Здравейте,

преди няколко дни антивирусната ме извести, че в компютърът ми има вирус.Аз го изтрих с нейната помощ (тя го изтри аз само потвърдих).След няколко часа отново същият вирус отново не обърнах внимание изтрих го и продължих.

На следващият ден започва през 30-40 минути отново не обърнах внимание.На лаптопа му нямаше нищо.

На следващият ден започна още по-често.Изкючих антивирусната(и без това и свършваше периода след 1-2 дни).Влезнах в местоположението на вируса който се намираше в: C:/Winndows/System32/server.exe-нямаше подобен файл.Не обърнах внимание.

Няколко дни няма проблем.

От вече 3 дни аз имам проблем с компютъра тоест няколко проблема:

1.Забавя

2.Не мога да изтрия никаква програма

3.Не мога да отворя и инсталирам Google Chrome

А един от най-големите ми проблеми е този:

Всеки път когато си включвам компютъра ми зарежда ужасно бавно и поне по 10 минути зарежда (това не е нормално преди за 2 минути даже и по-малко беше заредил.)Както и да е забавя с включването, но ми прави впечатление това, че на няколко пъти при включването ми изписва , че нещо прави по този файл server.exe.

Въпрос:

1.Ако му направя преинсталация ще се оправи ли

2.Ако има някакъв вариант без преинсталация мола да споделите

 

Благодаря!

Редактирано 15 февруари 201313 г. от B-boy[StyLe] (преглед на промените)

Моля предоставете логове от DDS !

 

Системата ми е инфектирана - какво да правя сега?

 

Екипа на HJT няма как да си свърши работата без тези логове!

