процесс services.exe переодически грузит систему !

[timon39]

процесс services.exe переодически грузит систему !
то на 40% то на 50% примерно каждую минуту ато и чаще.. в обще играть в игры невозможно постоянные зависания..
сразу попрошу обьеснять что делать человеческим языком и по шагово, ато я в компе шарю немного а вы программисты начинаете говорить такие вещи о которых я впервые слышу.
Вложение 307753

Вложение 307754

Вложение 307755

[polword]

1.Профиксите в HijackThis

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://yandex.ru/yandsearch?clid=123046&text=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = play4free.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://yandex.ru/yandsearch?clid=123044
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = play4free.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smaxi.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smaxi.net
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - (no file)
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)

2. Выполните скрипт в AVZ

procedure WhatService(AServiceName : string);
  var
   dllname, servicekey : string;
  begin
   servicekey := 'SYSTEM\CurrentControlSet\Services\'+AServiceName;
   RegKeyResetSecurity( 'HKLM', servicekey);
   RegKeyResetSecurity( 'HKLM', servicekey+'\Parameters');
   AddToLog('Description: '+RegKeyStrParamRead( 'HKLM', servicekey, 'Description'));
   AddToLog('DisplayName: '+RegKeyStrParamRead( 'HKLM', servicekey, 'DisplayName'));
   AddToLog('ImagePath: '+RegKeyStrParamRead( 'HKLM', servicekey, 'ImagePath'));
   dllname := RegKeyStrParamRead( 'HKLM', servicekey+'\Parameters', 'ServiceDll');
   AddToLog('ServiceDll: '+dllname);
   QuarantineFile(dllname,'');
  end;
 begin
  SearchRootkit(true, true);
  SetAVZGuardStatus(True);
  WhatService('hdsaqnua');
 WhatService('urlrfqmyd');
QuarantineFile('E:\WINDOWS\system32\inetres.dll','');
 QuarantineFile('E:\autorun.inf','');
 QuarantineFile('E:\WINDOWS\system32\d3dgearload.dll','');
 QuarantineFile('E:\WINDOWS\System32\Drivers\Winah52.sys','');
 QuarantineFile('E:\WINDOWS\System32\Drivers\Winah84.sys','');
 QuarantineFile('E:\WINDOWS\System32\Drivers\Winhn28.sys','');
 QuarantineFile('E:\WINDOWS\System32\Drivers\Winkq41.sys','');
 QuarantineFile('E:\WINDOWS\System32\Drivers\Winnv28.sys','');
 DeleteService('Winhn28');
 DeleteService('Winah84');
 BC_DeleteSvc('BrowserHTTPFilter');
 BC_DeleteSvc('BrowserHTTPFilteraspnet_state');
 BC_DeleteSvc('CiSvcose');
 BC_DeleteSvc('ClipSrvNetman');
 BC_DeleteSvc('ClipSrvNetmanERSvc');
 BC_DeleteSvc('ClipSrvNetmanERSvcBrowserHTTPFilter');
 BC_DeleteSvc('ClipSrvNetmansrserviceIrmon');
 BC_DeleteSvc('CryptSvcVSSMSDTC');
 BC_DeleteSvc('CryptSvcVSSMSDTCSENS');
 BC_DeleteSvc('DcomLaunchPlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNtLmSsp');
 BC_DeleteSvc('DcomLaunchpr2ajzsb');
 BC_DeleteSvc('DcomLaunchpr2ajzsbUPS');
 BC_DeleteSvc('DnscacheNtLmSsp');
