процесс services.exe переодически грузит систему !

процесс services.exe переодически грузит систему !
то на 40% то на 50% примерно каждую минуту ато и чаще.. в обще играть в игры невозможно постоянные зависания..
сразу попрошу обьеснять что делать человеческим языком и по шагово, ато я в компе шарю немного а вы программисты начинаете говорить такие вещи о которых я впервые слышу. :)
[ATTACH]307753[/ATTACH]

[ATTACH]307754[/ATTACH]

[ATTACH]307755[/ATTACH]

1.[URL="http://virusinfo.info/showthread.php?t=4491"]Профиксите[/URL] в HijackThis
[CODE]
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://yandex.ru/yandsearch?clid=123046&text=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = play4free.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://yandex.ru/yandsearch?clid=123044
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = play4free.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.smaxi.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.smaxi.net
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {8DAE90AD-4583-4977-9DD4-4360F7A45C74} - (no file)
O20 - Winlogon Notify: WinCtrl32 - WinCtrl32.dll (file missing)
[/CODE]
2. [URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/URL]
[CODE]
procedure WhatService(AServiceName : string);
var
dllname, servicekey : string;
begin
servicekey := 'SYSTEM\CurrentControlSet\Services\'+AServiceName;
RegKeyResetSecurity( 'HKLM', servicekey);
RegKeyResetSecurity( 'HKLM', servicekey+'\Parameters');
AddToLog('Description: '+RegKeyStrParamRead( 'HKLM', servicekey, 'Description'));
AddToLog('DisplayName: '+RegKeyStrParamRead( 'HKLM', servicekey, 'DisplayName'));
AddToLog('ImagePath: '+RegKeyStrParamRead( 'HKLM', servicekey, 'ImagePath'));
dllname := RegKeyStrParamRead( 'HKLM', servicekey+'\Parameters', 'ServiceDll');
AddToLog('ServiceDll: '+dllname);
QuarantineFile(dllname,'');
end;
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
WhatService('hdsaqnua');
WhatService('urlrfqmyd');
QuarantineFile('E:\WINDOWS\system32\inetres.dll','');
QuarantineFile('E:\autorun.inf','');
QuarantineFile('E:\WINDOWS\system32\d3dgearload.dll','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Winah52.sys','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Winah84.sys','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Winhn28.sys','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Winkq41.sys','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Winnv28.sys','');
DeleteService('Winhn28');
DeleteService('Winah84');
BC_DeleteSvc('BrowserHTTPFilter');
BC_DeleteSvc('BrowserHTTPFilteraspnet_state');
BC_DeleteSvc('CiSvcose');
BC_DeleteSvc('ClipSrvNetman');
BC_DeleteSvc('ClipSrvNetmanERSvc');
BC_DeleteSvc('ClipSrvNetmanERSvcBrowserHTTPFilter');
BC_DeleteSvc('ClipSrvNetmansrserviceIrmon');
BC_DeleteSvc('CryptSvcVSSMSDTC');
BC_DeleteSvc('CryptSvcVSSMSDTCSENS');
BC_DeleteSvc('DcomLaunchPlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNtLmSsp');
BC_DeleteSvc('DcomLaunchpr2ajzsb');
BC_DeleteSvc('DcomLaunchpr2ajzsbUPS');
BC_DeleteSvc('DnscacheNtLmSsp');
BC_DeleteSvc('FastUserSwitchingCompatibilityupnphost');
BC_DeleteSvc('FastUserSwitchingCompatibilityupnphostNVSvcUMWdfTermServicedmserverSpooler');
BC_DeleteSvc('gusvcMessengerdmadmin');
BC_DeleteSvc('helpsvcTrkWks');
BC_DeleteSvc('HTTPFilterxmlprovmnmsrvcRpcSs');
BC_DeleteSvc('ImapiServiceAlerter');
BC_DeleteSvc('LmHostsPlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNetDDEMSIServer');
BC_DeleteSvc('Messengerdmadmin');
BC_DeleteSvc('MessengerWebClient');
BC_DeleteSvc('mnmsrvcRpcSs');
BC_DeleteSvc('NetDDEdmadmin');
BC_DeleteSvc('NetDDEdmadminMSIServer');
BC_DeleteSvc('NetDDEdmadminxmlprovwuauserv');
BC_DeleteSvc('NetDDEMSIServerMSDTC');
BC_DeleteSvc('NlaMSIServer');
BC_DeleteSvc('NtmsSvcSCardSvr');
BC_DeleteSvc('NVSvcUMWdf');
BC_DeleteSvc('NVSvcUMWdfTermService');
BC_DeleteSvc('NVSvcUMWdfTermServicedmserver');
BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibility');
BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilityCiSvc');
BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNtLmSsp');
BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilitySCardSvrNlaMSIServer');
BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilitySCardSvrNlaMSIServeridsvc');
BC_DeleteSvc('PlugPlaywinmgmt');
BC_DeleteSvc('ProtectedStorageNetDDEdmadmin');
BC_DeleteSvc('ProtectedStorageSysmonLog');
BC_DeleteSvc('RasAutoLmHosts');
BC_DeleteSvc('RDSessMgrpr2ajzsb');
BC_DeleteSvc('RDSessMgrpr2ajzsbSharedAccess');
BC_DeleteSvc('RDSessMgrpr2ajzsbSharedAccessAppMgmtPlugPlayupnphostFastUserSwitchingCompatibilityCiSvc');
BC_DeleteSvc('RemoteAccessMessengerdmadmin');
BC_DeleteSvc('RpcSsAVP');
BC_DeleteSvc('RSVPBrowser');
BC_DeleteSvc('RSVPBrowserDcomLaunchpr2ajzsb');
BC_DeleteSvc('RSVPSysmonLog');
BC_DeleteSvc('RSVPUPSNetDDEdsdm');
BC_DeleteSvc('srserviceIrmon');
BC_DeleteSvc('SysmonLogMessengerWebClient');
BC_DeleteSvc('TlntSvrSSDPSRV');
BC_DeleteSvc('upnphostFastUserSwitchingCompatibility');
BC_DeleteSvc('UPSNetDDEdsdm');
BC_DeleteSvc('WmdmPmSNImapiService');
BC_DeleteSvc('wuauservTlntSvr');
BC_DeleteSvc('WZCSVCgupdate1c8fb5e8314128c');
BC_DeleteSvc('xmlprovmnmsrvcRpcSs');
BC_DeleteSvc('xmlprovose');
BC_DeleteSvc('xmlprovVSS');
BC_DeleteSvc('xmlprovwuauserv');
DeleteFile('E:\WINDOWS\System32\Drivers\Winnv28.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Winkq41.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Winhn28.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Winah84.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Winah52.sys');
DeleteFile('E:\autorun.inf');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
SaveLog(GetAVZDirectory+'urlrfqmyd.log');
RebootWindows(true);
end.
[/CODE]