DDS (Ver_2011-09-30.01) - NTFS_x86 Internet Explorer: 9.0.8112.16421 Run by User at 18:01:43 on 2013-02-10 Microsoft Windows 7 Ultimate 6.1.7601.1.1251.359.1033.18.2998.1557 [GMT 2:00] . AV: AVG Internet Security 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} AV: Advanced SystemCare Ultimate *Enabled/Updated* {1C304DC4-1D72-5DB9-B33A-43B638ECFD30} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: AVG Internet Security 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664} . ============== Running Processes ================ . C:Windowssystem32wininit.exe C:Windowssystem32lsm.exe C:Program FilesIObitAdvanced SystemCare Ultimateascsvc.exe C:Program FilesIObitAdvanced SystemCare Ultimateascavsvc.exe C:Windowssystem32Dwm.exe C:WindowsSystem32spoolsv.exe C:WindowsExplorer.EXE C:xamppapachebinhttpd.exe C:Windowssystem32taskhost.exe C:Program FilesApplication UpdaterApplicationUpdater.exe C:Program FilesAVGAVG2013avgidsagent.exe C:Windowsexplorer.exe C:Program FilesGoogleChromeApplicationchrome.exe C:Program FilesAVGAVG2013avgwdsvc.exe C:Program FilesBonjourmDNSResponder.exe C:Program FilesFirebirdFirebird_2_5binfbguard.exe C:Program FilesGoogleUpdate1.3.21.124GoogleCrashHandler.exe C:Program FilesIB UpdaterExtensionUpdaterService.exe C:Windowssystem32dmwu.exe C:Program FilesTeamViewerVersion8TeamViewer_Service.exe C:Program FilesCommon FilesAdobeARM1.0AdobeARM.exe C:Program FilesSynapticsSynTPSynTPEnh.exe C:Program FilesCONEXANTcAudioFilterAgentcAudioFilterAgent.exe C:WindowsSystem32hkcmd.exe C:WindowsSystem32igfxpers.exe C:Program FilesSynapticsSynTPSynTPHelper.exe C:Program FilesWinampwinampa.exe C:Program FilesAVGAVG2013avgui.exe C:Program FilesCommon FilesSpigotSearch SettingsSearchSettings.exe C:xamppapachebinhttpd.exe C:Program FilesSkypePhoneSkype.exe C:Program FilesIObitAdvanced SystemCare UltimateASCTray.exe C:WindowsSystem32jmdpstij.exe C:Program FilesMozilla Firefoxfirefox.exe C:Windowssystem32SearchIndexer.exe C:Program FilesFirebirdFirebird_2_5binfbserver.exe C:Program FilesWindows Media Playerwmpnetwk.exe C:WindowsSystem32WUDFHost.exe C:Program FilesMozilla Firefoxplugin-container.exe C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_149.exe C:Windowssystem32MacromedFlashFlashPlayerPlugin_11_5_502_149.exe C:Windowssystem32defrag.exe C:Windowssystem32conhost.exe C:Windowssystem32rundll32.exe C:Windowssystem32rundll32.exe C:Windowssystem32vssvc.exe C:Program FilesIObitAdvanced SystemCare UltimateASC.exe C:Windowssystem32SearchProtocolHost.exe C:Windowssystem32SearchFilterHost.exe C:Windowssystem32wbemwmiprvse.exe C:Windowssystem32conhost.exe C:Windowssystem32svchost.exe -k DcomLaunch C:Windowssystem32svchost.exe -k RPCSS C:WindowsSystem32svchost.exe -k LocalServiceNetworkRestricted C:WindowsSystem32svchost.exe -k LocalSystemNetworkRestricted C:Windowssystem32svchost.exe -k netsvcs C:Windowssystem32svchost.exe -k GPSvcGroup C:Windowssystem32svchost.exe -k LocalService C:Windowssystem32svchost.exe -k NetworkService C:Windowssystem32svchost.exe -k LocalServiceNoNetwork C:Windowssystem32svchost.exe -k imgsvc C:Windowssystem32svchost.exe -k LocalServiceAndNoImpersonation C:Windowssystem32svchost.exe -k NetworkServiceNetworkRestricted C:Windowssystem32svchost.exe -k SDRSVC C:Windowssystem32svchost.exe -k defragsvc C:WindowsSystem32svchost.exe -k swprv . ============== Pseudo HJT Report =============== . uStart Page = hxxp://mystart.incredibar.com/mb201?a=6R8RdwZRKz&i=26 uURLSearchHooks: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie6.8iobitappsToolbarIE.dll BHO: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie6.8iobitappsToolbarIE.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll BHO: Winamp Toolbar Loader: {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - c:program fileswinamp toolbarwinamptb.dll BHO: IB Updater: {336D0C35-8A85-403a-B9D2-65C292C39087} - c:program filesib updaterExtension32.dll BHO: Incredibar.com Helper Object: {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - c:program filesincredibar.comincredibar1.5.11.14bhincredibar.dll BHO: Advanced SystemCare Browser Protection: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - c:program filesiobitadvanced systemcare ultimatebrowerprotectASCPlugin_Protection.dll TB: Winamp Toolbar: {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - c:program fileswinamp toolbarwinamptb.dll TB: Winamp Toolbar: {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - c:program fileswinamp toolbarwinamptb.dll TB: Incredibar Toolbar: {F9639E4A-801B-4843-AEE3-03D9DA199E77} - c:program filesincredibar.comincredibar1.5.11.14incredibarTlbr.dll