tsg7yr5.defaultFF - prefs.js: browser.startup.homepage - hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786FF - prefs.js: keyword.URL - hxxp://btsearch.name/results.php?q=FF - ExtSQL: 2012-12-01 17:53; [email protected]; c:documents and settingsJackApplication DataMozillaFirefoxProfiles4tsg7yr5.defaultextensionsffxtlbr@funmoods.comFF - user.js: extensions.funmoods.hmpg - trueFF - user.js: extensions.funmoods.hmpgUrl - hxxp://searchfunmoods.com/?f=1&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786FF - user.js: extensions.funmoods.dfltSrch - trueFF - user.js: extensions.funmoods.srchPrvdr - SearchFF - user.js: extensions.funmoods.dnsErr - trueFF - user.js: extensions.funmoods_i.newTab - trueFF - user.js: extensions.funmoods.newTabUrl - hxxp://searchfunmoods.com/?f=2&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://searchfunmoods.com/?f=3&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtD0CtD0Azz0C0AzytDtAtCyDzztCyDtN0D0Tzu0CtAtAyEtN1L2XzutBtFtBtFtDtFtAyEyE&cr=673494786&q=FF - user.js: extensions.funmoods.id - 00C0A8CA90315815FF - user.js: extensions.funmoods.instlDay - 15674FF - user.js: extensions.funmoods.vrsn - 1.5.23.22FF - user.js: extensions.funmoods.vrsni - 1.5.23.22FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.225:48FF - user.js: extensions.funmoods.prtnrId - funmoodsFF - user.js: extensions.funmoods.prdct - funmoodsFF - user.js: extensions.funmoods.aflt - downloadFF - user.js: extensions.funmoods_i.smplGrp - noneFF - user.js: extensions.funmoods.tlbrId - baseFF - user.js: extensions.funmoods.instlRef - downloadFF - user.js: extensions.funmoods.dfltLng -FF - user.js: extensions.funmoods.excTlbr - falseFF - user.js: extensions.funmoods.autoRvrt - falseFF - user.js: extensions.funmoods.envrmnt - productionFF - user.js: extensions.funmoods.isdcmntcmplt - trueFF - user.js: extensions.funmoods.mntrvrsn - 1.3.0

[*]Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).

[*]По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката!

[*]Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

12 януари 201313 г.

Автор

12 януари 201313 г.

Не инсталирайте нови програми, защото затруднявате моята задача (това го казвам за незнам кой път вече).

[*]Отворете

notepad и с copy/paste въведете следната информация:

Folder::c:documents and settingsJackLocal SettingsApplication DataBabylonc:documents and settingsJackApplication DataBabylonc:documents and settingsAll UsersApplication DataBabylonRegistry::[-HKLM~startupfolderC:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]

[*]По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката! [*]Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

12 януари 201313 г.

Автор

12 януари 201313 г.

СТЪПКА 1

Стартирайте отново програмата AdwCleaner (by Xplode).

[*]Затворете всички стартирани програми и браузъри

[*]Кликнете два пъти върху adwcleaner.exe за да стартирате инструмента.

[*]Този път маркирайте Delete

[*]Вашият компютър ще се рестартира автоматично. Текстовия файл ще се отвори след рестарта.

[*]Моля, да публикувате съдържанието на този лог в отговора си

[*]Можете да намерите лога,който автоматично се запомня тук C:AdwCleaner[R1].txt.

СТЪПКА 2

Моля изтеглете Junkware Removal Tool на вашия десктоп.

[*]Спрете временно работата на защитните програми.

[*]Стартирайте инструмента JRT.exe

[*]Ще се отвори ДОС прозорец. Натиснете което и да е копче от клавиатурата.

[*]Затворете излишните приложения и всички браузъри и изчакайте проверката да завърши.

[*]Ще се появи лог файл (който можете да намерите и ръчно на десктопа с името JRT.txt).

[*]Моля копирайте съдържанието на лог файла в следващия си пост.

СТЪПКА 3

Изтеглете OTL.exe и го запазете на десктопа.

[*]Стартирайте OTL (ако е необходимо, потвърдете през UAC).

