PCAntispyware2010 и braviax.exe Нод 32 видит но удалить не может

[Tom Joad]

Добрий день!
Антивирусы не помагают,Нод 32 видит но удалить не может,тоже самое с AVZ.Решил боротса вручную.Сначала попробывал Malwarebytes’ Anti-Malware .После перегрузки не помогло.Попробывал повторно для полного сохранения резултатов.Вот что получил

Malwarebytes’ Anti-Malware 1.40
Версия базы данных: 2734
Windows 5.1.2600 Service Pack 2

03.09.2009 12:08:05
mbam-log-2009-09-03 (12-08-05).txt

Тип проверки: Полная (C:|)
Проверено объектов: 131130
Прошло времени: 32 minute(s), 4 second(s)

Заражено процессов в памяти: 1
Заражено модулей в памяти: 0
Заражено ключей реестра: 0
Заражено значений реестра: 7
Заражено параметров реестра: 6
Заражено папок: 0
Заражено файлов: 13

Заражено процессов в памяти:
C:WINDOWSsystem32braviax.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Заражено модулей в памяти:
(Вредоносные программы не обнаружены)

Заражено ключей реестра:
(Вредоносные программы не обнаружены)

Заражено значений реестра:
HKEY_CURRENT_USERControl Paneldon’t loadscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERControl Paneldon’t loadwscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunbraviax (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunbraviax (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunPC AntiSpyware 2010 (Rogue.PC_AntiSpyware2010) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunRegedit32 (Trojan.Agent) -> Delete on reboot.

Заражено параметров реестра:
HKEY_CURRENT_USERSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USERSOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterFirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftSecurity CenterUpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Заражено папок:
(Вредоносные программы не обнаружены)

Заражено файлов:
C:Documents and SettingsTom JoadLocal Settingstempmsupd_2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:Documents and SettingsTom JoadLocal SettingsTemporary Internet FilesContent.IE5H62T4WJCInstall[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:QooboxQuarantineCWINDOWSsystem32wisdstr.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:WINDOWSsystem32wisdstr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:WINDOWSsystem32dllcachebeep.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:WINDOWSsystem32driversbeep.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:WINDOWSsystem32braviax.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:WINDOWStempBN11.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:Documents and SettingsTom JoadLocal SettingstempBN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:Documents and SettingsTom Joadoashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> Quarantined and deleted successfully.
C:Documents and SettingsTom JoadLocal Settingstemptmpwr2 (Rogue.Installer) -> Quarantined and deleted successfully.
C:Documents and SettingsTom JoadLocal Settingstemptmpwr3 (Rogue.Installer) -> Quarantined and deleted successfully.
C:Documents and SettingsTom JoadLocal Settingstemptmpwr4 (Rogue.Installer) -> Quarantined and deleted successfully.

Повторно не помогло,решил попробывать SDFix ,результат

SDFix: Version 1.240
Run by Tom Joad on 03.09.2009 at 12:27

Microsoft Windows XP [‚ҐабЁп 5.1.2600]
Running From: C:SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File
Resetting AppInit_DLLs value

Rebooting

Infected beep.sys Found!

beep.sys File Locations:

«C:WINDOWSsystem32dllcachebeep.sys» 29184 03.09.2009 12:11
«C:WINDOWSsystem32driversbeep.sys» 29184 03.09.2009 12:11

Infected File Listed Below:

C:WINDOWSsystem32dllcachebeep.sys
C:WINDOWSsystem32driversbeep.sys

File copied to Backups Folder
Attempting to replace beep.sys with original version

Original beep.sys Restored

«C:WINDOWSsystem32dllcachebeep.sys» 4224 07.08.2008 15:27
«C:WINDOWSsystem32driversbeep.sys» 4224 07.08.2008 15:27

Checking Files :

Trojan Files Found:

