Выполните в АВЗ:
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
TerminateProcessByName('c:\docume~1\admin\applic~1\umxsys32.exe');
TerminateProcessByName('c:\windows\jodriv~1.exe');
TerminateProcessByName('c:\documents and settings\admin\application data\e8.tmp');
TerminateProcessByName('c:\documents and settings\admin\application data\e7.tmp');
TerminateProcessByName('c:\docume~1\admin\locals~1\temp\3582-490\dadvmg~1.exe');
TerminateProcessByName('c:\docume~1\admin\applic~1\addoon32.exe');
QuarantineFile('C:\WINDOWS\svchost.com','');
QuarantineFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost0.com','');
QuarantineFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost.com','');
QuarantineFile('C:\WINDOWS\system32\c9mgr.exe','');
QuarantineFile('C:\WINDOWS\jodrive32.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1413\syitm.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Мои документы\SkyMonk.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\igfxtray.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\umxsys32.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\dadvmgr32.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\addoon32.exe','');
QuarantineFile('C:\Documents and Settings\Admin\Application Data\Fhqeqj.exe','');
QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\3582-490\PRAETO~1.EXE','');
QuarantineFile('c:\docume~1\admin\applic~1\umxsys32.exe','');
QuarantineFile('c:\windows\jodriv~1.exe','');
QuarantineFile('c:\documents and settings\admin\application data\e8.tmp','');
QuarantineFile('c:\documents and settings\admin\application data\e7.tmp','');
QuarantineFile('c:\docume~1\admin\locals~1\temp\3582-490\dadvmg~1.exe','');
QuarantineFile('c:\docume~1\admin\applic~1\addoon32.exe','');
QuarantineFile('C:\WINDOWS\csfvo.exe','');
QuarantineFile('C:\WINDOWS\ukcns.exe','');
QuarantineFile('C:\WINDOWS\dosno.exe','');
DeleteFile('c:\docume~1\admin\applic~1\addoon32.exe');
DeleteFile('c:\docume~1\admin\locals~1\temp\3582-490\dadvmg~1.exe');
DeleteFile('c:\documents and settings\admin\application data\e7.tmp');
DeleteFile('c:\documents and settings\admin\application data\e8.tmp');
DeleteFile('c:\windows\jodriv~1.exe');
DeleteFile('c:\docume~1\admin\applic~1\umxsys32.exe');
DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\3582-490\PRAETO~1.EXE');
DeleteFile('C:\Documents and Settings\Admin\Application Data\Fhqeqj.exe');
DeleteFile('C:\Documents and Settings\Admin\Application Data\addoon32.exe');
DeleteFile('C:\Documents and Settings\Admin\Application Data\dadvmgr32.exe');
DeleteFile('C:\Documents and Settings\Admin\Application Data\umxsys32.exe');
DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\igfxtray.exe');
DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1413\syitm.exe');
DeleteFile('C:\WINDOWS\jodrive32.exe');
DeleteFile('C:\WINDOWS\system32\c9mgr.exe');
DeleteFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost.com');
DeleteFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost0.com');
DeleteFile('C:\WINDOWS\svchost.com');
DeleteFile('C:\WINDOWS\csfvo.exe');
DeleteFile('C:\WINDOWS\ukcns.exe');
DeleteFile('C:\WINDOWS\dosno.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Praetorian');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Fhqeqj');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','adonpdf');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dadv');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','umx0');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Tnaww');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Config Setup');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Config Setup');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','c9mgr');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows NT\CurrentVersion\Winlogon', 'Taskman');
DeleteFileMask('C:\Documents and Settings\Admin\Application Data','*.tmp',false);
DeleteFileMask('C:\WINDOWS','*.tmp',false);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
Компьютер перезагрузится
После перезагрузки:
- Выполните в АВЗ:
Код:
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
Файл quarantine.zip из папки AVZ загрузите через форму. Укажите ссылку на тему и ник на форуме.
Это Ваше? C:\Documents and Settings\Admin\Мои документы\SkyMonk.exe
Восстановите ассоциацию EXE файлов (скачайте и запустите)
Повторите логи.
Скачайте Malwarebytes' Anti-Malware или с зеркала, установите, обновите базы, выберите " Полное сканирование", нажмите " Сканирование", после сканирования - Ok - " Показать результаты" - Откройте лог и скопируйте в блокнот и прикрепите его к следующему посту.
|
