Премини към съдържанието
Форумът в приложение

По-лесно сърфиране. Научи повече.
Kaldata.com - Форуми

Приложение на форума на цял екран с push известия, значки и други.

За да инсталирате това приложение на iOS и iPadOS
  1. Докоснете Иконата за споделяне в Safari
  2. Превъртете менюто и докоснете Добавяне към началния екран.
  3. Докоснете Добавяне в горния десен ъгъл.
За да инсталирате това приложение на Android
  1. Докоснете менюто с 3 точки (⋮) в горния десен ъгъл на браузъра.
  2. Докоснете Добавяне към началния екран или Инсталиране на приложение.
  3. Потвърдете, като докоснете Инсталиране.
Добави Kaldata.com в предпочитани източници в Google

Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

 

Имам вирус, но не мога да го изчистя.

валя 0114
в Премахване на зловреден софтуер

Featured Replies

здравейте , не мога да пусна нито една антивирусна , не мога да заредя и сейф мод , връща ме в началото . Какво да направя ?

  • Автор
DDS (Ver_2011-09-30.01) - NTFS_x86 
Internet Explorer: 6.0.2900.2180  BrowserJavaVersion: 10.5.1
Run by Userrrr at 12:56:12 on 2013-03-12
Microsoft Windows XP Professional  5.1.2600.2.1251.1.1033.18.767.287 [GMT 2:00]
.
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ================
.
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32spoolsv.exe
C:Program FilesAviraAntiVir Desktopsched.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32RUNDLL32.EXE
C:WINDOWSRTHDCPL.EXE
C:Program FilesSweetIMMessengerSweetIM.exe
C:WINDOWSDatecsFlex2K.exe
C:Program FilesMcAfee Security Scan3.0.313SSScheduler.exe
C:FoxServmysqlbinwinmysqladmin.exe
C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exe
C:FoxServApachebinApache.exe
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserProtect.exe
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserProtect.exe
C:FoxServApachebinApache.exe
C:Program FilesOracleJavaFX 2.1 Runtimebinjqs.exe
C:FoxServmysqlbinmysqld-nt.exe
C:WINDOWSMicrosoft.NETFrameworkv3.0Windows Communication FoundationSMSvcHost.exe
C:WINDOWSsystem32HPZipm12.exe
C:Documents and SettingsAll Users.WINDOWSApplication DataSkypeToolbarsSkype C2C Servicec2c_service.exe
C:WINDOWSsystem32wscntfy.exe
C:Documents and SettingsUserrrrLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsUserrrrLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Documents and SettingsUserrrrLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:Program FilesCommon FilesJavaJava Updatejucheck.exe
C:WINDOWSsystem32ntvdm.exe
C:Documents and SettingsUserrrrLocal SettingsApplication DataGoogleChromeApplicationchrome.exe
C:WINDOWSsystem32wbemwmiprvse.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
C:WINDOWSsystem32svchost.exe -k NetworkService
C:WINDOWSsystem32svchost.exe -k LocalService
C:WINDOWSsystem32svchost.exe -k imgsvc
C:WINDOWSSystem32svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=6899e609000000000000001b220446fe
uSearch Bar = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://www.google.com
mSearch Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = ${SEARCH_URL_IE7}
uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {EEE6C35D-6118-11DC-9C72-001320C79847} - c:program filessweetimtoolbarsinternet explorermgHelper.dll
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:program filesmcafee security scan3.0.313McAfeeMSS_IE.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:program filescommon filesadobeacrobatactivexAcroIEHelperShim.dll
BHO: Babylon toolbar helper: {2EECD738-5844-4a99-B4B6-146BF802613B} - 
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:program filesoraclejavafx 2.1 runtimebinssv.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll
BHO: Blekko Search Bar Helper Object: {BAE35237-8D73-44D0-905C-8A95EA1E7E69} - c:program filesblekkospamfreesearch1.8.3.9bhspamfreesearch.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:program filesoraclejavafx 2.1 runtimebinjp2ssv.dll
BHO: DownTango Launcher: {e327b07a-0e11-4fd4-bef2-b2c5605b59c6} - c:documents and settingsuserrrrapplication datadowntangofttoolbarDownTangoFTToolbar.dll
BHO: SweetPacks Browser Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - c:program filessweetimtoolbarsinternet explorermgToolbarIE.dll
TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - c:program filessweetimtoolbarsinternet explorermgToolbarIE.dll
TB: SweetPacks Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - c:program filessweetimtoolbarsinternet explorermgToolbarIE.dll