TB: IObit Apps Toolbar: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - c:program filesiobit apps toolbarie6.8iobitappsToolbarIE.dll uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun uRun: [Advanced SystemCare Ultimate] "c:program filesiobitadvanced systemcare ultimateASCTray.exe" /AutoStart uRun: [HKCU] c:windowssystem32installserver.exe mRun: [Adobe Reader Speed Launcher] "c:program filesadobereader 9.0readerReader_sl.exe" mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe" mRun: [synTPEnh] c:program filessynapticssyntpSynTPEnh.exe mRun: [cAudioFilterAgent] c:program filesconexantcaudiofilteragentcAudioFilterAgent.exe mRun: [smartAudio] c:program filesconexantsaiiSAIICpl.exe /t mRun: [igfxTray] c:windowssystem32igfxtray.exe mRun: [HotKeysCmds] c:windowssystem32hkcmd.exe mRun: [Persistence] c:windowssystem32igfxpers.exe mRun: [AdobeCS4ServiceManager] "c:program filescommon filesadobecs4servicemanagerCS4ServiceManager.exe" -launchedbylogin mRun: [QuickTime Task] "d:програмиQTTask.exe" -atboottime mRun: [NeroFilterCheck] c:windowssystem32NeroCheck.exe mRun: [WinampAgent] "c:program fileswinampwinampa.exe" mRun: [AVG_UI] "c:program filesavgavg2013avgui.exe" /TRAYONLY mRun: [searchSettings] "c:program filescommon filesspigotsearch settingsSearchSettings.exe" mRun: [HKLM] c:windowssystem32installserver.exe uExplorerRun: [Policies] c:windowssystem32installserver.exe uExplorerRun: [Policies] c:windowssystem32installserver.exe mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableLUA = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 mPolicies-System: PromptOnSecureDesktop = dword:0 IE: + Offline &Explorer: Download the link - c:program filesoffline explorer proAdd_UrlO.htm IE: + Offline E&xplorer: Download the current page - c:program filesoffline explorer proAdd_AllO.htm IE: E&xport to Microsoft Excel - c:program filesmicros~1office12EXCEL.EXE/3000 IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:program filespokerstarsPokerStarsUpdate.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 195.24.89.9 195.24.90.1 TCP: Interfaces{BC67FACB-85F8-4890-A156-4790EC722075} : DHCPNameServer = 195.24.89.9 195.24.90.1 TCP: Interfaces{BC67FACB-85F8-4890-A156-4790EC722075}6716C6F6E6 : DHCPNameServer = 192.168.1.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll Notify: igfxcui - igfxdev.dll SSODL: WebCheck - <orphaned> mASetup: {658GPA4E-66C5-1C5K-6H7D-D3FHW36BTL81} - c:windowssystem32installserver.exe mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:program filesgooglechromeapplication24.0.1312.57installerchrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome . ================= FIREFOX =================== . FF - ProfilePath - c:usersuserappdataroamingmozillafirefoxprofilesjwwedgsp.default FF - prefs.js: browser.search.selectedEngine - MyStart Search FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredibar.com/mb201?a=6R8RdwZRKz&i=26 FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb201/?loc=IB_DS&a=6R8RdwZRKz&&i=26&search= FF - plugin: c:program filesgoogleupdate1.3.21.124npGoogleUpdate3.dll FF - plugin: c:windowssystem32adobedirectornp32dsw_1168638.dll FF - plugin: c:windowssystem32macromedflashNPSWF32_11_5_502_149.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin2.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin3.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin4.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin5.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin6.dll FF - plugin: d:рџсђрѕрісђр°рјрёpluginsnpqtplugin7.dll . ---- FIREFOX POLICIES ---- FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: browser.turbo.enabled - true FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.chrome.favicons - false FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.cache.memory.capacity - 65536 FF - user.js: content.notify.ontimer - true FF - user.js: content.interrupt.parsing - true FF - user.js: content.max.tokenizing.time - 2250000 FF - user.js: content.switch.threshold - 750000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 FF - user.js: extensions.incredibar_i.newTab - false FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8RdwZRKz&loc=IB_TB&i=26&search= FF - user.js: extensions.incredibar_i.id - 3c81d08500000000000000266c7a52e7 FF - user.js: extensions.incredibar_i.instlDay - 15718 FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14 FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1418:06:13 FF - user.js: extensions.incredibar_i.prtnrId - Incredibar FF - user.js: extensions.incredibar_i.prdct - incredibar FF - user.js: extensions.incredibar_i.aflt - orgnl FF - user.js: extensions.incredibar_i.smplGrp - none FF - user.js: extensions.incredibar_i.tlbrId - base FF - user.js: extensions.incredibar_i.instlRef - FF - user.js: extensions.incredibar_i.dfltLng - FF - user.js: extensions.incredibar_i.excTlbr - false FF - user.js: extensions.incredibar_i.ms_url_id - FF - user.js: extensions.incredibar_i.upn2 - 6R8RdwZRKz FF - user.js: extensions.incredibar_i.upn2n - 92825740600230611 FF - user.js: extensions.incredibar_i.productid - 26 FF - user.js: extensions.incredibar_i.installerproductid - 26 FF - user.js: extensions.incredibar_i.did - 10643 FF - user.js: extensions.incredibar_i.ppd - 1 . ============= SERVICES / DRIVERS =============== . R?2 avgwd;AVG WatchDog;c:program filesavgavg2013avgwdsvc.exe [2012-10-22 196664] R0 AVGIDSHX;AVGIDSHX;c:windowssystem32driversavgidshx.sys [2012-10-15 55776] R0 Avglogx;AVG Logging Driver;c:windowssystem32driversavglogx.sys [2012-9-21 177376] R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:windowssystem32driversavgmfx86.sys [2012-11-15 94048] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:windowssystem32driversavgrkx86.sys [2012-9-14 35552] R1 aswKbd;aswKbd;c:windowssystem32driversaswKbd.sys [2012-10-31 20624] R1 AVGIDSDriver;AVGIDSDriver;c:windowssystem32driversavgidsdriverx.sys [2012-10-22 179936] R1 AVGIDSShim;AVGIDSShim;c:windowssystem32driversavgidsshimx.sys [2012-9-21 19936] R1 Avgldx86;AVG AVI Loader Driver;c:windowssystem32driversavgldx86.sys [2012-10-2 159712] R1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32driversvwififlt.sys [2009-7-14 48128] R2 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:program filesiobitadvanced systemcare ultimateASCSvc.exe [2013-1-11 1051088] R2 Apache2.4;Apache2.4;c:xamppapachebinhttpd.exe [2012-8-18 22016] R2 Application Updater;Application Updater;c:program filesapplication updaterApplicationUpdater.exe [2013-2-7 800120] R2 ASCAntivirusSrv;AdvancedSystemCareAntivirus;c:program filesiobitadvanced systemcare ultimateASCAvSvc.exe [2013-1-11 621008] R2 AVGIDSAgent;AVGIDSAgent;c:program filesavgavg2013avgidsagent.exe [2012-11-15 5814904] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:program filesfirebirdfirebird_2_5binfbguard.exe [2012-11-11 98304] R2 IB Updater;IB Updater;c:program filesib updaterExtensionUpdaterService.exe [2013-1-13 188760] R2 IBUpdaterService;IBUpdaterService;c:windowssystem32dmwu.exe [2013-1-13 1087792] R2 TeamViewer8;TeamViewer 8;c:program filesteamviewerversion8TeamViewer_Service.exe [2013-1-3 3467768] R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:program filesfirebirdfirebird_2_5binfbserver.exe [2012-11-11 3735552] R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:windowssystem32driversL1C62x86.sys [2011-4-19 69232] R3 mcdevice;mcdevice;c:windowssystem32driversmcdevice.sys [2012-12-9 322816] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsmicrosoft.netframeworkv4.0.30319mscorsvw.exe [2010-3-18 130384] S2 gupdate;Услуга на Google Актуализация (gupdate);c:program filesgoogleupdateGoogleUpdate.exe [2013-2-7 116648] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:windowssystem32macromedflashFlashPlayerUpdateService.exe [2012-10-31 251248] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:windowssystem32driversb57nd60x.sys [2009-7-14 229888] S3 dmvsc;dmvsc;c:windowssystem32driversdmvsc.sys [2011-4-12 62464] S3 gupdatem;Услуга на Google Актуализация (gupdatem);c:program filesgoogleupdateGoogleUpdate.exe [2013-2-7 116648] S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-12-7 115608] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:windowssystem32driversrdpvideominiport.sys [2012-10-31 14848] S3 Synth3dVsc;Synth3dVsc;c:windowssystem32driversSynth3dVsc.sys [2011-4-12 77184] S3 terminpt;Microsoft Remote Desktop Input Driver;c:windowssystem32driversterminpt.sys [2012-10-31 24064] S3 TsUsbGD;Remote Desktop Generic USB Device;c:windowssystem32driversTsUsbGD.sys [2012-10-31 27136] S3 WatAdminSvc;Услуга на технологиите за активиране на Windows;c:windowssystem32watWatAdminSvc.exe [2012-11-7 1343400] SUnknown TsUsbFlt;TsUsbFlt; [x] SUnknown tsusbhub;tsusbhub; [x] . =============== File Associations =============== . FileExt: .js: jsfile="c:program filesadobeadobe dreamweaver cs4Dreamweaver.exe","%1" ShellExec: dreamweaver.exe: Open="c:program filesadobeadobe dreamweaver cs4dreamweaver.exe", "%1" . =============== Created Last 30 ================ . 