 BC_DeleteSvc('FastUserSwitchingCompatibilityupnphost');
 BC_DeleteSvc('FastUserSwitchingCompatibilityupnphostNVSvcUMWdfTermServicedmserverSpooler');
 BC_DeleteSvc('gusvcMessengerdmadmin');
 BC_DeleteSvc('helpsvcTrkWks');
 BC_DeleteSvc('HTTPFilterxmlprovmnmsrvcRpcSs');
 BC_DeleteSvc('ImapiServiceAlerter');
 BC_DeleteSvc('LmHostsPlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNetDDEMSIServer');
 BC_DeleteSvc('Messengerdmadmin');
 BC_DeleteSvc('MessengerWebClient');
 BC_DeleteSvc('mnmsrvcRpcSs');
 BC_DeleteSvc('NetDDEdmadmin');
 BC_DeleteSvc('NetDDEdmadminMSIServer');
 BC_DeleteSvc('NetDDEdmadminxmlprovwuauserv');
 BC_DeleteSvc('NetDDEMSIServerMSDTC');
 BC_DeleteSvc('NlaMSIServer');
 BC_DeleteSvc('NtmsSvcSCardSvr');
 BC_DeleteSvc('NVSvcUMWdf');
 BC_DeleteSvc('NVSvcUMWdfTermService');
 BC_DeleteSvc('NVSvcUMWdfTermServicedmserver');
 BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibility');
 BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilityCiSvc');
 BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNtLmSsp');
 BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilitySCardSvrNlaMSIServer');
 BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilitySCardSvrNlaMSIServeridsvc');
 BC_DeleteSvc('PlugPlaywinmgmt');
 BC_DeleteSvc('ProtectedStorageNetDDEdmadmin');
 BC_DeleteSvc('ProtectedStorageSysmonLog');
 BC_DeleteSvc('RasAutoLmHosts');
 BC_DeleteSvc('RDSessMgrpr2ajzsb');
 BC_DeleteSvc('RDSessMgrpr2ajzsbSharedAccess');
 BC_DeleteSvc('RDSessMgrpr2ajzsbSharedAccessAppMgmtPlugPlayupnphostFastUserSwitchingCompatibilityCiSvc');
 BC_DeleteSvc('RemoteAccessMessengerdmadmin');
 BC_DeleteSvc('RpcSsAVP');
 BC_DeleteSvc('RSVPBrowser');
 BC_DeleteSvc('RSVPBrowserDcomLaunchpr2ajzsb');
 BC_DeleteSvc('RSVPSysmonLog');
 BC_DeleteSvc('RSVPUPSNetDDEdsdm');
 BC_DeleteSvc('srserviceIrmon');
 BC_DeleteSvc('SysmonLogMessengerWebClient');
 BC_DeleteSvc('TlntSvrSSDPSRV');
 BC_DeleteSvc('upnphostFastUserSwitchingCompatibility');
 BC_DeleteSvc('UPSNetDDEdsdm');
 BC_DeleteSvc('WmdmPmSNImapiService');
 BC_DeleteSvc('wuauservTlntSvr');
 BC_DeleteSvc('WZCSVCgupdate1c8fb5e8314128c');
 BC_DeleteSvc('xmlprovmnmsrvcRpcSs');
 BC_DeleteSvc('xmlprovose');
 BC_DeleteSvc('xmlprovVSS');
 BC_DeleteSvc('xmlprovwuauserv');
 DeleteFile('E:\WINDOWS\System32\Drivers\Winnv28.sys');
 DeleteFile('E:\WINDOWS\System32\Drivers\Winkq41.sys');
 DeleteFile('E:\WINDOWS\System32\Drivers\Winhn28.sys');
 DeleteFile('E:\WINDOWS\System32\Drivers\Winah84.sys');
 DeleteFile('E:\WINDOWS\System32\Drivers\Winah52.sys');
 DeleteFile('E:\autorun.inf');
  BC_ImportAll;
  ExecuteSysClean;
  ExecuteWizard('TSW', 2, 2, true);
  ExecuteWizard('SCU', 2, 2, true);
  BC_Activate;
  SaveLog(GetAVZDirectory+'urlrfqmyd.log');
  RebootWindows(true);
 end.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы
- Сделайте повторные логи по правилам п.2 и 3 раздела Диагностика.(virusinfo_syscheck.zip;hijackthis.log)
- файл urlrfqmyd.log прикрепите к сообщению