TB: DownTango Launcher: {e327b07a-0e11-4fd4-bef2-b2c5605b59c6} - c:documents and settingsuserrrrapplication datadowntangofttoolbarDownTangoFTToolbar.dll
TB: Blekko Search Bar Toolbar: {EECF410C-006C-4A05-AD13-6741A0814DBF} - c:program filesblekkospamfreesearch1.8.3.9spamfreesearchTlbr.dll
uRun: [Google Update] "c:documents and settingsuserrrrlocal settingsapplication datagoogleupdateGoogleUpdate.exe" /c
uRun: [skype] "c:program filesskypephoneSkype.exe" /minimized /regrun
uRun: [Video Performer63920.exe] "c:docume~1userrrrlocals~1tempvideo performer63920.exe" /xml="c:docume~1userrrrlocals~1temp484.tmp" /STP=0:2
uRun: [Microsoft Windows Manager] c:documents and settingsuserrrrs-80-5421-8975-4765winmgr.exe
mRun: [nwiz] nwiz.exe /installquiet
mRun: [NvMediaCenter] RUNDLL32.EXE c:windowssystem32NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:windowssystem32NvCpl.dll,NvStartup
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [avgnt] "c:program filesaviraantivir desktopavgnt.exe" /min
mRun: [Adobe ARM] "c:program filescommon filesadobearm1.0AdobeARM.exe"
mRun: [sunJavaUpdateSched] "c:program filescommon filesjavajava updatejusched.exe"
mRun: [sweetIM] c:program filessweetimmessengerSweetIM.exe
StartupFolder: c:docume~1userrrrstartm~1programsstartupwinmys~1.lnk - c:foxservmysqlbinwinmysqladmin.exe
StartupFolder: c:docume~1alluse~1.winstartm~1programsstartupflexty~1.lnk - c:windowsdatecsFlex2K.exe
StartupFolder: c:docume~1alluse~1.winstartm~1programsstartupmcafee~1.lnk - c:program filesmcafee security scan3.0.313SSScheduler.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-System: EnableLUA = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: Add to Google Photos Screensa&ver - c:windowssystem32GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:progra~1micros~2office11EXCEL.EXE/3000
IE: {2d8ee268-8d7a-4996-b80b-8999ce8c7fe2} - {e327b07a-0e11-4fd4-bef2-b2c5605b59c6}
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:program filespokerstarsPokerStarsUpdate.exe
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: Interfaces{8A2DD4A6-A3F8-4AA8-A065-ADC9CBD9BDC0} : NameServer = 212.39.90.42,212.39.90.43
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:program filesskypetoolbarsinternet explorerskypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:program filescommon filesskypeSkype4COM.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:documents and settingsuserrrrapplication datamozillafirefoxprofiles7lanbcba.default
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.startup.homepage - hxxp://www.google.bg/
FF - plugin: c:documents and settingsuserrrrapplication datafacebooknpfbplugin_1_0_3.dll
FF - plugin: c:documents and settingsuserrrrlocal settingsapplication datagoogleupdate1.3.21.135npGoogleUpdate3.dll
FF - plugin: c:program filesadobereader 10.0readerairnppdf32.dll
FF - plugin: c:program filesgooglepicasa3npPicasa3.dll
FF - plugin: c:program filesmcafee security scan3.0.313npMcAfeeMSS.dll
FF - plugin: c:program filesmicrosoft silverlight4.0.60310.0npctrlui.dll
FF - plugin: c:program filesoraclejavafx 2.1 runtimebinplugin2npjp2.dll
FF - plugin: c:windowssystem32npDeployJava1.dll
FF - plugin: c:windowssystem32npptools.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=6899e609000000000000001b220446fe&q=
FF - user.js: extensions.BabylonToolbar.id - 6899e609000000000000001b220446fe
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15715
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.7.2
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.7.2
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.7.215:18:17
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar_i.excTlbr - false
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=109220&tt=0213_4
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.spamfreesearch.autoRvrt - false
FF - user.js: extensions.spamfreesearch_i.hmpg - true
FF - user.js: extensions.spamfreesearch.hmpgUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=homepage&u=6899e609000000000000001b220446fe
FF - user.js: extensions.spamfreesearch.dfltSrch - true
FF - user.js: extensions.spamfreesearch.srchPrvdr - blekko
FF - user.js: extensions.spamfreesearch.keyWordUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=rbox&u=6899e609000000000000001b220446fe&q=
FF - user.js: extensions.spamfreesearch_i.dnsErr - true
FF - user.js: extensions.spamfreesearch_i.newTab - true
FF - user.js: extensions.spamfreesearch.newTabUrl - chrome://spamfreesearch/content/new browser tab.html?source=5f97ddbe&tbp=tab&u=6899e609000000000000001b220446fe