C:DOCUME~1TOMJOA~1COOKIESUVUMEW._DL — Deleted
C:DOCUME~1TOMJOA~1COOKIESEMOXY.PIF — Deleted
C:WINDOWSbraviax.exe — Deleted
C:WINDOWScru629.dat — Deleted
C:WINDOWSsystem32braviax.exe — Deleted
C:WINDOWSsystem32cru629.dat — Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista — rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-03 12:33:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions]
«34484=484?4>4@4B4 ?W?A?N? ?(?L?2?T?P?)?»=str(7):»1»
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?T?P?)?»=str(7):»1»
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?P?o?E?)?»=str(7):»1»
«374@4O4<4>494 ??0404@0404;4;0454;4L4=4K494 ??4>4@4B4″=str(7):»1»
«34484=484?4>4@4B4 ?W?A?N? ?(?I?P?)?»=str(7):»1»
«34484=484?4>4@4B4 ??4;0404=484@4>0424I484:0404 ??0404:0454B4>0424″=str(7):»1002»
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceslanmanserverShares]
«374@484=4B0454@4″=str(7):»CSCFlags=0MaxUses=4294967295Path=Microsoft XPS Document Writer,LocalsplOnlyPermissions=0Remark=Microsoft XPS Document WriterType=1»
«374@484=4B0454@042?»=str(7):»CSCFlags=0MaxUses=4294967295Path=Microsoft Office Document Image Writer,LocalsplOnlyPermissions=0Remark=Microsoft Office Document Image WriterType=1»
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg]
«s1″=dword:2df9c43f
«s2″=dword:110480d0
«h0″=dword:00000001

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA4]
«p0″=»C:Program FilesDAEMON Tools»
«h0″=dword:00000000
«khjeh»=hex:50,bd,ed,49,ed,99,ca,7b,05,d3,ca,51,ba,7a,ca,ec,53,c7,06,e9,5a,..

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
«a0″=hex:20,01,00,00,90,d7,6d,e1,81,0a,a6,3e,08,cd,7c,04,44,50,b4,1f,c6,..
«khjeh»=hex:3a,b4,f1,47,99,9a,fc,1b,2b,e6,24,2d,78,1e,d9,61,1e,07,7d,37,25,..

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
«khjeh»=hex:a7,34,f5,e9,8a,50,f1,9a,d2,3b,3c,c1,32,19,4f,75,01,12,27,5f,22,..
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSysmonLogLog Queries{99aa6cce-4d9c-4285-a202-95bd8579dea9}]
«324>4A0420454=4=4K494 ?:4>4<4<0454=4B0404@48494"="@C:WINDOWSSystem32smlogcfg.dll,-735"
«204B4@480414C4B4K4 ?E4@0404=0454=484O4 ?40404=4=4K4E4″=dword:00000021
«324>4A0420454=4=4>0454 ?84<4O4 ?D040494;0404 ?64C4@4=0404;0404 ?10400474K4 ?40404=4=4K4E4"="@C:WINDOWSSystem32smlogcfg.dll,-744"
[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA4]
«p0″=»C:Program FilesDAEMON Tools»
«h0″=dword:00000000
«khjeh»=hex:50,bd,ed,49,ed,99,ca,7b,05,d3,ca,51,ba,7a,ca,ec,53,c7,06,e9,5a,..

[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
«a0″=hex:20,01,00,00,90,d7,6d,e1,81,0a,a6,3e,08,cd,7c,04,44,50,b4,1f,c6,..
«khjeh»=hex:3a,b4,f1,47,99,9a,fc,1b,2b,e6,24,2d,78,1e,d9,61,1e,07,7d,37,25,..

