netch.exe не удаляется

Отключите антивирус и интернет!

[URL="http://mail.ustc.edu.cn/~jfpan/download/IceSword122en.zip"]Скачать[/URL],меню,File,появится аналог проводника,найти:WinNt64.dll,WinCtrl32.dll,Oty51.sys,Sye27.sys,правая кнопка мыши Force Delete на запрос о перезагрузке ответьте положительно.

[URL="http://virusinfo.info/showthread.php?t=4491"]Пофиксить[/URL]

[CODE]O4 - HKLM\..\Run: [runservices] C:\WINDOWS\services.exe
O4 - HKLM\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKLM\..\Run: [winlogon] C:\Documents and Settings\jana\svchost.exe
O4 - HKCU\..\Run: [[system]] C:\WINDOWS\system32\drivers\services.exe
O4 - HKCU\..\Run: [winlogon] C:\Documents and Settings\jana\svchost.exe
O4 - Startup: userinit.exe
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
O20 - Winlogon Notify: WinNt64 - C:\WINDOWS\SYSTEM32\WinNt64.dll[/CODE]

[URL="http://virusinfo.info/showthread.php?t=7239"]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".
[/URL]

[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\windows\system32\drivers\services.exe');
TerminateProcessByName('c:\windows\services.exe');
QuarantineFile('C:\WINDOWS\system32\vedxga1me4t1.exe','');
QuarantineFile('C:\WINDOWS\system32\maxpaynow1.exe','');
QuarantineFile('WinNt64.dll','');
QuarantineFile('WinCtrl32.dll','');
QuarantineFile('C:\WINDOWS\system32\userinit.exe','');
QuarantineFile('C:\WINDOWS\msupdater.exe','');
QuarantineFile('C:\WINDOWS\TEMP\csrssc.exe','');
QuarantineFile('C:\Documents and Settings\jana\svchost.exe','');
QuarantineFile('C:\Documents and Settings\jana\Start Menu\Programs\Startup\userinit.exe','');
QuarantineFile('C:\Documents and Settings\LocalService\svchost.exe','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winua62.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Ubg27.sys','');
QuarantineFile('C:\Documents and Settings\jana\ie_updates3r.exe','');
QuarantineFile('C:\WINDOWS\system32\Drivers\Sye27.sys','');
QuarantineFile('C:\WINDOWS\system32\Drivers\Oty51.sys','');
QuarantineFile('C:\WINDOWS\system32\WinNt64.dll','');
QuarantineFile('c:\windows\system32\drivers\services.exe','');
QuarantineFile('c:\windows\services.exe','');
DeleteService('Sye27');
DeleteService('Oty51');
DeleteService('Ubg27');
DeleteService('Winua62');
DeleteService('Google Online Services');
DeleteFile('c:\windows\services.exe');
DeleteFile('c:\windows\system32\drivers\services.exe');
DeleteFile('C:\WINDOWS\system32\WinNt64.dll');
DeleteFile('C:\WINDOWS\system32\Drivers\Oty51.sys');
DeleteFile('C:\WINDOWS\system32\Drivers\Sye27.sys');
DeleteFile(' ');
DeleteFile('C:\Documents and Settings\jana\ie_updates3r.exe');
DeleteFile('C:\WINDOWS\System32\Drivers\Ubg27.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winua62.sys');
DeleteFile('C:\Documents and Settings\LocalService\svchost.exe');
DeleteFile('C:\Documents and Settings\jana\Start Menu\Programs\Startup\userinit.exe');
DeleteFile('C:\Documents and Settings\jana\svchost.exe');
DeleteFile('C:\WINDOWS\TEMP\csrssc.exe');
DeleteFile('C:\WINDOWS\msupdater.exe');
DeleteFile('WinCtrl32.dll');
DeleteFile('WinNt64.dll');
DeleteFile('C:\WINDOWS\system32\maxpaynow1.exe');
DeleteFile('C:\WINDOWS\system32\vedxga1me4t1.exe')
BC_ImportALL;
ExecuteSysClean;
BC_DeleteSvc('Sye27 ');
BC_DeleteSvc('Oty51 ');
BC_DeleteSvc('Ubg27 ');
BC_DeleteSvc('Winua62 ');
BC_DeleteSvc('Google Online Services ');
BC_Activate;
ExecuteRepair(1 );
RebootWindows(true);
end.
[/CODE]

Пришлите карантин по правилам и повторите логи.