FF - user.js: extensions.spamfreesearch.tlbrSrchUrl - hxxp://blekko.com/ws/?source=5f97ddbe&tbp=main&u=6899e609000000000000001b220446fe&q=
FF - user.js: extensions.spamfreesearch.id - 6899e609000000000000001b220446fe
FF - user.js: extensions.spamfreesearch.appId - {1005247F-A178-490A-8DC3-6BAF09EA427B}
FF - user.js: extensions.spamfreesearch.instlDay - 15750
FF - user.js: extensions.spamfreesearch.vrsn - 1.8.3.9
FF - user.js: extensions.spamfreesearch.vrsni - 1.8.3.9
FF - user.js: extensions.spamfreesearch_i.vrsnTs - 1.8.3.913:23:46
FF - user.js: extensions.spamfreesearch.prtnrId - blekko
FF - user.js: extensions.spamfreesearch.prdct - spamfreesearch
FF - user.js: extensions.spamfreesearch.aflt - orgnl
FF - user.js: extensions.spamfreesearch_i.smplGrp - none
FF - user.js: extensions.spamfreesearch.tlbrId - base
FF - user.js: extensions.spamfreesearch.instlRef - 5f97ddbe
FF - user.js: extensions.spamfreesearch.dfltLng - 
FF - user.js: extensions.spamfreesearch.excTlbr - false
FF - user.js: extensions.spamfreesearch.admin - false
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:program filesaviraantivir desktopavgio.sys [2011-5-13 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:program filesaviraantivir desktopsched.exe [2011-5-13 136360]
R2 avgntflt;avgntflt;c:windowssystem32driversavgntflt.sys [2011-5-13 66616]
R2 BrowserProtect;BrowserProtect;c:documents and settingsall users.windowsapplication databrowserprotect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserProtect.exe [2013-1-10 2547816]
R2 Skype C2C Service;Skype C2C Service;c:documents and settingsall users.windowsapplication dataskypetoolbarsskype c2c servicec2c_service.exe [2013-1-31 3289208]
R3 asc3360pr;asc3360pr;??c:windowssystem32driversiimsne.sys --> c:windowssystem32driversiimsne.sys [?]
S2 AntiVirService;Avira AntiVir Guard;c:program filesaviraantivir desktopavguard.exe [2011-5-13 351400]
S2 cqtvf;aqcmuhbc;c:windowssystem32svchost.exe -k netsvcs [2004-8-4 14336]
S2 SkypeUpdate;Skype Updater;c:program filesskypeupdaterUpdater.exe [2013-1-8 235264]
S3 Ambfilt;Ambfilt;c:windowssystem32driversAmbfilt.sys [2010-3-4 1691480]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:program filesmcafee security scan3.0.313McCHSvc.exe [2012-10-26 312600]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:program filesmozilla maintenance servicemaintenanceservice.exe [2012-4-26 189336]
S3 NPF;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2008-12-23 50704]
.
=============== Created Last 30 ================
.
2013-03-12 07:15:48 0 ---ha-w- c:documents and settingsuserrrrapplication datawinsvcns.sys
2013-03-12 07:15:34 -------- d-sh--r- c:documents and settingsuserrrrS-80-5421-8975-4765
2013-03-04 14:50:47 -------- d-----w- c:documents and settingsall users.windowsKaspersky Lab Setup Files
2013-03-04 14:24:17 -------- d-----w- c:windowssystem32wbemrepositoryFS
2013-03-04 14:24:17 -------- d-----w- c:windowssystem32wbemRepository
2013-03-04 14:21:40 -------- d-----w- c:documents and settingsuserrrrapplication dataBabSolution
2013-03-04 14:21:29 -------- d-----w- c:documents and settingsuserrrrapplication datago
2013-03-04 14:21:29 -------- d-----w- c:documents and settingsall users.windowsapplication dataEasybits GO
2013-03-04 14:21:21 -------- d-----w- c:program filesblekko
2013-03-04 14:21:21 -------- d-----w- c:documents and settingsuserrrrapplication datablekko
2013-02-28 16:24:39 -------- d-----w- c:documents and settingsall users.windowsapplication dataAMMYY
2013-02-28 16:22:34 -------- d-----w- c:documents and settingsuserrrrapplication dataGeek Uninstaller
2013-02-28 15:51:18 -------- d-----w- c:program filesESET
2013-02-22 10:25:58 -------- d-----w- c:program filesWinPcap
2013-02-22 10:25:40 -------- d-----w- c:program filesCain
2013-02-20 07:28:29 -------- d-----r- C:Sandbox
2013-02-15 22:31:23 186432 ----a-w- c:program filesmozilla firefoxpluginsnppdf32.dll
2013-02-15 22:31:23 186432 ----a-w- c:program filesinternet explorerpluginsnppdf32.dll
2013-02-13 13:27:10 -------- d-----w- c:program filesOptimizer Pro
2013-02-13 13:26:54 -------- d-----w- c:program filesBrowseToSave
2013-02-13 09:06:19 -------- d-----w- c:documents and settingsall users.windowsapplication dataRightClick
2013-02-13 09:05:30 -------- d-----w- c:documents and settingsall users.windowsapplication dataInstallMate
.
==================== Find3M  ====================
.
.
============= FINISH: 12:56:42.25 ===============
 