После перезагрузки:
- выполните такой скрипт
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
- Файл [B][COLOR="Red"]quarantine.zip[/COLOR][/B] из папки AVZ загрузите по ссылке [B][COLOR="Red"]Прислать запрошенный карантин[/COLOR][/B] вверху темы
- Сделайте повторные логи по [URL="http://virusinfo.info/pravila.html"]правилам[/URL] п.2 и 3 раздела Диагностика.([COLOR="Blue"]virusinfo_syscheck.zip;hijackthis.log[/COLOR])
- файл [COLOR="Blue"][B]urlrfqmyd.log[/B][/COLOR] прикрепите к сообщению

омг. из всего что мне делать я не понял ничего)

[size="1"][color="#666686"][B][I]Добавлено через 25 секунд[/I][/B][/color][/size]

ща попробую разобраться)

вроде сделал как вы сказали. а прежде чем делать новые логи, старые обязательно удалять или нет? просто я не удалял.
[ATTACH]307774[/ATTACH]

[ATTACH]307775[/ATTACH]

[QUOTE=polword;782780]
- файл [COLOR=Blue][B]urlrfqmyd.log[/B][/COLOR] прикрепите к сообщению[/QUOTE]
еще вот этот файл прикрепите

[ATTACH]307776[/ATTACH]

Выполните скрипт в AVZ
[code]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('р%Ђ|x srv','');
QuarantineFile('E:\WINDOWS\system32\pxeqog.dll','');
DeleteFile('E:\WINDOWS\system32\d3dgearload.dll');
DeleteFile('E:\WINDOWS\system32\pxeqog.dll');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\hdsaqnua\Parameters','ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\urlrfqmyd\Parameters','ServiceDll');
DeleteFile('р%Ђ|x srv');
BC_ImportAll;
ExecuteSysClean;
BC_DeleteSvc('SCardSvrNlaMSIServer');
BC_DeleteSvc('RDSessMgrpr2ajzsbSharedAccessAppMgmt');
BC_DeleteSvc('PlugPlayupnphostFastUserSwitchingCompatibilityCiSvcNetDDEMSIServer');
BC_DeleteSvc('NVSvcUMWdfTermServicedmserverSpooler');
BC_DeleteSvc('NetDDEMSIServerMSDTCBrowserHTTPFilter');
BC_DeleteSvc('NetDDEMSIServer');
BC_DeleteSvc('LmHostsPlugPlaywinmgmt');
BC_DeleteSvc('CryptSvcVSS');
BC_Activate;
RebootWindows(true);
end. [/code]Компьютер перезагрузится.

