Проблема servises.exe, svchost.exe и др.

[pavbest8]

Вчера включаю ноутбук, сам пошёл чай пить прихожу и вижу что там ошибка о том что нужный процесс был закрыт - servises.exe
Потом перезапустил компьютер зашёл в Диспетчер и увидел что вся оперативная память заполняется не понятно чем, как только она полностью заполняется компьютер выключается сам (Вылазиет ошибка о закрытии servises.exe). Скачивал drweb но он просто не успевает проверить весь Диск C(Опять же эта ошибка servises.exe)

Логи вроде бы успел сделать до отключения
Надеюсь на вашу помощь

[polword]

Закройте все открытые приложения, кроме АVZ и Internet Explorer.
Отключите
- ПК от интернета/локалки
- Обязательно!!! Системное восстановление!!! как- посмотреть можно тут
- Выгрузите антивирус и/или Файрвол
- Закройте все программы
- Выполните скрипт в AVZ

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 RegKeyStrParamWrite('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon','UserInit', GetEnvironmentVariable ('WinDir')+'\System32\userinit.exe,'); 
  QuarantineFile('C:\Program Files\QuestDns\questdns.dll','');
 QuarantineFile('C:\WINDOWS\system32\csrcs.exe','');
 QuarantineFile('C:\Program Files\Internet Explorer\rasadhlp.dll','');
 QuarantineFile('C:\WINDOWS\system32\swfrexb.dll','');
 QuarantineFile('C:\WINDOWS\svc2.exe','');
 QuarantineFile('C:\Documents and Settings\Дом\epowmlxx~.exe','');
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\QuestDns\questdns117.exe','');
 QuarantineFile('C:\WINDOWS\system32\Drivers\NDIS.sys','');
 QuarantineFile('C:\DOCUME~1\F184~1\APPLIC~1\Adobe\WINUPL~1\msftldr.dll','');
 QuarantineFile('C:\Documents and Settings\Дом\Application Data\Adobe\winuplupl80\msfttcp.dll','');
 QuarantineFile('C:\Documents and Settings\Дом\Application Data\Adobe\winuplupl80\msfteml.dll','');
 QuarantineFile('C:\Documents and Settings\Дом\Application Data\Adobe\winuplupl80\msftcore.dll','');
 QuarantineFile('c:\windows\svc2.exe','');
 TerminateProcessByName('c:\windows\svc2.exe');
 QuarantineFile('c:\documents and settings\Дом\epowmlxx~.exe','');
 TerminateProcessByName('c:\documents and settings\Дом\epowmlxx~.exe');
 DeleteFile('c:\documents and settings\Дом\epowmlxx~.exe');
 DeleteFile('c:\windows\svc2.exe');
 DeleteFile('C:\Documents and Settings\Дом\epowmlxx~.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','epowmlxx~');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','NetLog2');
 DeleteFile('C:\WINDOWS\svc2.exe');
 DeleteFile('C:\WINDOWS\system32\swfrexb.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\uppeugm\Parameters','ServiceDll');
 DeleteFile('C:\Program Files\Internet Explorer\rasadhlp.dll');
 DeleteFile('C:\WINDOWS\system32\csrcs.exe');
 BC_ImportAll;
 ExecuteSysClean;
 ExecuteRepair(20);
 ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
 RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun',221);
 BC_Activate;
 RebootWindows(true);
end.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы
- Замените файл C:\WINDOWS\system32\Drivers\NDIS.sys на чистый из дистрибутива.
- Сделайте повторные логи по правилам п.2 и 3 раздела Диагностика.(virusinfo_syscheck.zip;hijackthis.log)

[pavbest8]

Извиняюсь что отсутствовал так долго...
Всё сделал.

[polword]

- Замените файл C:\WINDOWS\system32\Drivers\NDIS.sys на чистый из дистрибутива.

это сделайте

- Выполните скрипт в AVZ

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
 DeleteFile('C:\Documents and Settings\Дом\Application Data\Adobe\winuplupl80\msftcore.dll');
 DeleteFile('C:\Documents and Settings\Дом\Application Data\Adobe\winuplupl80\msfteml.dll');
 DeleteFile('C:\Documents and Settings\Дом\Application Data\Adobe\winuplupl80\msfttcp.dll');
 DeleteFile('C:\DOCUME~1\F184~1\APPLIC~1\Adobe\WINUPL~1\msftldr.dll');
 DeleteFile('C:\Program Files\QuestDns\questdns.dll');
 BC_ImportAll;
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.