 
ето това показа 

Редактирано от валя 0114 (преглед на промените)

  • Автор

първата програма - не тръгва 

втората - след рестарт , мисля че заби

третата - след като копирам и поставя , какво да правя за да тръгне ?

Първата - малко повече информация ще може ли?

Втората - как разбрахте, че е забила - колко време и дадохте?

Третата - след като копирате текста натиснете Run Scan.

Всъщност първата няма опция RUN.

Adwcleaner има опция Search или Delete.

Нито едната от тях ли не работи?

Нищо...засега не ги барайте за да не влошим положението...аз ще говоря с автора на инструмента.

След малко ще постна и скрипт за ОTL за да почистим системата...Логовете са дългички и анализа може да отнеме някакво време...

  • Автор

излезе ми и това 

след двоен клик ми излиза RUN , и не зарежда нищо 

Ок...няма проблеми. Аз писах на автора. Сега ще погледна и ОTL логовете.


Лоши новини и промяна в плана...после ще чистим с OTL...Имаме си работа с Conficker + полиморфен вирус Sality...

Sality е опасен вирус, защото заразява всички scr и exe файлове на всички дялове...В повечето случаи се препоръчва формат с изтриване на всички дялове, но да се опитаме да закърпим положението...

 

 

 

1. Спрете Autorun функцията.
 

Изтеглете и стартирайте следния файл Публикувано изображение

Стартирайте го и се съгласете с лицензионното споразумение.
Натиснете Next и изчакайте да си свърпи работата.



2. Спрете System Restore функцията.


Щракнете с десен бутон върху My Computer, след това изберете Properties => отидете на System Restore => изберете опцията Turn off System Restore on all drives => натиснете Apply и затворете прозореца.