[*]Направете следните настройки:

[*]Сложете отметка пред Scan All Users

[*]Под менюто File Age изберете 90 days

[*]Под менюто Standard Registry променете на ALL

[*]Сложете отметки пред LOP и Purity Check

Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

netsvcsmsconfigsafebootminimalsafebootnetworkactivexdrivers32%SYSTEMDRIVE%*.*%USERPROFILE%*.*%USERPROFILE%Application Data*.*%USERPROFILE%Application Data*.%USERPROFILE%Local Settings*.*%USERPROFILE%Local Settingstemp*.exe%USERPROFILE%Local SettingsTemporary Internet Files*.exe%USERPROFILE%Local SettingsApplication Data*.*%AllUsersProfile%*.*%AllUsersProfile%Application Data*.*%AllUsersProfile%Application Data*.%AllUsersProfile%Application DataLocal Settings*.*%AllUsersProfile%Application DataLocal SettingsTemp*.exe%ALLUSERSPROFILE%DocumentsMy Music*.exe%ALLUSERSPROFILE%DocumentsMy Pictures*.exe%ALLUSERSPROFILE%DocumentsMy Videos*.exe%ALLUSERSPROFILE%Documents*.exe%USERPROFILE%My Documents*.*%CommonProgramFiles%*.*%CommonProgramFiles%ComObjects*.*%PROGRAMFILES%*.*%PROGRAMFILES%*.%systemroot%system32configsystemprofile*.*%systemroot%system32configsystemprofileApplication Data*.*%systemroot%system32configsystemprofileLocal Settings*.*%systemroot%system32configsystemprofileLocal SettingsApplication Data*.*%systemroot%system32configsystemprofileLocal SettingsTemp*.exe%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files*.exeC:Documents and SettingsLocalServiceApplication Data*.*C:Documents and SettingsLocalServiceLocal SettingsApplication Data*.*C:Documents and SettingsLocalServiceLocal Settingstemp*.exeC:Documents and SettingsLocalServiceLocal SettingsTemporary Internet Files*.exeC:Documents and SettingsLocalServiceLocal Settings*.*C:Documents and SettingsLocalService*.*C:Documents and SettingsNetworkServiceApplication Data*.*C:Documents and SettingsNetworkServiceLocal SettingsApplication Data*.*C:Documents and SettingsNetworkServiceLocal Settingstemp*.exeC:Documents and SettingsNetworkServiceLocal SettingsTemporary Internet Files*.exeC:Documents and SettingsNetworkServiceLocal Settings*.*C:Documents and SettingsNetworkService*.*%windir%temp*.exe%windir%*.%windir%installer*.%windir%system32*.%Temp%smtmp1*.*%Temp%smtmp2*.*%Temp%smtmp3*.*%Temp%smtmp4*.*%systemroot%system32*.dll /lockedfiles%systemroot%Tasks*.job /lockedfiles%systemroot%system32drivers*.sys /90%systemroot%system32drivers*.sys /lockedfiles%systemroot%system32Spoolprtprocsw32x86*.dll%systemroot%*. /rp /s%systemroot%assemblytmp*.* /S /MD5%systemroot%assemblytemp*.* /S /MD5%systemroot%assemblyGAC*.ini%systemroot%assemblyGAC_32*.ini%SystemRoot%assemblyGAC_MSIL*.iniwsSystemRoot|l,n,u,@;True;False;True;$,{ /fn%systemdrive%$Recycle.Bin|@;true;true;true /fpc:|incredibar;true;true;true; /FPHKEY_CLASSES_ROOTCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /sHKEY_CLASSES_ROOTCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /sHKEY_CURRENT_USERSoftwareClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{7C857801-7381-11CF-884D-00AA004B2E24} /sHKEY_CLASSES_ROOTclsid{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /sHKEY_CLASSES_ROOTclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /sHKEY_CURRENT_USERSoftwareClassesclsid{fbeb8a05-beee-4442-804e-409d6c4515e9} /sHKEY_LOCAL_MACHINESOFTWAREClassesCLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /sHKEY_CURRENT_USERSoftwareClassesclsid{12d0253a-7c96-815c-11e0-3034bbd97cc0}] /sHKEY_CURRENT_USERSoftwareMSOLoad /stype C:WINDOWSsystem.ini >> test.txt /c>C:commands.txt echo list vol /raw /hide /c/wait>C:DiskReport.txt diskpart /s C:commands.txt /raw /hide /c/waittype c:diskreport.txt /c/waiterase c:commands.txt /hide /c/waiterase c:diskreport.txt /hide /c/md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dllconsrv.dllservices.exesvchost.exeexplorer.exeuserinit.exewinlogon.exesmss.exelsass.exeatapi.sysiaStor.sysserial.sysdisk.sysvolsnap.sysredbook.sysi8042prt.sysafd.sysnetbt.systcpip.sysipsec.syshlp.datstr.syscrexv.ocx/md5stop