Пришлите карантин согласно [B]Приложения 3[/B] правил по красной ссылке [COLOR="Red"][U][B]Прислать запрошенный карантин[/B][/U][/COLOR] вверху темы

Сделайте новые логи

[ATTACH]307823[/ATTACH]

[ATTACH]307824[/ATTACH]

[ATTACH]307825[/ATTACH]

[color="#FF0000"][b]Внимание![/b][/color] Официальная поддержка (и выпуск обновлений) для Windows XP SP2 [b]прекращена[/b]

Установите [url="http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=ru"]SP3[/url] (может потребоваться активация) + все [url="http://www.update.microsoft.com/microsoftupdate/v6/default.aspx?ln=ru"]новые обновления[/url] для Windows

Что с проблемой?

все сделал. проблемма осталась(

Сделайте лог [url="http://virusinfo.info/showpost.php?p=457118&postcount=1"]полного сканирования МВАМ[/url]

[ATTACH]307962[/ATTACH]

а удалять обьекты которые нашел malwarebytes надо?

[url="http://virusinfo.info/showpost.php?p=493584&postcount=2"]Удалите в МВАМ[/url] [b]только указанные ниже записи[/b] [code]Заражённые ключи в реестре:
HKEY_CLASSES_ROOT\AppID\{B0ED4726-5BC8-4E22-A7A8-3074A73CE64E} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1408E208-2AC1-42D3-9F10-78A5B36E05AC} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6D125299-C2A9-4DBC-BEC3-6F7124E39A41} (Adware.FieryAds) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6D125299-C2A9-4DBC-BEC3-6F7124E39A41} (Adware.FieryAds) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86} (Adware.MyCentria) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86} (Adware.MyCentria) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2BA1C226-EC1B-4471-A65F-D0688AC6EE3A} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{137E6E5E-A205-4657-A49F-1AB865787089} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbAx (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbAx.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.HbInfoBand.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButton (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButton.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonA.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.IEButtonB.1 (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl (Adware.SmartShopper) -> No action taken.
HKEY_CLASSES_ROOT\SmartShopper.SmrtShprCtl.1 (Adware.SmartShopper) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\SmartShopper (Adware.SmartShopper) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MyCentria (Adware.MyCentria) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SmartShopper (Adware.SmartShopper) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\XP_Antispyware (Rogue.XPAntiSpyware) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Zumie (PUP.Zwangi) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_XMLPROVVSS (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ZUMIESEARCH_SERVICE (PUP.Zwangi) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\XPROTECTOR (Backdoor.Trojan) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SmartShopper (Adware.SmartShopper) -> No action taken.

Заражённые параметры в реестре:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEBF} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4DD1-A69A-8C56BCC7BEC0} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} (Adware.SmartShopper) -> Value: {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEBF} -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Value: scui.cpl -> No action taken.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Value: wscui.cpl -> No action taken.

Объекты реестра заражены:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{CEE51FDB-E08E-4623-81DB-8E85F6E82816}\DhcpNameServer (Trojan.DNSChanger) -> Bad: (85.255.116.165,85.255.112.220) Good: () -> No action taken.

Заражённые папки:
e:\documents and settings\Main\application data\FieryAds (Adware.FieryAds) -> No action taken.
e:\documents and settings\Main\application data\smartshopper (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> No action taken.
e:\program files\FieryAds (Adware.Adware.FearAds) -> No action taken.
e:\program files\mycentria (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\Firefox (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\InfoBar (Adware.MyCentria) -> No action taken.
e:\program files\smartshopper (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> No action taken.
e:\program files\VVSN (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1 (Adware.WhenU) -> No action taken.
e:\program files\xp_antispyware (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\data (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\microsoft.vc80.crt (Rogue.XPAntiSpyware) -> No action taken.
e:\documents and settings\Main\application data\winxrar (Trojan.Agent) -> No action taken.
e:\program files\Zumie (PUP.Zwangi) -> No action taken.