 

Публикувано изображение

 


3. Изтеглете SalityKiller и го запазете на десктопа.
Изключете интернет достъпа и след това сканирайте с него по описания по-надолу начин:

  • Изтеглете SalityKiller и запазете инструмента на десктопа.
  • Отворете Start => Run в полето въведете CMD => натиснете Enter => след това  с copy/paste копирайте командата и я поставете в черния прозорец на CMD с десен бутон на мишката => paste "%userprofile%desktopsalitykiller.exe" -n -r -x -a -j -k -l c:report.txt
  • Изчакайте проверката да завърши.
  • След като тя приключи, публикувайте съдържанието на лог файла C:report.txt в следващия си пост.

 

 

4.Направете една проверка с Kaspersky Virus Removal Tool

След като изтеглите инструмента, изключете достъпа до интернет.

След като стартирате инструмента, отидете до Settings (Иконата, която прилича на звездичка) сложете отметка пред My Computer.
Публикувано изображение

От опциите за почистване изберете Disinfect => но не избирайте delete if disinfection fails.
Публикувано изображение

Върнете се до Automatic Scan и натиснете Start Scanning.
Публикувано изображение

Ако по време на сканирането ви попита за дадено действие изберете skip.

След като приключи проверката изберете Report (Иконата която прилича на листче) => Detected Threats изберете SAVE и запазете документа на десктопа.
Публикувано изображение

Kопирайте съдържанието му в следващия си пост.
Затворете инструмента - това ще до деинсталира автоматично.

 

 

Това са засега инструкциите...след като изчистим Sality ще се насочим към оправянето на поразиите от Conficker и останалите вредители като BrowserProtect...

  • Автор

не мога да изтегля SALITY KILLER ? от линка който сте ми дали 

Здравейте,

  • [*]Стартирайте файла Публикувано изображение с двукратен клик на мишката. [*]Под Публикувано изображение с
Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

:OTLPRC - [2013/03/12 09:14:38 | 000,657,760 | RHS- | M] () -- C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exeMOD - [2013/03/12 09:14:38 | 000,657,760 | RHS- | M] () -- C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exeMOD - [2012/12/25 10:51:45 | 002,202,728 | ---- | M] () -- c:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}BrowserProtect.dllSRV - File not found [Auto | Stopped] -- C:WINDOWSsystem32zgynj.dll -- (cqtvf)DRV - File not found [Kernel | On_Demand | Running] -- C:WINDOWSsystem32driversiimsne.sys -- (asc3360pr)IE - HKLMSOFTWAREMicrosoftInternet ExplorerMain,Start Default_Page_URL = http://search.certified-toolbar.com?si=41460&home=true&tid=2937IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,Search Bar = http://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,Search Page = http://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,Start Default_Page_URL = http://search.certified-toolbar.com?si=41460&home=true&tid=2937IE - HKLMSOFTWAREMicrosoftInternet ExplorerSearch,Start Page = http://search.certified-toolbar.com?si=41460&home=true&tid=2937IE - HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerMain,Start Default_Page_URL = http://search.certified-toolbar.com?si=41460&home=true&tid=2937IE - HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearch,Search Bar = http://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=IE - HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearch,Search Page = http://search.certified-toolbar.com?si=41460&tid=2937&bs=true&q=IE - HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearch,Start Default_Page_URL = http://search.certified-toolbar.com?si=41460&home=true&tid=2937IE - HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearch,Start Page = http://search.certified-toolbar.com?si=41460&home=true&tid=2937IE - HKUS-1-5-21-1801674531-299502267-725345543-1003..URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - SOFTWAREClassesCLSID{EEE6C35D-6118-11DC-9C72-001320C79847}InprocServer32 File not foundIE - HKUS-1-5-21-1801674531-299502267-725345543-1003..SearchScopes12C2CFC3-ACF8-42E1-9772-78F9929F2DCF: "URL" = http://blekko.com/ws/?source=5f97ddbe&tbp=rbox&u=6899e609000000000000001b220446fe$amp;q={searchTerms}[2010/09/09 16:29:43 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultextensionsquickstores@quickstores.de[2013/01/10 15:16:39 | 000,213,444 | ---- | M] () (No name found) -- C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultextensionstorntv@torntv.com.xpi[2013/01/10 15:18:45 | 000,002,432 | ---- | M] () -- C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultsearchpluginsbabylon1.xml[2013/01/10 15:17:19 | 000,002,349 | ---- | M] () -- C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultsearchpluginsBrowserProtect.xml[2013/01/09 15:33:14 | 000,003,269 | ---- | M] () -- C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultsearchpluginsWeb Search.xml[2012/12/06 09:03:56 | 000,000,000 | ---D | M] (QuickStores-Toolbar) -- C:Program FilesMozilla [email protected][2013/01/09 15:33:14 | 000,003,269 | ---- | M] () -- C:Program Filesmozilla firefoxsearchpluginsWeb Search.xmlO2 - BHO: (Blekko Search Bar Helper Object) - {BAE35237-8D73-44D0-905C-8A95EA1E7E69} - C:Program Filesblekkospamfreesearch1.8.3.9bhspamfreesearch.dll File not foundO2 - BHO: (DownTango Launcher) - {e327b07a-0e11-4fd4-bef2-b2c5605b59c6} - C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbarDownTangoFTToolbar.dll (Simplytech Ltd.)O3 - HKLM..Toolbar: (DownTango Launcher) - {e327b07a-0e11-4fd4-bef2-b2c5605b59c6} - C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbarDownTangoFTToolbar.dll (Simplytech Ltd.)O3 - HKLM..Toolbar: (Blekko Search Bar Toolbar) - {EECF410C-006C-4A05-AD13-6741A0814DBF} - C:Program Filesblekkospamfreesearch1.8.3.9spamfreesearchTlbr.dll File not foundO4 - HKUS-1-5-21-1801674531-299502267-725345543-1003..Run: [Microsoft Windows Manager] C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exe ()O4 - HKUS-1-5-21-1801674531-299502267-725345543-1003..Run: [Video Performer63920.exe] "C:DOCUME~1UserrrrLOCALS~1TempVideo Performer63920.exe" /XML="C:DOCUME~1UserrrrLOCALS~1Temp484.tmp" /STP=0:2 File not foundO33 - MountPoints2{679e37ca-4eb4-11df-b1d4-001b220446fe}ShellAutoRuncommand - "" = F:utcddeq.exeO33 - MountPoints2{679e37ca-4eb4-11df-b1d4-001b220446fe}ShellopenCommand - "" = F:utcddeq.exeNetSvcs: cqtvf - C:WINDOWSsystem32zgynj.dll File not found[2013/03/12 09:15:34 | 000,000,000 | RHSD | C] -- C:Documents and SettingsUserrrrS-80-5421-8975-4765[2013/03/04 16:22:39 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll Users.WINDOWSStart MenuProgramsProtected Search[2013/02/13 15:26:54 | 000,000,000 | ---D | C] -- C:Program FilesBrowseToSave[2013/01/10 15:18:31 | 000,000,000 | ---D | C] -- C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect[2013/01/10 15:16:35 | 000,000,000 | ---D | C] -- C:Program FilesTornTV.com[2013/01/10 15:16:35 | 000,000,000 | ---D | C] -- C:Documents and SettingsUserrrrStart MenuProgramsTornTV.com[2013/01/09 15:33:19 | 000,000,000 | ---D | C] -- C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbar[2013/01/09 15:33:06 | 000,000,000 | ---D | C] -- C:Documents and SettingsUserrrrLocal SettingsApplication DataDownTangoFTToolbar[2013/01/07 16:52:50 | 000,000,000 | ---D | C] -- C:Documents and SettingsUserrrrApplication DataExpressFiles[2013/03/12 16:50:50 | 000,000,000 | -H-- | M] () -- C:Documents and SettingsUserrrrApplication Datawinsvcns.sys[2013/03/12 16:50:44 | 000,236,466 | ---- | M] () -- C:WINDOWSSystem32NvApps.xml[2013/03/12 16:50:43 | 000,000,334 | ---- | M] () -- C:WINDOWStasksProtected Search.job[2013/03/12 16:50:43 | 000,000,290 | ---- | M] () -- C:WINDOWStasksExpress FilesUpdate.job@Alternate Data Stream - 1161576 bytes -> C:WINDOWSTemp:temp:filesC:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exeC:Documents and SettingsUserrrrMy DocumentsDownloadsIMG0540250-JPG (1).scr    C:Documents and SettingsUserrrrMy DocumentsDownloadsIMG0540250-JPG (2).scr    C:Documents and SettingsUserrrrMy DocumentsDownloadsIMG0540250-JPG.scr:reg[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile]"EnableFirewall"=dword:00000001[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList]"C:Program FilesExpressFilesexpressdl.exe"=-"C:Program FilesExpressFilesExpressFiles.exe"=-"C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exe"=-:commands[resethosts][emptytemp]
  • [*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в
червено: Run Fix [*]Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