После перезагрузки:
- Сделайте повторный лог virusinfo_syscheck.zip;
- Сделайте лог MBAM

[pavbest8]

Всё сделал, но получилось так что сначало логи сделал потом заменил файлик ndis.sys, Заменял с помощью консоли восстановления

Вот логи...

[polword]

1.Выполните скрипт в AVZ

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 SetAVZPMStatus(true);
 DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
 RegKeyStrParamWrite('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon','UserInit', GetEnvironmentVariable ('WinDir')+'\System32\userinit.exe,'); 
 QuarantineFile('C:\Program Files\Opera\rasadhlp.dll','');
 QuarantineFile('C:\Program Files\wpe\PermEdit.exe','');
 QuarantineFile('C:\Program Files\Outlook Express\rasadhlp.dll','');
 QuarantineFile('C:\Program Files\Mozilla Firefox\rasadhlp.dll','');
 QuarantineFile('C:\Program Files\Safari\rasadhlp.dll ','');
 QuarantineFile('C:\WINDOWS\system32\Drivers\ntndis.sys ','');
 QuarantineFile('C:\WINDOWS\system32\d3dx10d.dll ','');
 QuarantineFile('C:\WINDOWS\system32\ipsecndis.sys ','');
 DeleteFile('C:\Program Files\Opera\rasadhlp.dll');
 DeleteFile('C:\Program Files\Outlook Express\rasadhlp.dll');
 DeleteFile('C:\Program Files\Mozilla Firefox\rasadhlp.dll');
 DeleteFile('C:\Program Files\Safari\rasadhlp.dll ');
 QuarantineFile('C:\WINDOWS\system32\Drivers\NDIS.sys','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-6490289052-6468931481-255282520-2428\wingn.exe','');
 BC_ImportAll;
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы
2.удалите в MBAM

Зараженные ключи в реестре:
HKEY_CLASSES_ROOT\shopperreports.hbax (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.hbax.1 (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.hbinfoband (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.hbinfoband.1 (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.iebutton (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.iebutton.1 (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.iebuttona (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.iebuttona.1 (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.rprtctrl (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\shopperreports.rprtctrl.1 (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{38493f7f-2922-4c6c-9a9a-8da2c940d0ee} (Adware.7FaSSt) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{9bec9b38-bf39-4899-806e-a1c5dfeb60a2} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e6961c59-cfce-4ccd-b794-bc78db98413a} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{3277cd27-4001-4ef8-9d96-c6ca745ac2f9} (Adware.7FaSSt) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e5a1ece5-3e3d-4fe7-8447-78cb1fd377c6} (Adware.7FaSSt) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e5a1ece5-3e3d-4fe7-8447-78cb1fd377c6} (Adware.7FaSSt) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{a078f691-9c07-4af2-bf43-35e79eecf8b7} (Adware.Softomate) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{dee758b4-c3fb-4a5b-9939-848b9c77a2fb} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{573f4abb-a1a2-44ed-9ba9-a8dad40aac46} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{71e02280-5212-45c3-b174-4d5a35da254f} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{396cfc12-932d-496b-a0a8-5d7201e105e1} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{60da826c-b1c6-4358-bdec-4837ced45470} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{74c22317-5b90-471f-9ad2-fec049870a16} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c1089f63-7afc-4538-b0eb-bea0f4225a57} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{02aed140-2b62-4b49-8b3b-179020cc39b9} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{17bf1e05-c0e8-413c-bd1f-a481eea3b8e9} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{83b2fe06-ba20-4f7d-96c6-6fc3a4e877d3} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{b32966a2-f7c2-4362-a6cf-399ec8b44110} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cc7bd6f1-565c-47ce-a5bb-9c935e77b59d} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cfc16189-8a92-4a29-a940-60248385f426} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{5fe0ceae-cb69-40af-a323-40f94257dacb} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{65a16874-2ed0-460e-a547-5fe2ec3a13a7} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2721a8e5-bfdb-4562-9912-9e0531ca616c} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{f1a1892c-2a6c-4817-98b4-ff81443cba20} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e25da6d6-c365-46cf-abaf-dc5893135d7a} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{09325003-167c-483d-a4ba-8b3122abb432} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6dd76b7b-6423-4df0-9a07-84a6cad973a0} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7f6cfb6a-9227-4bb8-b941-f2b067e76f51} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ab0ee208-df60-4fa7-a617-c4269760033e} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e12aeab6-7d12-4c07-8e36-5892efb4dafb} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{e2f2c137-a782-4fb5-81af-086156f5eb0a} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{f1d06c9f-51f0-4476-bede-5ddf91be304e} (Adware.ShopperReports) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{f3a32df2-7413-4fb1-b575-1ac920a17b76} (Adware.ShopperReports) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DRM\amty (Worm.Autorun) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\AGprotect (Malware.Trace) -> No action taken.