[timon39]

омг. из всего что мне делать я не понял ничего)

Добавлено через 25 секунд

ща попробую разобраться)

[timon39]

вроде сделал как вы сказали. а прежде чем делать новые логи, старые обязательно удалять или нет? просто я не удалял.
Вложение 307774

Вложение 307775

[polword]

- файл urlrfqmyd.log прикрепите к сообщению

еще вот этот файл прикрепите

[timon39]

Вложение 307776

[thyrex]

Выполните скрипт в AVZ

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('р%Ђ|x  srv','');
 QuarantineFile('E:\WINDOWS\system32\pxeqog.dll','');
 DeleteFile('E:\WINDOWS\system32\d3dgearload.dll');
 DeleteFile('E:\WINDOWS\system32\pxeqog.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\hdsaqnua\Parameters','ServiceDll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\urlrfqmyd\Parameters','ServiceDll');
 DeleteFile('р%Ђ|x  srv');
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('SCardSvrNlaMSIServer');
 BC_DeleteSvc('RDSessMgrpr2ajzsbSharedAccessAppMgmt');
 BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNetDDEMSIServer');
 BC_DeleteSvc('NVSvcUMWdfTermServicedmserverSpooler');
 BC_DeleteSvc('NetDDEMSIServerMSDTCBrowserHTTPFilter');
 BC_DeleteSvc('NetDDEMSIServer');
 BC_DeleteSvc('LmHostsPlugPlaywinmgmt');
 BC_DeleteSvc('CryptSvcVSS');
BC_Activate;
RebootWindows(true);
end.

Компьютер перезагрузится.

Пришлите карантин согласно Приложения 3 правил по красной ссылке Прислать запрошенный карантин вверху темы

Сделайте новые логи

[timon39]

Вложение 307823

Вложение 307824

Вложение 307825

[thyrex]

Внимание! Официальная поддержка (и выпуск обновлений) для Windows XP SP2 прекращена

Установите SP3 (может потребоваться активация) + все новые обновления для Windows

Что с проблемой?

[timon39]

все сделал. проблемма осталась(

[thyrex]

Сделайте лог полного сканирования МВАМ

[timon39]

Вложение 307962

[timon39]

а удалять обьекты которые нашел malwarebytes надо?

[thyrex]

Удалите в МВАМ только указанные ниже записи

Заражённые ключи в реестре:
HKEY_CLASSES_ROOT\AppID\{B0ED4726-5BC8-4E22-A7A8-3074A73CE64E} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1408E208-2AC1-42D3-9F10-78A5B36E05AC} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6D125299-C2A9-4DBC-BEC3-6F7124E39A41} (Adware.FieryAds) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6D125299-C2A9-4DBC-BEC3-6F7124E39A41} (Adware.FieryAds) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86} (Adware.MyCentria) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86} (Adware.MyCentria) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbAx (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbAx.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButton (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButton.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl.1 (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyCentria (Adware.MyCentria) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\XP_Antispyware (Rogue.XPAntiSpyware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Zumie (PUP.Zwangi) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_XMLPROVVSS (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZUMIESEARCH_SERVICE (PUP.Zwangi) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\XPROTECTOR (Backdoor.Trojan) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartShopper (Adware.SmartShopper) -> No action taken.

Заражённые параметры в реестре:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Value: scui.cpl -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Value: wscui.cpl -> No action taken.

Объекты реестра заражены:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CEE51FDB-E08E-4623-81DB-8E85F6E82816}\DhcpNameServer (Trojan.DNSChanger) -> Bad: (85.255.116.165,85.255.112.220) Good: () -> No action taken.