 

 

След това изтеглете SalityKiller от прикачения файл SalityKiller.zip и го зарархивирайте на десктопа.

След това го стартирайте по-начина описан в предишния ми коментар.

Публикувайте резултатите от проверката....

След това ще продължим с две важни начинания...Combofix за да премахнем рууткит услугата + ръчно поправяне на system.ini файла.

Поздрави! :)

  • Автор
All processes killed
========== OTL ==========
No active process named winmgr.exe was found!
Service cqtvf stopped successfully!
Service cqtvf deleted successfully!
File C:WINDOWSsystem32zgynj.dll not found.
Error: Unable to stop service asc3360pr!
Registry key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesasc3360pr deleted successfully.
File C:WINDOWSsystem32driversiimsne.sys not found.
HKLMSOFTWAREMicrosoftInternet ExplorerMainStart Default_Page_URL| /E : value set successfully!
HKLMSOFTWAREMicrosoftInternet ExplorerSearchSearch Bar| /E : value set successfully!
HKLMSOFTWAREMicrosoftInternet ExplorerSearchSearch Page| /E : value set successfully!
HKLMSOFTWAREMicrosoftInternet ExplorerSearchStart Default_Page_URL| /E : value set successfully!
HKLMSOFTWAREMicrosoftInternet ExplorerSearchStart Page| /E : value set successfully!
HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerMainStart Default_Page_URL| /E : value set successfully!
HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearchSearch Bar| /E : value set successfully!
HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearchSearch Page| /E : value set successfully!
HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearchStart Default_Page_URL| /E : value set successfully!
HKUS-1-5-21-1801674531-299502267-725345543-1003SOFTWAREMicrosoftInternet ExplorerSearchStart Page| /E : value set successfully!
Registry value HKEY_USERSS-1-5-21-1801674531-299502267-725345543-1003SoftwareMicrosoftInternet ExplorerURLSearchHooks{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{EEE6C35D-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_USERSS-1-5-21-1801674531-299502267-725345543-1003SoftwareMicrosoftInternet ExplorerSearchScopes{searchTerms} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{searchTerms} not found.
C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultextensionsquickstores@quickstores.dechrome folder moved successfully.
C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultextensionsquickstores@quickstores.de folder moved successfully.
C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultextensionstorntv@torntv.com.xpi moved successfully.
C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultsearchpluginsbabylon1.xml moved successfully.
C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultsearchpluginsBrowserProtect.xml moved successfully.
C:Documents and SettingsUserrrrApplication DataMozillaFirefoxProfiles7lanbcba.defaultsearchpluginsWeb Search.xml moved successfully.
C:Program FilesMozilla [email protected] folder moved successfully.
C:Program FilesMozilla [email protected] folder moved successfully.
C:Program FilesMozilla FirefoxsearchpluginsWeb Search.xml moved successfully.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{BAE35237-8D73-44D0-905C-8A95EA1E7E69} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{BAE35237-8D73-44D0-905C-8A95EA1E7E69} deleted successfully.
Registry key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{e327b07a-0e11-4fd4-bef2-b2c5605b59c6} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{e327b07a-0e11-4fd4-bef2-b2c5605b59c6} deleted successfully.
C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbarDownTangoFTToolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{e327b07a-0e11-4fd4-bef2-b2c5605b59c6} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{e327b07a-0e11-4fd4-bef2-b2c5605b59c6} not found.
File C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbarDownTangoFTToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerToolbar{EECF410C-006C-4A05-AD13-6741A0814DBF} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{EECF410C-006C-4A05-AD13-6741A0814DBF} deleted successfully.
Registry value HKEY_USERSS-1-5-21-1801674531-299502267-725345543-1003SoftwareMicrosoftWindowsCurrentVersionRunMicrosoft Windows Manager deleted successfully.
C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exe moved successfully.
Registry value HKEY_USERSS-1-5-21-1801674531-299502267-725345543-1003SoftwareMicrosoftWindowsCurrentVersionRunVideo Performer63920.exe deleted successfully.
Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2{679e37ca-4eb4-11df-b1d4-001b220446fe} deleted successfully.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{679e37ca-4eb4-11df-b1d4-001b220446fe} not found.
File F:utcddeq.exe not found.
Registry key HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2{679e37ca-4eb4-11df-b1d4-001b220446fe} not found.
Registry key HKEY_LOCAL_MACHINESOFTWAREClassesCLSID{679e37ca-4eb4-11df-b1d4-001b220446fe} not found.
File F:utcddeq.exe not found.
cqtvf removed from NetSvcs value successfully!
C:Documents and SettingsUserrrrS-80-5421-8975-4765 folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSStart MenuProgramsProtected Search folder moved successfully.
C:Program FilesBrowseToSave folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}traking_settings folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}FirefoxExtensioncontent folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}FirefoxExtensioncomponents folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}FirefoxExtension folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8} folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect2.6.1040.25 folder moved successfully.
C:Documents and SettingsAll Users.WINDOWSApplication DataBrowserProtect folder moved successfully.
C:Program FilesTornTV.com folder moved successfully.
C:Documents and SettingsUserrrrStart MenuProgramsTornTV.com folder moved successfully.
C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbar64 folder moved successfully.
C:Documents and SettingsUserrrrApplication DataDownTangoFTToolbar folder moved successfully.
C:Documents and SettingsUserrrrLocal SettingsApplication DataDownTangoFTToolbar folder moved successfully.
C:Documents and SettingsUserrrrApplication DataExpressFiles folder moved successfully.
C:Documents and SettingsUserrrrApplication Datawinsvcns.sys moved successfully.
C:WINDOWSsystem32NvApps.xml moved successfully.
C:WINDOWStasksProtected Search.job moved successfully.
C:WINDOWStasksExpress FilesUpdate.job moved successfully.
ADS C:WINDOWSTemp:temp deleted successfully.
========== FILES ==========
FileFolder C:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exe not found.
C:Documents and SettingsUserrrrMy DocumentsDownloadsIMG0540250-JPG (1).scr moved successfully.
C:Documents and SettingsUserrrrMy DocumentsDownloadsIMG0540250-JPG (2).scr moved successfully.
C:Documents and SettingsUserrrrMy DocumentsDownloadsIMG0540250-JPG.scr moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile"EnableFirewall"|dword:00000001 /E : value set successfully!
Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListC:Program FilesExpressFilesexpressdl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListC:Program FilesExpressFilesExpressFiles.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListC:Documents and SettingsUserrrrS-80-5421-8975-4765winmgr.exe deleted successfully.
========== COMMANDS ==========
C:WINDOWSSystem32driversetcHosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Administrator
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 456 bytes
 
User: All Users
 
User: All Users.WINDOWS
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: NetworkService
->Temp folder emptied: 97488 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Office
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 51509694 bytes
->Java cache emptied: 12118723 bytes
->FireFox cache emptied: 16711781 bytes
->Google Chrome cache emptied: 6864640 bytes
->Flash cache emptied: 876 bytes
 
User: Userrrr
->Temp folder emptied: 3990884 bytes
->Temporary Internet Files folder emptied: 19263678 bytes
->Java cache emptied: 403042 bytes
->FireFox cache emptied: 134752079 bytes
->Google Chrome cache emptied: 55394699 bytes
->Flash cache emptied: 64637 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%System32 .tmp files removed: 2577 bytes
%systemroot%System32dllcache .tmp files removed: 0 bytes
%systemroot%System32drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 100647 bytes
%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 81390052 bytes
 
Total Files Cleaned = 365.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 03132013_131236
 
FilesFolders moved on Reboot...
 
