winsock.exe

[zdoro]

Здравейте!

С Win98 SE съм. Преди време NAV 2003 Pro откри троянски кон, но след като го премахна (може би), започнаха да се появяват при всяко стартиране на компютъра следните съобщения:







Дайте съвет какво да правя! Благодаря!

[BAD_BOBIK]

Ми редактирай си горепосочения файл т.е. в съобщение 2 .Където намериш името му триеш .



Ееееееееееее остави двата реда празни т.е. триеш всичко след = )

Ако пак мрънка влизаш в регистрите и от там го затриваш ама ме съмнява, че е стигнал до там.

[zdoro]

В момента е изтрит. win.ini файла започваше така:



[windows]

load=C:\WINDOWS\SYSTEM\winsock.exe

run=C:\WINDOWS\SYSTEM\winsock.exe

и т.н.



сега, след като изтрих "winsock.exe", излиза същото съобщение, ама вече търси

"SYSTEM"

[Malone]

BAD_BOBIK ти го е написал, ама ти не четеш ...

[]

Триеш всичко след =, не само winsock.exe



За другото ...

Ще ти го пусна тук направо както го чета.

Много ми се спи вече и не ми се превежда.

Мисля, че се справиш и сам.



1. Open Windows Task Manager.

On Windows 9x/ME systems, press

CTRL+ALT+DELETE

On Windows NT/2000/XP systems, press

CTRL+SHIFT+ESC, and click the Processes tab.

2. In the list of running programs*, locate the process:

3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your system.

4. To check if the malware process has been terminated, close Task Manager, and then open it again.

5. Close Task Manager.



Removing Autostart Entries from System Files



Malware autostart entries in system files must be removed before the system can be restarted safely. You will need the name(s) of the file(s) detected earlier.



1. Open System Configuration Editor. To do this, click Start>Run, type SYSEDIT, then press Enter.

2. Select the WIN.INI window.

3.

4. Under the [windows] section, locate the lines that begin with:

load =

run =

5. From the same lines, delete the malware path and filename:

%Windows%\winsock.exe

%Windows%\winsock.exe

6. In System Configuration Editor, select the SYSTEM.INI window.

7. Under the [windows] section, locate the lines that begin with:

Load

8. From the same lines, delete the malware path and filename:

%Windows%\winsock.exe

9. Close System Configuration Editor and click Yes when prompted to save.



Removing Autostart Entries from the Registry



Removing autostart entries from the registry prevents the malware from executing during startup.



1. Open Registry Editor. To do this, click Start>Run, type REGEDIT, then press Enter.

2. In the left panel, double-click the following:

HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>CurrentVersion>Run

3. In the right panel, locate and delete the entry:

winsock.exe = "%Windows%\winsock.exe"

%Windows% refers to the Windows directory, usually C:\Windows or C:\WinNT.

4. In the left panel, double-click the following:

HKEY_LOCAL_MACHINE>Software>Microsoft>

Windows>CurrentVersion>RunOnce

5. In the right panel, locate and delete the entry:

winsock.exe = "%windows%\winsock.exe"

6. In the left panel, double-click the following:

HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>

CurrentVersion>RunServices

7. In the right panel, locate and delete the entry:

winsock.exe = "%Windows%\winsock.exe"

8. In the left panel, double-click the following:

HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>

CurrentVersion>RunServicesOnce

9. In the right panel, locate and delete the entry:

winsock.exe = "%Windows%\winsock.exe"

10. Close Registry Editor.



Deleting Malware Files



Delete the following files dropped by the malware:



* C:\AUTORUN.INF

* %Windows%\WINSOCK.EXE

* %System%\RUNEXEC.DLL

[zdoro]

Благодаря ви! Сега вече стана работата.