Заражённые папки:
e:\documents and settings\Main\application data\FieryAds (Adware.FieryAds) -> No action taken.
e:\documents and settings\Main\application data\smartshopper (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> No action taken.
e:\program files\FieryAds (Adware.Adware.FearAds) -> No action taken.
e:\program files\mycentria (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\Firefox (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\InfoBar (Adware.MyCentria) -> No action taken.
e:\program files\smartshopper (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> No action taken.
e:\program files\VVSN (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1 (Adware.WhenU) -> No action taken.
e:\program files\xp_antispyware (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\data (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\microsoft.vc80.crt (Rogue.XPAntiSpyware) -> No action taken.
e:\documents and settings\Main\application data\winxrar (Trojan.Agent) -> No action taken.
e:\program files\Zumie (PUP.Zwangi) -> No action taken.

Заражённые файлы:
e:\documents and settings\Main\application data\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\xp_antispyware\htmlayout.dll (Rogue.AntiVirusPro) -> No action taken.
e:\documents and settings\Main\application data\fieryads.dat (Adware.FieryAds) -> No action taken.
e:\uninstall.exe (Trojan.Agent) -> No action taken.
e:\WINDOWS\system32\phcpn9j0ev6t.bmp (Trojan.FakeAlert) -> No action taken.
e:\WINDOWS\system32\delself.bat (Malware.Trace) -> No action taken.
e:\WINDOWS\system32\drivers\Oreans.sys (Backdoor.Trojan) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report\send_storage.xml (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\res1\whitelist.dbs (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Uninst.exe (Adware.SmartShopper) -> No action taken.
e:\program files\VVSN\vvsn.cfg (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1\vsn.cab (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1\vsn.cfg (Adware.WhenU) -> No action taken.
e:\program files\xp_antispyware\comp.dat (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\pthreadvc2.dll (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\xp_antispyware.cfg (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\data\daily.cvd (Rogue.XPAntiSpyware) -> No action taken.
e:\documents and settings\Main\application data\winxrar\after.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\aview (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\dir.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\dot.gif (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\htmlayout.dll (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\key (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\logo.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\logo2.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\logo_____.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\myriadwebpro-condensed.ttf (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\rules.css (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-h-scroll-next.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-h-scroll-prev.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-scroll-back.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-scroll-base.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-scroll-slider.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-v-scroll-next.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-v-scroll-prev.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\scroll.css (Trojan.Agent) -> No action taken.

[timon39]

в общем удалил все. а куда лог сохранился не знаю..было написанно мол кудато он сохранился но в папке с рограммой его нет(

[ARMA9000]

Новый отчет сделайте.

[timon39]

Вложение 308262

[thyrex]

Удалите в МВАМ только указанные строки

Заражённые папки:
e:\documents and settings\Main\application data\FieryAds (Adware.FieryAds) -> No action taken.
e:\documents and settings\Main\application data\smartshopper (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> No action taken.
e:\program files\FieryAds (Adware.Adware.FearAds) -> No action taken.
e:\program files\mycentria (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\Firefox (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\InfoBar (Adware.MyCentria) -> No action taken.
e:\program files\smartshopper (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> No action taken.
e:\program files\VVSN (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1 (Adware.WhenU) -> No action taken.
e:\program files\xp_antispyware (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\data (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\microsoft.vc80.crt (Rogue.XPAntiSpyware) -> No action taken.
e:\documents and settings\Main\application data\winxrar (Trojan.Agent) -> No action taken.
e:\program files\Zumie (PUP.Zwangi) -> No action taken.

Заражённые файлы:
e:\documents and settings\Main\application data\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\alcohol soft\alcohol 120\Plugins\Helper\AlSrvN.exe (Backdoor.Agent) -> No action taken.
e:\program files\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\xp_antispyware\htmlayout.dll (Rogue.AntiVirusPro) -> No action taken.
e:\documents and settings\Main\application data\fieryads.dat (Adware.FieryAds) -> No action taken.
e:\uninstall.exe (Trojan.Agent) -> No action taken.
e:\WINDOWS\system32\phcpn9j0ev6t.bmp (Trojan.FakeAlert) -> No action taken.
e:\WINDOWS\system32\delself.bat (Malware.Trace) -> No action taken.

[timon39]

Вложение 308290

[thyrex]

Что с проблемой?