[thyrex]

Выполните скрипт в AVZ

Код:

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
QuarantineFile('C:\Windows\System32\Drivers\SPTDDRV1.SYS','');
QuarantineFile('C:\Users\123\AppData\Local\Temp\init.exe','');
QuarantineFile('c:\users\123\appdata\local\temp\init.exe','');
QuarantineFile('C:\Windows\system32\mssrv32.exe','');
QuarantineFile('C:\Windows\system32\svshost.dll','');
QuarantineFile('C:\Users\123\AppData\Local\Temp\gAGP440p.sys','');
QuarantineFile('C:\Windows\system32\sdra64.exe','');
QuarantineFile('c:\windows\system32\twext.exe','');
QuarantineFile('c:\windows\system32\twex.exe','');
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
DeleteFile('c:\windows\system32\twex.exe');
DeleteFile('c:\windows\system32\twext.exe');
DeleteFile('C:\Windows\system32\sdra64.exe');
DeleteFile('C:\Users\123\AppData\Local\Temp\gAGP440p.sys');
DeleteFile('C:\Windows\system32\svshost.dll');
DeleteFile('C:\Windows\system32\mssrv32.exe');
DeleteFile('c:\users\123\appdata\local\temp\init.exe');
DeleteFile('C:\Users\123\AppData\Local\Temp\init.exe');
DeleteFile('C:\Windows\System32\Drivers\SPTDDRV1.SYS');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

quarantine.zip - отправьте на newvirus@kaspersky.com

Пофиксите в HiJackThis

Код:

F2 - REG:system.ini: UserInit=C:\Windows\system32\userinit.exe,C:\Users\123\AppData\Local\Temp\init.exe,C:\Windows\system32\sdra64.exe,C:\Windows\system32\twex.exe,C:\Windows\system32\twext.exe,