[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
«khjeh»=hex:a7,34,f5,e9,8a,50,f1,9a,d2,3b,3c,c1,32,19,4f,75,01,12,27,5f,22,..
[HKEY_LOCAL_MACHINESYSTEMControlSet002ServicesSysmonLogLog Queries{99aa6cce-4d9c-4285-a202-95bd8579dea9}]
«324>4A0420454=4=4K494 ?:4>4<4<0454=4B0404@48494"="@C:WINDOWSSystem32smlogcfg.dll,-735"
«204B4@480414C4B4K4 ?E4@0404=0454=484O4 ?40404=4=4K4E4″=dword:00000021
«324>4A0420454=4=4>0454 ?84<4O4 ?D040494;0404 ?64C4@4=0404;0404 ?10400474K4 ?40404=4=4K4E4"="@C:WINDOWSSystem32smlogcfg.dll,-744"
[HKEY_LOCAL_MACHINESYSTEMControlSet003ControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}Descriptions]
«34484=484?4>4@4B4 ?W?A?N? ?(?L?2?T?P?)?»=str(7):»1»
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?T?P?)?»=str(7):»1»
«34484=484?4>4@4B4 ?W?A?N? ?(?P?P?P?o?E?)?»=str(7):»1»
«374@4O4<4>494 ??0404@0404;4;0454;4L4=4K494 ??4>4@4B4″=str(7):»1»
«34484=484?4>4@4B4 ?W?A?N? ?(?I?P?)?»=str(7):»1»
«34484=484?4>4@4B4 ??4;0404=484@4>0424I484:0404 ??0404:0454B4>0424″=str(7):»1002»
[HKEY_LOCAL_MACHINESYSTEMControlSet003ServiceslanmanserverShares]
«374@484=4B0454@4″=str(7):»CSCFlags=0MaxUses=4294967295Path=Microsoft XPS Document Writer,LocalsplOnlyPermissions=0Remark=Microsoft XPS Document WriterType=1»
«374@484=4B0454@042?»=str(7):»CSCFlags=0MaxUses=4294967295Path=Microsoft Office Document Image Writer,LocalsplOnlyPermissions=0Remark=Microsoft Office Document Image WriterType=1»
[HKEY_LOCAL_MACHINESYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA4]
«p0″=»C:Program FilesDAEMON Tools»
«h0″=dword:00000000
«khjeh»=hex:50,bd,ed,49,ed,99,ca,7b,05,d3,ca,51,ba,7a,ca,ec,53,c7,06,e9,5a,..

[HKEY_LOCAL_MACHINESYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001]
«a0″=hex:20,01,00,00,90,d7,6d,e1,81,0a,a6,3e,08,cd,7c,04,44,50,b4,1f,c6,..
«khjeh»=hex:3a,b4,f1,47,99,9a,fc,1b,2b,e6,24,2d,78,1e,d9,61,1e,07,7d,37,25,..

[HKEY_LOCAL_MACHINESYSTEMControlSet003ServicessptdCfg19659239224E364682FA4BAF72C53EA40000001Jf40]
«khjeh»=hex:a7,34,f5,e9,8a,50,f1,9a,d2,3b,3c,c1,32,19,4f,75,01,12,27,5f,22,..
[HKEY_LOCAL_MACHINESYSTEMControlSet003ServicesSysmonLogLog Queries{99aa6cce-4d9c-4285-a202-95bd8579dea9}]
«324>4A0420454=4=4K494 ?:4>4<4<0454=4B0404@48494"="@C:WINDOWSSystem32smlogcfg.dll,-735"
«204B4@480414C4B4K4 ?E4@0404=0454=484O4 ?40404=4=4K4E4″=dword:00000021
«324>4A0420454=4=4>0454 ?84<4O4 ?D040494;0404 ?64C4@4=0404;0404 ?10400474K4 ?40404=4=4K4E4"="@C:WINDOWSSystem32smlogcfg.dll,-744"