PendingFileRenameOperations files...
 
Registry entries deleted on Reboot...
 
това е ОТЛ
  • Автор

когато отворя SALITY KILLER  къде да пейстна ...... отваря ми се черен прозорец и сканира ?

Не стартирайте SalityKiller директно...само го разархивирайте на десктопа.

После съм написал какво да направите....Start => Run => въведете CMD => и натиснете Enter

И като се появи черния прозорец копирайте командата и я поставете в прозореца:

"%userprofile%desktopsalitykiller.exe" -n -r -x -a -j -k -l c:report.txt

 

Публикувано изображение

 

След това натиснете Enter.

За започне да сканира по предварително зададени параметри...След края на провертака би трябвало да се създаде лог файл в C: с името raport.txt

Копирайте съдържанието му в следващия си коментар. :)

  • Автор

при мен веднага започва да сканира , пробвах да пиша и да поставя но тя си сканира :( , сега ще опитам пак .....

след като ми е на деска , с двоен клик - RUN - и започва да сканира не мога да пиша или поставя нищо

мога да ви дам достъп до компютъра да погледнете ?

  • Автор
16:28:52:890 6768 scanning threads ...
16:28:56:953 6768
16:28:56:953 6768 scanning processes ...
16:28:56:968 6768
16:28:56:968 6768 removing autorun.inf files ...
16:28:57:000 6768
16:28:57:000 6768 Restoring show hidden and system files
16:28:57:000 6512
Monitoring thread started
16:28:57:015 6768
16:28:57:015 6768 Disabling autorun on all drive types
16:28:57:031 6768
16:28:57:031 6768 restoring SafeBoot registry node
16:28:57:031 6768 Restoring safe/network boot registry branches for windows XP
16:28:57:390 6768
16:28:57:390 6768 fixing registry ...
16:28:57:390 6768 SalityRegCure: Restoring general registry keys
16:28:57:406 6768 SalityRegCure: Fixing system.ini
16:28:57:406 6768
16:28:57:406 6768 scanning drives ...
16:28:57:406 6768 scanning C: ...
16:34:07:515 6768 C:Program FilesAviraAntiVir DesktopApnStub.exe infected Virus.Win32.Sality.aa ...16:34:07:515 6768 not cured
16:34:07:593 6768 C:Program FilesAviraAntiVir DesktopApnToolbarInstaller.exe infected Virus.Win32.Sality.aa ...16:34:07:593 6768 not cured
16:34:07:687 6768 C:Program FilesAviraAntiVir Desktopavcenter.exe infected Virus.Win32.Sality.aa ...16:34:07:687 6768 not cured
16:34:07:781 6768 C:Program FilesAviraAntiVir Desktopavconfig.exe infected Virus.Win32.Sality.aa ...16:34:07:781 6768 not cured
16:34:08:015 6768 C:Program FilesAviraAntiVir Desktopavguard.exe infected Virus.Win32.Sality.aa ...16:34:08:015 6768 not cured
16:34:08:062 6768 C:Program FilesAviraAntiVir Desktopavhlp.exe infected Virus.Win32.Sality.aa ...16:34:08:062 6768 not cured
16:34:08:265 6768 C:Program FilesAviraAntiVir Desktopavrestart.exe infected Virus.Win32.Sality.aa ...16:34:08:265 6768 not cured
16:34:08:375 6768 C:Program FilesAviraAntiVir Desktopavscan.exe infected Virus.Win32.Sality.aa ...16:34:08:375 6768 not cured
16:34:08:468 6768 C:Program FilesAviraAntiVir Desktopavshadow.exe infected Virus.Win32.Sality.aa ...16:34:08:468 6768 not cured
16:34:08:546 6768 C:Program FilesAviraAntiVir Desktopavupgsvc.exe infected Virus.Win32.Sality.aa ...16:34:08:546 6768 not cured
16:34:08:609 6768 C:Program FilesAviraAntiVir Desktopavwebgrd.exe infected Virus.Win32.Sality.aa ...16:34:08:609 6768 not cured
16:39:47:312 6768 scanning D: ...
16:39:51:218 6768 D:Program FilesWindows NTdialer.exe infected Virus.Win32.Sality.aa ...16:39:51:218 6768 not cured
16:39:52:593 6768
16:39:52:593 6512
Monitoring thread stopped
16:39:52:593 6768
completed
16:39:52:593 6768 Infected files: 12
16:39:52:593 6768 Infected processes: 0
16:39:52:593 6768 Infected threads: 0
16:39:52:593 6768 Cured files: 0
16:39:52:593 6768 Will be cured on reboot: 0
16:39:52:593 6768 Executed registry scripts: 5

Супер...деинсталирайте Avira от Control Panel-a.

