Появилось в автостарте бяка !!!!!

Искал ключи для Каспера..... и нашел!

В автостарте вот такие бяки:

CPMd767ad6f Rundll32.exe "c:\windows\system32\veyekuke.dll",a
Wasomebalu Rundll32.exe "C:\WINDOWS\system32\sosazeri.dll",s

Kasper находит Trojan.Win32.Stuh.fcq

Но удалить не может

Что делать?

Пробую в абгезих.модусе,не могу убрать с аутостарта.

С помощью этой проги "Malwarebytes-Anti-Malware" вроде убрал паразитов.

Вот log. Может кому пригодится.

Цитата

alwarebytes' Anti-Malware 1.36
Datenbank Version: 1945
Windows 5.1.2600 Service Pack 3

14.05.2009 14:05:06
mbam-log-2009-05-14 (14-05-06).txt

Scan-Methode: Vollstдndiger Scan (C:\|D:\|E:\|)
Durchsuchte Objekte: 45483
Laufzeit: 8 minute(s), 18 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 4
Infizierte Registrierungsschlьssel: 6
Infizierte Registrierungswerte: 4
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7

Infizierte Speicherprozesse:
(Keine bцsartigen Objekte gefunden)

Infizierte Speichermodule:
C:\WINDOWS\system32\sibofuda.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\veyekuke.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sosazeri.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\muzupera.dll (Trojan.Vundo.H) -> Delete on reboot.

Infizierte Registrierungsschlьssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b0d0b4cf-9fe5-410d-829c-88381dcd9cf1} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b0d0b4cf-9fe5-410d-829c-88381dcd9cf1} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b0d0b4cf-9fe5-410d-829c-88381dcd9cf1} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{db893839-10f0-4af9-92fa-b23528f530af} (Dialer) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wasomebalu (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmd767ad6f (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\sibofuda.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\sibofuda.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\veyekuke.dll -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bцsartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system32\vuzasufa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\afusazuv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sosazeri.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\veyekuke.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\muzupera.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sibofuda.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Dokumente und Einstellungen\Wlad\Lokale Einstellungen\Temp\rasesnet.tmp (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Показать весь код