Virus mi kopira svhost.exe

Pozz!

Imam problem koji poceo zivcirati.

Nakon svakog restarta pojavljuje mi se error(slika 1),pritiskom na Continue ili Quit,on nestaje i sve radi ok,samo sto mi je net pomalo usporen.

Ping test je ok,ali duze traje ocitavanje nekih stranica.

Takoder nakon pokretanja mozzile dobivam obavezno ovo upozorenje(slika 2),nakon toga sve opet radi ok,sve do sljedeceg restarta.

Detalji errora:

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.IO.IOException: The file 'C:\Users\xxxxx\AppData\Local\Temp\svchost.exe' already exists.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite)
   at BD.Form1.AddToAutorun(String Path)
   at BD.Form1.Form1_Load(Object sender, EventArgs e)
   at System.EventHandler.Invoke(Object sender, EventArgs e)
   at System.Windows.Forms.Form.OnLoad(EventArgs e)
   at System.Windows.Forms.Form.OnCreateControl()
   at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)
   at System.Windows.Forms.Control.CreateControl()
   at System.Windows.Forms.Control.WmShowWindow(Message& m)
   at System.Windows.Forms.Control.WndProc(Message& m)
   at System.Windows.Forms.ScrollableControl.WndProc(Message& m)
   at System.Windows.Forms.ContainerControl.WndProc(Message& m)
   at System.Windows.Forms.Form.WmShowWindow(Message& m)
   at System.Windows.Forms.Form.WndProc(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
   at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Loaded Assemblies **************
mscorlib
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4952 (win7RTMGDR.050727-4900)
    CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v2.0.50727/mscorlib.dll
----------------------------------------
BD
    Assembly Version: 1.0.0.0
    Win32 Version: 1.0.0.0
    CodeBase: file:///C:/Users/xxxx/AppData/Local/Temp/svchost.exe
----------------------------------------
Microsoft.VisualBasic
    Assembly Version: 8.0.0.0
    Win32 Version: 8.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Microsoft.VisualBasic/8.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll
----------------------------------------
System
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
----------------------------------------
System.Windows.Forms
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
----------------------------------------
System.Drawing
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
----------------------------------------
System.Runtime.Remoting
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Runtime.Remoting/2.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll
----------------------------------------
System.Configuration
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
----------------------------------------
System.Xml
    Assembly Version: 2.0.0.0
    Win32 Version: 2.0.50727.4927 (NetFXspW7.050727-4900)
    CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll
----------------------------------------

************** JIT Debugging **************
To enable just-in-time (JIT) debugging, the .config file for this
application or computer (machine.config) must have the
jitDebugging value set in the system.windows.forms section.
The application must also be compiled with debugging
enabled.

For example:

<configuration>
    <system.windows.forms jitDebugging="true" />
</configuration>

When JIT debugging is enabled, any unhandled exception
will be sent to the JIT debugger registered on the computer
rather than be handled by this dialog box.


Sve se pocelo desavati kada sam deinstalirao AVG i instalirao Aviru.

Upravo jesam,isti problem!

prije bih pitao koji os koristis, jer mi se nekako cini da net framework nema dozvolu write na scvhost...

znas sam sto sam mislio, xp ili w7, nepotrebno cjepidlacenje

edit: bolje pokusaj pomoc covjeku nego da ispravljas moje ocito dvosmislene postove, srecom pa nisu ljudi pomislili da mislim da koristi android il nest slicno

Najvjerojatnije nije obrisala mape nego exe datoteke koje su nazvane isto kao mape. Npr mapa Slike i virus napravi Slike.exe s ikonom foldera, a stvarnu mapu Slike napravi skrivenom (hidden). On onda otvara tu mapu (.exe se ne vidi ako je uključeno sakrivanje ekstenzija). Tako da mape najvjerojatnije nisu obrisane nego sakrivene.

System.IO.IOException: The file 'C:\Users\xxxxx\AppData\Local\Temp\svchost.exe' already exists.

Po ovome si odmah mogao znati da je u pitanju virus jer nijedan legitiman program nema potrebe kopirati sistemsku datoteku svchost.exe u Temp.

Da virus je bio u pitanju.

Norton je nasao 2 komada(neka tamo),no ipak nije rijesio onaj pravi,koji pati me.

Odmah da kazem,ovo sto sam napravio,meni je pomoglo,ali nije pravilo da je ispravno i da tako treba raditi.Ja sam ionako vec davno preci na 64 bitnu verziju OS-a,tako da mi je bilo svejedno.

Sistem restore mi je vratio moje slike!

E ovako:

Pokrenuo sam TuneUp optimazaciju i TuneUp me je upozorio da mi proces bjvrhz trosi abnormalno mnogo memorije,tako da mi je komp usporen bla,bla,bla...

BJVRHZ???Mos mislit i to shupak bas u mapi sistem 32.

Probao ga izbrisati,onako ljut,no naravno shupak ne da mi!

U safe modu sam ga roknuo,te uz pomoc neta nasao u :HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services.

Sve je proradilo,osim Mozzile koju sam morao reinstalirati,tako da je i ona napokon proradila.

Kakav sam ja baksuz,sigurno sam izbrisao nesta vazno,no boli me kuhac sada radi!