scanning hidden registry entries …

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionControl PanelCursorsSchemes]
«!4B0404=0440404@4B4=0404O4 ?W?i?n?d?o?w?s?»=»»,,,,,,,,,,,,,»»
«374>044042480464=0404O4 ?W?i?n?d?o?w?s?»=»»C:WINDOWSCursorsrainbow.ani,,C:WINDOWSCursorsappstart.ani,C:WINDOWSCursorshourglas.ani,C:WINDOWSCursorscross.cur,,,,C:WINDOWSCursorssizens.ani,C:WINDOWSCursorssizewe.ani,C:WINDOWSCursorssizenwse.ani,C:WINDOWSCursorssizenesw.ani,,»»
«360414J0454<4=0404O4 ?10454;0404O4"=""C:WINDOWSCursors3dwarro.cur,,C:WINDOWSCursorsappstar3.ani,C:WINDOWSCursorshourgla3.ani,C:WINDOWSCursorscross.cur,,,C:WINDOWSCursors3dwno.cur,C:WINDOWSCursors3dwns.cur,C:WINDOWSCursors3dwwe.cur,C:WINDOWSCursors3dwnwse.cur,C:WINDOWSCursors3dwnesw.cur,C:WINDOWSCursors3dwmove.cur,""
» 4C4:484 ?1?»=»»C:WINDOWSCursorsharrow.cur,,C:WINDOWSCursorshandapst.ani,C:WINDOWSCursorshand.ani,C:WINDOWSCursorshcross.cur,C:WINDOWSCursorshibeam.cur,,C:WINDOWSCursorshnodrop.cur,C:WINDOWSCursorshns.cur,C:WINDOWSCursorshwe.cur,C:WINDOWSCursorshnwse.cur,C:WINDOWSCursorshnesw.cur,C:WINDOWSCursorshmove.cur,»»
» 4C4:484 ?2?»=»»C:WINDOWSCursorsharrow.cur,,C:WINDOWSCursorshandapst.ani,C:WINDOWSCursorshandwait.ani,C:WINDOWSCursorshcross.cur,C:WINDOWSCursorshibeam.cur,,C:WINDOWSCursorshandno.ani,C:WINDOWSCursorshandns.ani,C:WINDOWSCursorshandwe.ani,C:WINDOWSCursorshandnwse.ani,C:WINDOWSCursorshandnesw.ani,C:WINDOWSCursorshmove.cur,»»
«24484=4>0470400424@4″=»»C:WINDOWSCursors3dgarro.cur,,C:WINDOWSCursorsdinosaur.ani,C:WINDOWSCursorsdinosau2.ani,C:WINDOWSCursorscross.cur,,,C:WINDOWSCursorsbanana.ani,C:WINDOWSCursors3dsns.cur,C:WINDOWSCursors3dgwe.cur,C:WINDOWSCursors3dsnwse.cur,C:WINDOWSCursors3dgnesw.cur,C:WINDOWSCursors3dsmove.cur,»»
«224 ?A4B0404@4>4<4 ?A4B484;0454"=""C:WINDOWSCursorsharrow.cur,,C:WINDOWSCursorshorse.ani,C:WINDOWSCursorsbarber.ani,C:WINDOWSCursorshcross.cur,C:WINDOWSCursorshibeam.cur,,C:WINDOWSCursorscoin.ani,C:WINDOWSCursors3dgns.cur,C:WINDOWSCursors3dgwe.cur,C:WINDOWSCursors3dgnwse.cur,C:WINDOWSCursors3dgnesw.cur,C:WINDOWSCursors3dgmove.cur,""
«24484@480460454@4″=»»C:WINDOWSCursorsharrow.cur,,C:WINDOWSCursorsdrum.ani,C:WINDOWSCursorsmetronom.ani,C:WINDOWSCursorshcross.cur,C:WINDOWSCursorshibeam.cur,,C:WINDOWSCursorspiano.ani,C:WINDOWSCursorshns.cur,C:WINDOWSCursorshwe.cur,C:WINDOWSCursorshnwse.cur,C:WINDOWSCursorshnesw.cur,C:WINDOWSCursorshmove.cur,»»
«#0420454;484G0454=4=0404O4″=»»C:WINDOWSCursorslarrow.cur,,C:WINDOWSCursorslappstrt.cur,C:WINDOWSCursorslwait.cur,C:WINDOWSCursorslcross.cur,C:WINDOWSCursorslibeam.cur,,C:WINDOWSCursorslnodrop.cur,C:WINDOWSCursorslns.cur,C:WINDOWSCursorslwe.cur,C:WINDOWSCursorslnwse.cur,C:WINDOWSCursorslnesw.cur,C:WINDOWSCursorslmove.cur,»»
«220404@480404F48484″=»»C:WINDOWSCursorsfillitup.ani,,C:WINDOWSCursorsraindrop.ani,C:WINDOWSCursorscounter.ani,C:WINDOWSCursorscross.cur,,,C:WINDOWSCursorswagtail.ani,C:WINDOWSCursorssizens.ani,C:WINDOWSCursorssizewe.ani,C:WINDOWSCursorssizenwse.ani,C:WINDOWSCursorssizenesw.ani,»»
«360414J0454<4=0404O4 ?14@4>4=0474>0420404O4″=»»C:WINDOWSCursors3dgarro.cur,,C:WINDOWSCursorsappstar2.ani,C:WINDOWSCursorshourgla2.ani,C:WINDOWSCursorscross.cur,,,C:WINDOWSCursors3dgno.cur,C:WINDOWSCursors3dgns.cur,C:WINDOWSCursors3dgwe.cur,C:WINDOWSCursors3dgnwse.cur,C:WINDOWSCursors3dgnesw.cur,C:WINDOWSCursors3dgmove.cur,»»