 

След това:

 

  • [*]Стартирайте файла
Публикувано изображение с двукратен клик на мишката. [*]Под Публикувано изображение с Copy/ Paste въведете изцяло следната текстова информация (само това, което е поставено в карето):

 

:filesC:Program FilesAviraAntiVir DesktopApnStub.exeC:Program FilesAviraAntiVir DesktopApnToolbarInstaller.exeC:Program FilesAviraAntiVir Desktopavcenter.exeC:Program FilesAviraAntiVir Desktopavconfig.exeC:Program FilesAviraAntiVir Desktopavguard.exeC:Program FilesAviraAntiVir Desktopavhlp.exeC:Program FilesAviraAntiVir Desktopavrestart.exeC:Program FilesAviraAntiVir Desktopavscan.exeC:Program FilesAviraAntiVir Desktopavshadow.exeC:Program FilesAviraAntiVir Desktopavupgsvc.exeC:Program FilesAviraAntiVir Desktopavwebgrd.exeD:Program FilesWindows NTdialer.exe:commands[resethosts][emptytemp]

 

  • [*]След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в
червено: Run Fix [*]Windows ще се рестартира и ще се създаде лог файл - OTL fix log. Публикувайте съдържанието му с Copy/Paste в следващия си коментар.

 

После:

 

 

1. Изтеглете ComboFix от BleepingComputer
и го запазете (бутон Save -> Save as) ComboFix на вашия десктоп:
Публикувано изображение
След приключване на изтеглянето на ComboFix, иконката на програмата би трябвало да изглежда така:
Публикувано изображение

2. Затворете всички работещи приложения, отворени прозорци и програми работещи във фонов режим. Спрете временно защитата в реално време на антивирусната програма и на другите програми за сигурност, ако има такива.


3. Стартирайте с двоен клик Combofix.exe. Изберете YES, за да се съгласите с условията за използване на програмата. Важно: По време на работата на ComboFix не бива да се движи мишката и да се натискат клавиши от клавиатурата. Просто търпеливо оставете ComboFix да си свърши работата, без да използвате компютъра за други цели.


4. ComboFix ще провери дали Windows Recovery Console e инсталиранa.


*Ако Windows Recovery Console не е инсталирана, ще е необходимо да използвате YES за инсталация на Windows Recovery Console
*Ако Windows Recovery Console е инсталирана, ComboFix ще продължи работата си.
Публикувано изображение


Забележка: Необходимо е да сте свързани към Интернет за да може Windows Recovery Console да се изтегли.


След инсталация на Windows Recovery Console потвърдете с YES, за да продължите напред. Снимка:
Публикувано изображение


5. ComboFix ще спре временно Интернет връзката, но след като приключи работата на програмата тази връзка ще бъде възстановена автоматично. ComboFix ще сканира за проблеми и за заразени файлове, като това може да отнеме известно време. Моля да бъдете търпеливи. Ако има проблем с Интернет връзката след приключване на работата на ComboFix, моля да прочетете това: Manually restoring the Internet connection section.


6. Когато работата на ComboFix приключи, ще се появи текстов документ (log) в Notepad:
Публикувано изображение

Копирайте с (Copy) и поставете с (Paste) съдържанието на лога в следващия си коментар.

 

 

 

След това отворете файла C:Windowssystem.ini с notepad и премахнете само следните два реда от него:
 

Цитат

[MCIDRV_VER]
DEVICEMB=1414818764017


Затворете файла и запазете промените.
Пишете как е положението после.

  • Автор

как да я деинсталирам , в контрол панел с десен бутон не става ?

  • Автор

стана , просто се шашнах вече , благодаря ти много , утре след обяд  ще довърша и ще постна :) после ще черпя много ;)

  • Автор
All processes killed
========== FILES ==========
FileFolder C:Program FilesAviraAntiVir DesktopApnStub.exe not found.
FileFolder C:Program FilesAviraAntiVir DesktopApnToolbarInstaller.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavcenter.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavconfig.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavguard.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavhlp.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavrestart.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavscan.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavshadow.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavupgsvc.exe not found.
FileFolder C:Program FilesAviraAntiVir Desktopavwebgrd.exe not found.
D:Program FilesWindows NTdialer.exe moved successfully.
========== COMMANDS ==========
C:WINDOWSSystem32driversetcHosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: Administrator
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: All Users.WINDOWS
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: NetworkService.NT AUTHORITY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Office
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Userrrr
->Temp folder emptied: 1202228 bytes
->Temporary Internet Files folder emptied: 33261 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 5157121 bytes
->Google Chrome cache emptied: 260404143 bytes
->Flash cache emptied: 1772 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%System32 .tmp files removed: 0 bytes
%systemroot%System32dllcache .tmp files removed: 0 bytes
%systemroot%System32drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3713 bytes
%systemroot%system32configsystemprofileLocal SettingsTemp folder emptied: 0 bytes
%systemroot%system32configsystemprofileLocal SettingsTemporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 505402 bytes
 
Total Files Cleaned = 255.00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 03142013_153940
 
FilesFolders moved on Reboot...
 
PendingFileRenameOperations files...
 
Registry entries deleted on Reboot...
 
ТОВА ОТ  OTL

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Назад

Разглеждащи това в момента 0

  • Няма регистрирани потребители разглеждащи тази страница.

Дарение

  • Подкрепи съществуването на форума - направи дарение
    32%
    Дарени 315 € от нужните 1 000 €

Бюлетин

Получавайте известие, когато има важна промяна или новина свързана с форума.
Абонирайте се

Профил

Навигация

Търсене

Търсене

Конфигуриране на push известия в браузъра
Chrome (Android)
  1. Докоснете иконата на катинар до адресната лента.
  2. Докоснете Разрешения → Известия.
  3. Променете предпочитанията си.
Chrome (Desktop)
  1. Кликнете върху иконата на катинар в адресната лента.
  2. Изберете Настройки на сайта.
  3. Намерете Известия и коригирайте предпочитанията си.