Зараженные параметры в реестре:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{e5a1ece5-3e3d-4fe7-8447-78cb1fd377c6} (Adware.7FaSSt) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_1 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_2 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_3 (Rootkit.Agent) -> No action taken.

Объекты реестра заражены:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe,C:\RECYCLER\S-1-5-21-6490289052-6468931481-255282520-2428\wingn.exe) Good: (Explorer.exe) -> No action taken.

Зараженные папки:
C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> No action taken.
C:\Program Files\ShopperReports3 (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0 (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\chrome (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\components (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3 (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\db (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\dwld (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\report (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\res1 (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\db (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\dwld (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\report (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\res1 (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3 (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\db (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\dwld (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\report (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\res1 (Adware.ShopperReports) -> No action taken.
C:\Program Files\Def Group\PC Defender (Rogue.PCDefender) -> No action taken.
C:\Documents and Settings\All Users\Главное меню\Программы\PC Defender (Rogue.PCDefender) -> No action taken.

Зараженные файлы:
C:\Program Files\ShopperReports3\bin\3.0.489.0\ShopperReports.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\blinkx Remote Toolbar\the_blinkx_toolbar.dll (Adware.7FaSSt) -> No action taken.
C:\Program Files\Def Group\PC Defender\pcdef.exe (Rogue.PCDefender) -> No action taken.
C:\Program Files\Opera\rasadhlp.dll (Spyware.Passwords) -> No action taken.
C:\Program Files\Outlook Express\rasadhlp.dll (Spyware.Passwords) -> No action taken.
C:\Program Files\Safari\rasadhlp.dll (Spyware.Passwords) -> No action taken.
C:\Program Files\Mozilla Firefox\rasadhlp.dll (Spyware.Passwords) -> No action taken.
C:\Program Files\FileZilla FTP Client\hnetcfg.dll (Spyware.Passwords) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\BRNstIE.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\CmndFF.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\CntntCntr.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\link.ico (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\mozillaps.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\Pltfrm.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\ShopperReportsUninstaller.exe (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\chrome.manifest (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\install.rdf (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\chrome\firefoxtoolbar.jar (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.dll (Adware.ShopperReports) -> No action taken.
C:\Program Files\ShopperReports3\bin\3.0.489.0\firefox\firefoxtoolbar\extensions\components\BRNstFF.xpt (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\Config.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\db\Aliases.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\db\Sites.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\report\aggr_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\report\send_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\Firefox\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\Config.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\db\Aliases.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\db\Sites.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\report\aggr_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\report\send_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\Дом\Application Data\ShopperReports3\IE\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\Config.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\dwld\WhiteList.xip (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\report\aggr_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\report\send_storage.xml (Adware.ShopperReports) -> No action taken.
C:\Documents and Settings\NetworkService\Application Data\ShopperReports3\IE\cs\res1\WhiteList.dbs (Adware.ShopperReports) -> No action taken.
C:\Program Files\Def Group\PC Defender\proccheck.exe (Rogue.PCDefender) -> No action taken.
C:\Program Files\Def Group\PC Defender\prockill64.exe (Rogue.PCDefender) -> No action taken.
C:\Program Files\Def Group\PC Defender\Undo.ico (Rogue.PCDefender) -> No action taken.
C:\Program Files\Def Group\PC Defender\uninstall.bat (Rogue.PCDefender) -> No action taken.
C:\Documents and Settings\All Users\Главное меню\Программы\PC Defender\PC Defender.lnk (Rogue.PCDefender) -> No action taken.
C:\Documents and Settings\All Users\Главное меню\Программы\PC Defender\Uninstall.lnk (Rogue.PCDefender) -> No action taken.
C:\Program Files\Common Files\keylog.txt (Malware.Trace) -> No action taken.
C:\WINDOWS\system32\SKYNETtevdlyfv.dat (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\SKYNETxipmyyqx.dat (Rootkit.TDSS) -> No action taken.
C:\WINDOWS\system32\Drivers\ntndis.sys (Rootkit.Agent) -> No action taken.