[*]Натиснете маркираният в синьо бутон: Run Scan.

[*]Като приключи проверката, ще се създадат два файла - OTL.Txt и Extras.Txt. Прикачете тези два файла в следващия си коментар (погледнете опцията Прикачени файлове, когато публикувате мнение).

По време на сканирането с инструментите, не използвайте компютъра си и изключете интернет достъпа !

12 януари 201313 г.

Автор

12 януари 201313 г.

[*]Стартирайте файла с двукратен клик на мишката.

[*]Под с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTLSRV - File not found [Auto | Stopped] -- C:Program FilesKaspersky LabKaspersky Anti-Virus 2013avp.exe -- (AVP)DRV - File not found [Kernel | On_Demand Stopped] -- C:DOCUME~1JackLOCALS~1Tempcatchme.sys -- (catchme)DRV - [2012/11/18 23:05:12 | 000,014,336 ---- M] () [Kernel | On_Demand Unknown] -- C:WINDOWSsystem32driversTrueSight.sys -- (TrueSight)CHR - default_search_provider: search_url = http://btsearch.name/results.php?q={searchTerms}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}[2013/01/10 17:09:55 | 000,000,000 ---D C] -- C:Documents and SettingsAll UsersStart MenuProgramsKC Softwares[2012/11/19 06:52:01 | 000,000,000 ---D C] -- C:Documents and SettingsJackLocal SettingsApplication DataCRE[2012/11/19 00:47:04 | 000,000,000 ---D C] -- C:$AVG[2013/01/11 05:34:49 | 000,001,711 ---- M] () -- C:Documents and SettingsJackDesktopKCleaner.lnk[2013/01/11 05:34:49 | 000,000,837 ---- M] () -- C:Documents and SettingsJackApplication DataMicrosoftInternet ExplorerQuick LaunchKCleaner.lnk[2013/01/11 04:47:21 | 000,000,000 ---D M] -- C:Documents and SettingsAll UsersApplication DataKaspersky Lab[2012/10/04 07:36:19 | 000,000,000 ---D M] -- C:Documents and SettingsAll UsersApplication DataMcAfee[2012/10/04 07:36:20 | 000,000,000 ---D M] -- C:Documents and SettingsAll UsersApplication DataMcAfee Security Scan:commands[emptytemp]

[*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено: Run Fix

[*]Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

След това отворете файла C:Windowssystem.ini с notepad и премахнете следните два реда от него:

[MCIDRV_VER]

DEVICEMB=495721820197

Затворете файла и запазете промените.

Отворете го отново и се уверете, че промените са запазени.

12 януари 201313 г.

Автор

All processes killed

========== OTL ==========

Service AVP stopped successfully!

Service AVP deleted successfully!

File C:Program FilesKaspersky LabKaspersky Anti-Virus 2013avp.exe not found.

Service catchme stopped successfully!

Service catchme deleted successfully!

File C:DOCUME~1JackLOCALS~1Tempcatchme.sys not found.

Error: No service named TrueSight was found to stop!

Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTrueSight deleted successfully.

C:WINDOWSsystem32driversTrueSight.sys moved successfully.

Use Chrome's Settings page to remove the default_search_provider items.

C:Documents and SettingsAll UsersStart MenuProgramsKC SoftwaresKCleaner folder moved successfully.

C:Documents and SettingsAll UsersStart MenuProgramsKC Softwares folder moved successfully.