«‘0454@4=0404O4 ?»=»C:WINDOWScursorsarrow_r.cur,C:WINDOWScursorshelp_r.cur,C:WINDOWScursorswait_r.cur,C:WINDOWScursorsbusy_r.cur,C:WINDOWScursorscross_r.cur,C:WINDOWScursorsbeam_r.cur,C:WINDOWScursorspen_r.cur,C:WINDOWScursorsno_r.cur,C:WINDOWScursorssize4_r.cur,C:WINDOWScursorssize3_r.cur,C:WINDOWScursorssize2_r.cur,C:WINDOWScursorssize1_r.cur,C:WINDOWScursorsmove_r.cur,C:WINDOWScursorsup_r.cur»
«‘0454@4=0404O4 ?(?:4@4C4?4=0404O4)?»=»C:WINDOWScursorsarrow_rm.cur,C:WINDOWScursorshelp_rm.cur,C:WINDOWScursorswait_rm.cur,C:WINDOWScursorsbusy_rm.cur,C:WINDOWScursorscross_rm.cur,C:WINDOWScursorsbeam_rm.cur,C:WINDOWScursorspen_rm.cur,C:WINDOWScursorsno_rm.cur,C:WINDOWScursorssize4_rm.cur,C:WINDOWScursorssize3_rm.cur,C:WINDOWScursorssize2_rm.cur,C:WINDOWScursorssize1_rm.cur,C:WINDOWScursorsmove_rm.cur,C:WINDOWScursorsup_rm.cur»
«‘0454@4=0404O4 ?(?>0434@4>4<4=0404O4)?"="C:WINDOWScursorsarrow_rl.cur,C:WINDOWScursorshelp_rl.cur,C:WINDOWScursorswait_rl.cur,C:WINDOWScursorsbusy_rl.cur,C:WINDOWScursorscross_rl.cur,C:WINDOWScursorsbeam_rl.cur,C:WINDOWScursorspen_rl.cur,C:WINDOWScursorsno_rl.cur,C:WINDOWScursorssize4_rl.cur,C:WINDOWScursorssize3_rl.cur,C:WINDOWScursorssize2_rl.cur,C:WINDOWScursorssize1_rl.cur,C:WINDOWScursorsmove_rl.cur,C:WINDOWScursorsup_rl.cur"
«304=0420454@4A4=0404O4″=»C:WINDOWScursorsarrow_i.cur,C:WINDOWScursorshelp_i.cur,C:WINDOWScursorswait_i.cur,C:WINDOWScursorsbusy_i.cur,C:WINDOWScursorscross_i.cur,C:WINDOWScursorsbeam_i.cur,C:WINDOWScursorspen_i.cur,C:WINDOWScursorsno_i.cur,C:WINDOWScursorssize4_i.cur,C:WINDOWScursorssize3_i.cur,C:WINDOWScursorssize2_i.cur,C:WINDOWScursorssize1_i.cur,C:WINDOWScursorsmove_i.cur,C:WINDOWScursorsup_i.cur»
«304=0420454@4A4=0404O4 ?(?:4@4C4?4=0404O4)?»=»C:WINDOWScursorsarrow_im.cur,C:WINDOWScursorshelp_im.cur,C:WINDOWScursorswait_im.cur,C:WINDOWScursorsbusy_im.cur,C:WINDOWScursorscross_im.cur,C:WINDOWScursorsbeam_im.cur,C:WINDOWScursorspen_im.cur,C:WINDOWScursorsno_im.cur,C:WINDOWScursorssize4_im.cur,C:WINDOWScursorssize3_im.cur,C:WINDOWScursorssize2_im.cur,C:WINDOWScursorssize1_im.cur,C:WINDOWScursorsmove_im.cur,C:WINDOWScursorsup_im.cur»
«304=0420454@4A4=0404O4 ?(?>0434@4>4<4=0404O4)?"="C:WINDOWScursorsarrow_il.cur,C:WINDOWScursorshelp_il.cur,C:WINDOWScursorswait_il.cur,C:WINDOWScursorsbusy_il.cur,C:WINDOWScursorscross_il.cur,C:WINDOWScursorsbeam_il.cur,C:WINDOWScursorspen_il.cur,C:WINDOWScursorsno_il.cur,C:WINDOWScursorssize4_il.cur,C:WINDOWScursorssize3_il.cur,C:WINDOWScursorssize2_il.cur,C:WINDOWScursorssize1_il.cur,C:WINDOWScursorsmove_il.cur,C:WINDOWScursorsup_il.cur"
«!4B0404=0440404@4B4=0404O4 ?(?:4@4C4?4=0404O4)?»=»C:WINDOWScursorsarrow_m.cur,C:WINDOWScursorshelp_m.cur,C:WINDOWScursorswait_m.cur,C:WINDOWScursorsbusy_m.cur,C:WINDOWScursorscross_m.cur,C:WINDOWScursorsbeam_m.cur,C:WINDOWScursorspen_m.cur,C:WINDOWScursorsno_m.cur,C:WINDOWScursorssize4_m.cur,C:WINDOWScursorssize3_m.cur,C:WINDOWScursorssize2_m.cur,C:WINDOWScursorssize1_m.cur,C:WINDOWScursorsmove_m.cur,C:WINDOWScursorsup_m.cur»
«!4B0404=0440404@4B4=0404O4 ?(?>0434@4>4<4=0404O4)?"="C:WINDOWScursorsarrow_l.cur,C:WINDOWScursorshelp_l.cur,C:WINDOWScursorswait_l.cur,C:WINDOWScursorsbusy_l.cur,C:WINDOWScursorscross_l.cur,C:WINDOWScursorsbeam_l.cur,C:WINDOWScursorspen_l.cur,C:WINDOWScursorsno_l.cur,C:WINDOWScursorssize4_l.cur,C:WINDOWScursorssize3_l.cur,C:WINDOWScursorssize2_l.cur,C:WINDOWScursorssize1_l.cur,C:WINDOWScursorsmove_l.cur,C:WINDOWScursorsup_l.cur"
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionGrpConvMapGroups]
«300434@4K4″=»!B0=40@B=K53@K»