- Сделайте повторные логи virusinfo_syscheck.zip и MBAM[/URL]

[pavbest8]

Всё сделал

[pavbest8]

Что делать дальше?

[thyrex]

Что с проблемой?

[pavbest8]

Что с проблемой?

Проблема само - отключения пропала, но теперь не могу подключиться к интернету, драйвера на Lan переустанавливал, толку нету...

[polword]

попробуйте это

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 2
• Обработано файлов: 18
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\documents and settings\\дом\\application data\\adobe\\winuplupl80\\msftcore.dll - Backdoor.Win32.Agent.baid ( DrWEB: BackDoor.Msft.1, BitDefender: Backdoor.Generic.485123, AVAST4: Win32:Malware-gen )
  2. c:\\documents and settings\\дом\\application data\\adobe\\winuplupl80\\msfteml.dll - Backdoor.Win32.Agent.baew ( DrWEB: BackDoor.Siggen.26800, BitDefender: Backdoor.Generic.491332, AVAST4: Win32:Malware-gen )
  3. c:\\docume~1\\f184~1\\applic~1\\adobe\\winupl~1\\m sftldr.dll - Trojan.Win32.Agent.gwoy ( DrWEB: Tool.Siggen.6125, BitDefender: Gen:Variant.Hyat.1, AVAST4: Win32:Malware-gen )
  4. c:\\program files\\mozilla firefox\\rasadhlp.dll - Backdoor.Win32.Delf.woe ( DrWEB: Trojan.PWS.Stealer.333, BitDefender: Trojan.Generic.4827210, NOD32: Win32/Delf.NWS trojan, AVAST4: Win32:Spyware-gen [Spy] )
  5. c:\\program files\\opera\\rasadhlp.dll - Backdoor.Win32.Delf.woe ( DrWEB: Trojan.PWS.Stealer.333, BitDefender: Trojan.Generic.4827210, NOD32: Win32/Delf.NWS trojan, AVAST4: Win32:Spyware-gen [Spy] )
  6. c:\\program files\\outlook express\\rasadhlp.dll - Backdoor.Win32.Delf.woe ( DrWEB: Trojan.PWS.Stealer.333, BitDefender: Trojan.Generic.4827210, NOD32: Win32/Delf.NWS trojan, AVAST4: Win32:Spyware-gen [Spy] )
  7. c:\\program files\\questdns\\questdns.dll - not-a-virus:AdWare.Win32.Zwangi.can ( DrWEB: Trojan.Searcher.151, BitDefender: Gen:Variant.Adware.Zwangi.1, AVAST4: Win32:Zwangi-BE [Adw] )
  8. c:\\program files\\safari\\rasadhlp.dll - Backdoor.Win32.Delf.woe ( DrWEB: Trojan.PWS.Stealer.333, BitDefender: Trojan.Generic.4827210, NOD32: Win32/Delf.NWS trojan, AVAST4: Win32:Spyware-gen [Spy] )
  9. c:\\program files\\wpe\\permedit.exe - Trojan.Win32.Genome.wrr ( DrWEB: Trojan.Click.30422, BitDefender: Trojan.Generic.6948471, AVAST4: Win32:Trojan-gen )
  10. c:\\windows\\system32\\csrcs.exe - Worm.Win32.AutoIt.xl ( DrWEB: archive: Win32.HLLW.Autoruner.based, BitDefender: Trojan.Generic.4766341 )