Заражённые файлы:
e:\documents and settings\Main\application data\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\xp_antispyware\htmlayout.dll (Rogue.AntiVirusPro) -> No action taken.
e:\documents and settings\Main\application data\fieryads.dat (Adware.FieryAds) -> No action taken.
e:\uninstall.exe (Trojan.Agent) -> No action taken.
e:\WINDOWS\system32\phcpn9j0ev6t.bmp (Trojan.FakeAlert) -> No action taken.
e:\WINDOWS\system32\delself.bat (Malware.Trace) -> No action taken.
e:\WINDOWS\system32\drivers\Oreans.sys (Backdoor.Trojan) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\Config.xml (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db\Aliases.dbs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db\Sites.dbs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld\phishinglist.xip (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld\whitelist.xip (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report\aggr_storage.xml (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report\send_storage.xml (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\res1\whitelist.dbs (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Uninst.exe (Adware.SmartShopper) -> No action taken.
e:\program files\VVSN\vvsn.cfg (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1\vsn.cab (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1\vsn.cfg (Adware.WhenU) -> No action taken.
e:\program files\xp_antispyware\comp.dat (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\pthreadvc2.dll (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\xp_antispyware.cfg (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\data\daily.cvd (Rogue.XPAntiSpyware) -> No action taken.
e:\documents and settings\Main\application data\winxrar\after.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\aview (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\dir.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\dot.gif (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\htmlayout.dll (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\key (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\logo.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\logo2.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\logo_____.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\myriadwebpro-condensed.ttf (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\rules.css (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-h-scroll-next.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-h-scroll-prev.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-scroll-back.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-scroll-base.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-scroll-slider.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-v-scroll-next.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\sb-v-scroll-prev.png (Trojan.Agent) -> No action taken.
e:\documents and settings\Main\application data\winxrar\scroll.css (Trojan.Agent) -> No action taken.[/code]

в общем удалил все. а куда лог сохранился не знаю..было написанно мол кудато он сохранился но в папке с рограммой его нет(

Новый отчет сделайте.

[ATTACH]308262[/ATTACH]

[url="http://virusinfo.info/showpost.php?p=493584&postcount=2"]Удалите в МВАМ[/url] [b]только указанные строки[/b] [code]Заражённые папки:
e:\documents and settings\Main\application data\FieryAds (Adware.FieryAds) -> No action taken.
e:\documents and settings\Main\application data\smartshopper (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\db (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\dwld (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\report (Adware.SmartShopper) -> No action taken.
e:\documents and settings\Main\application data\smartshopper\cs\res1 (Adware.SmartShopper) -> No action taken.
e:\program files\FieryAds (Adware.Adware.FearAds) -> No action taken.
e:\program files\mycentria (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\Firefox (Adware.MyCentria) -> No action taken.
e:\program files\mycentria\InfoBar (Adware.MyCentria) -> No action taken.
e:\program files\smartshopper (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin (Adware.SmartShopper) -> No action taken.
e:\program files\smartshopper\Bin\2.5.0 (Adware.SmartShopper) -> No action taken.
e:\program files\VVSN (Adware.WhenU) -> No action taken.
e:\program files\VVSN\URL1 (Adware.WhenU) -> No action taken.
e:\program files\xp_antispyware (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\data (Rogue.XPAntiSpyware) -> No action taken.
e:\program files\xp_antispyware\microsoft.vc80.crt (Rogue.XPAntiSpyware) -> No action taken.
e:\documents and settings\Main\application data\winxrar (Trojan.Agent) -> No action taken.
e:\program files\Zumie (PUP.Zwangi) -> No action taken.

Заражённые файлы:
e:\documents and settings\Main\application data\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\alcohol soft\alcohol 120\Plugins\Helper\AlSrvN.exe (Backdoor.Agent) -> No action taken.
e:\program files\FieryAds\fieryadsuninstall.exe (Adware.FieryAds) -> No action taken.
e:\program files\xp_antispyware\htmlayout.dll (Rogue.AntiVirusPro) -> No action taken.
e:\documents and settings\Main\application data\fieryads.dat (Adware.FieryAds) -> No action taken.
e:\uninstall.exe (Trojan.Agent) -> No action taken.
e:\WINDOWS\system32\phcpn9j0ev6t.bmp (Trojan.FakeAlert) -> No action taken.
e:\WINDOWS\system32\delself.bat (Malware.Trace) -> No action taken.[/code]

[ATTACH]308290[/ATTACH]

Что с проблемой?

осталась

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]23[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]