2013-02-09 13:19:40  --------  d-----w-  c:program filesIObit Apps Toolbar 2013-02-09 13:19:40  --------  d-----w-  c:program filescommon filesSpigot 2013-02-09 13:19:40  --------  d-----w-  c:program filesApplication Updater 2013-02-08 16:22:19  --------  d-sh--w-  C:found.003 2013-02-08 12:36:16  --------  d-sh--w-  C:found.002 2013-02-07 14:19:41  --------  d-sh--w-  C:found.001 2013-02-07 13:30:25  --------  d-sh--w-  C:found.000 2013-02-01 15:43:35  --------  d-----w-  c:usersuserappdataroamingOffline Explorer 2013-02-01 15:42:20  --------  d-----w-  c:program filesOffline Explorer Pro 2013-01-29 16:38:42  --------  d-----w-  C:Games 2013-01-29 16:10:04  --------  d-----w-  c:windowssystem32jmdp 2013-01-25 14:36:43  --------  d-----w-  c:program filesMozilla Firefox.bak 2013-01-13 16:06:18  --------  d-----w-  c:program filesPerion 2013-01-13 16:06:12  --------  d-----w-  c:program filesIncredibar.com 2013-01-13 16:06:07  632656  ----a-w-  c:windowssystem32msvcr80.dll 2013-01-13 16:06:07  554832  ----a-w-  c:windowssystem32msvcp80.dll 2013-01-13 16:06:07  479232  ----a-w-  c:windowssystem32msvcm80.dll 2013-01-13 16:06:04  28160  ----a-w-  c:windowssystem32ImHttpComm.dll 2013-01-13 16:06:04  1087792  ----a-w-  c:windowssystem32dmwu.exe 2013-01-13 16:06:04  --------  d-----w-  c:windowssystem32WNLT 2013-01-13 16:06:04  --------  d-----w-  c:windowssystem32ARFC 2013-01-13 16:06:02  --------  d-----w-  c:program filesIB Updater 2013-01-11 16:09:28  --------  d-----w-  c:windowsPCHEALTH . ==================== Find3M  ==================== . 2013-02-08 15:40:11  74096  ----a-w-  c:windowssystem32FlashPlayerCPLApp.cpl 2013-02-08 15:40:11  697712  ----a-w-  c:windowssystem32FlashPlayerApp.exe 2012-12-16 14:13:28  295424  ----a-w-  c:windowssystem32atmfd.dll 2012-12-16 14:13:20  34304  ----a-w-  c:windowssystem32atmlib.dll 2012-12-07 12:26:17  308736  ----a-w-  c:windowssystem32Wpc.dll 2012-12-07 12:20:43  2576384  ----a-w-  c:windowssystem32gameux.dll 2012-11-30 04:53:34  169984  ----a-w-  c:windowssystem32winsrv.dll 2012-11-30 04:47:45  293376  ----a-w-  c:windowssystem32KernelBase.dll 2012-11-30 02:55:25  271360  ----a-w-  c:windowssystem32conhost.exe 2012-11-30 02:38:59  6144  ---ha-w-  c:windowssystem32api-ms-win-security-base-l1-1-0.dll 2012-11-30 02:38:59  4608  ---ha-w-  c:windowssystem32api-ms-win-core-threadpool-l1-1-0.dll 2012-11-30 02:38:59  3584  ---ha-w-  c:windowssystem32api-ms-win-core-xstate-l1-1-0.dll 2012-11-30 02:38:59  3072  ---ha-w-  c:windowssystem32api-ms-win-core-util-l1-1-0.dll 2012-11-23 02:56:23  2345984  ----a-w-  c:windowssystem32win32k.sys 2012-11-23 02:48:41  49152  ----a-w-  c:windowssystem32taskhost.exe 2012-11-22 04:45:03  626688  ----a-w-  c:windowssystem32usp10.dll 2012-11-20 04:51:09  220160  ----a-w-  c:windowssystem32ncrypt.dll 2012-11-14 02:09:22  1800704  ----a-w-  c:windowssystem32jscript9.dll 2012-11-14 01:58:15  1427968  ----a-w-  c:windowssystem32inetcpl.cpl 2012-11-14 01:57:37  1129472  ----a-w-  c:windowssystem32wininet.dll 2012-11-14 01:49:25  142848  ----a-w-  c:windowssystem32ieUnatt.exe 2012-11-14 01:48:27  420864  ----a-w-  c:windowssystem32vbscript.dll 2012-11-14 01:44:42  2382848  ----a-w-  c:windowssystem32mshtml.tlb . ============= FINISH: 18:02:07,45 ===============  

1. Изтеглете ComboFix от BleepingComputer


и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:



След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:


2.Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.


3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.


4. Ако получите предупреждение от UAC, съгласете се.


5 ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix
ще сканира за проблеми и за заразени файлове, като това може да отнеме
известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет
връзката след приключване на работата на Combofix, моля да прочетете това: Manually restoring the Internet connection section.


6 Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:




Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

Забележка: Ако се появи следното съобщение при отварянето на различни програми след завършване на сканирането с Combofix - "illegal operation on a registry key that has been marked for deletion." просто рестартирайте компютъра още веднъж и то ще изчезне. По време на сканирането не използвайте компютъра си !

От 30 минути това ми стой на екрана- http://prikachi.com/images/680/5853680d.jpg Нормално ли е?

В повечето случаи да... Дайте още време на скенера...и не използвайте машината по време на проверката. Надявам се изключихте антивирусната преди да стартирате проверката?

Има ли индикация от диода на хардиска, че се случва нещо?

Имате ли някакви проблеми след изпълнението на Combofix?

Дръжте ме в течение за да можем да оправим нещата при нужда.