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicystandardprofileauthorizedapplicationslist]
«%windir%\system32\sessmgr.exe»=»%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»
«C:\Program Files\uTorrent\uTorrent.exe»=»C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:зTorrent»
«C:\Program Files\Bonjour\mDNSResponder.exe»=»C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour»
«C:\Program Files\QIP\qip.exe»=»C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager»
«C:\Program Files\iTunes\iTunes.exe»=»C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes»

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetservicessharedaccessparametersfirewallpolicydomainprofileauthorizedapplicationslist]
«%windir%\system32\sessmgr.exe»=»%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019»

Remaining Files :

File Backups: — C:SDFixbackupsbackups.zip

Files with Hidden Attributes :

Mon 13 Apr 2009 8 ..SHR — «C:Documents and SettingsAll UsersApplication Data2AF91488C3.sys»
Mon 13 Apr 2009 2,516 A.SH. — «C:Documents and SettingsAll UsersApplication DataKGyGaAvL.sys»
Tue 23 Oct 2007 3,350,528 A..H. — «C:Documents and SettingsTom JoadApplication DataU3tempLaunchpad Removal.exe»

Finished!

ничего не помагает.Жду советов…

[Admin]

Здравствуйте, добро пожаловать на Spyware-ru форум.

Скачайте программу Combofix. Закройте все открытые окна и запустите эту программу.
После выполнения будет создан лог файл, пожалуйста вставьте его в ваш ответ.

Примечание: перед использованием Combofix обязательно установите Recovery console. Как это сделать будет описано на странице, ссылку на которую я привёл выше.

[Автор]

Сообщения