C:Documents and SettingsJackLocal SettingsApplication DataCRE folder moved successfully.

C:$AVG$VAULT folder moved successfully.

C:$AVG folder moved successfully.

C:Documents and SettingsJackDesktopKCleaner.lnk moved successfully.

C:Documents and SettingsJackApplication DataMicrosoftInternet ExplorerQuick LaunchKCleaner.lnk moved successfully.

C:Documents and SettingsAll UsersApplication DataKaspersky LabAVP13TempData folder moved successfully.

C:Documents and SettingsAll UsersApplication DataKaspersky LabAVP13Temp folder moved successfully.

C:Documents and SettingsAll UsersApplication DataKaspersky LabAVP13QB folder moved successfully.

C:Documents and SettingsAll UsersApplication DataKaspersky LabAVP13 folder moved successfully.

C:Documents and SettingsAll UsersApplication DataKaspersky Lab folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSSecurityScannerMcUicnt folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSSecurityScanner folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSPartnerCustomSSScheduler folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSPartnerCustomSecurityScan_Release folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSPartnerCustomMcUicnt folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSPartnerCustomMcCHSvc folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSPartnerCustom folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSMcUICntMcUicnt folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSMcUICnt folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSCommonMcUicnt folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGSCommon folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfeeMCLOGS folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfee folder moved successfully.

C:Documents and SettingsAll UsersApplication DataMcAfee Security Scan folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

12 януари 201313 г.

Лог файла не е целия...лиспва информацията от emptytemp частта.

Малко ще хапна и после съм на линия.

12 януари 201313 г.

Автор

Мда моя грешка не сам го копирал целия

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Jack

->Temp folder emptied: 739005 bytes

->Temporary Internet Files folder emptied: 624572 bytes

->Google Chrome cache emptied: 122305226 bytes

->Flash cache emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 6508032 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%System32 .tmp files removed: 0 bytes

%systemroot%System32dllcache .tmp files removed: 0 bytes

%systemroot%System32drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes

%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 124.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 01122013_195444

FilesFolders moved on Reboot...

File move failed. C:WINDOWStemp_avast_Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

12 януари 201313 г.

Мисля, че сме готови...

За ваше успокоение може да следвате следните съвети:

Ако искате да се подсигурите включете и една проверка със следните 4 инструмента за всеки случай:

Microsoft Malicious Software Removal Tool 4.16
AVG rmslt.exe
PCMAV for Sality
Dr.Web CureIt

За финал ако имате инсталационен диск с Windows XP следвайте това:

Важно е диска да е със същата версия на Service Pack, като този инсталиран на компютъра в момента.

Добре е да се провери състоянието на системните файлове:

Използвайте „System File Checker” за да проверите състоянието и версиите на системните файлове. За да направите това, следвайте тези стъпки:

Щракнете върху Старт, а след това щракнете върху Изпълнeние.
Копирайте и поставете (или въведете) следната команда (cmd) в полето Отвори и след това натиснете ENTER:
В командния ред въведете sfc /scannow и натиснете клавиша ENTER.

Забележка Ако се появи подкана за Windows XP CD диск, поставете компактдиска в CD устройството.

Макар, че спряхме Autorun-a е добре да се подсигурим.

Изтеглете USBFix от този линк
Стартирайте инструмента и натиснете: Vaccinate и затворете и изтрийте програмата.

Желателно е да преинсталирате всички (абсолютно всички) инсталирани програми (особено avast!), драйвъри и дори игри.

Забележка: Ако ще преинсталирате софтуера, драйвърите и игрите, ги изтеглете от интернет наново (без да използвате инсталаторите, които са били вече на хардиска).
Но това са поправими щети...мисля че го излекувахме.

Пишете като приключите с проверките и наблюдавайте какво е положението 1-2 дни...дали има проблеми и ако няма такива приключваме.
Добре е да се сканират и всички флашки за вируса, за да не стане пак нова инфекция.

Tова става като изберете от контекстното меню с десен бутон на мишката върху буквата на флашката...

Поздрави!

Добре дошли!

Не мога да инсталирам антивирусна - Sality

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)