Перед выполнением скрипта временно отключите защитное ПО (Outpost). Включите брандмауэр Windows
Выполните скрипт в AVZ
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
SetServiceStart('RSVPMSDTC', 4);
SetServiceStart('Microsoft Memory Driver', 4);
SetServiceStart('AudioSrvRpcLocator', 4);
QuarantineFile('C:\WINDOWS\system32\cabine.dll','');
QuarantineFile('WinCtrl32.dll','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Ekq85.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati0pvxx.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati0sxxx.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati1joxx.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati2puxx.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati5otxx.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati7joxx.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ati8joxx.sys','');
QuarantineFile('C:\WINDOWS\iedr.exe','');
QuarantineFile('srv.exe','');
QuarantineFile('C:\WINDOWS\system32\drivers\TDSSmaxt.sys','');
DeleteFile('C:\WINDOWS\system32\drivers\TDSSmaxt.sys');
DeleteFile('srv.exe');
DeleteFile('C:\WINDOWS\iedr.exe');
DeleteFile('C:\WINDOWS\System32\Drivers\ati8joxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ati7joxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ati5otxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ati2puxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ati1joxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ati0sxxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ati0pvxx.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Ekq85.sys');
DeleteFile('WinCtrl32.dll');
DeleteFile('C:\WINDOWS\system32\cabine.dll');
DeleteService('ati8joxx');
DeleteService('ati7joxx');
DeleteService('ati5otxx');
DeleteService('ati2puxx');
DeleteService('ati1joxx');
DeleteService('ati0sxxx');
DeleteService('ati0pvxx');
DeleteService('Ekq85');
DeleteService('RSVPMSDTC');
DeleteService('Microsoft Memory Driver');
DeleteService('AudioSrvRpcLocator');
DelWinlogonNotifyByKeyName('WinCtrl32');
DeleteFileMask('%Tmp%', '*.*', true);
BC_ImportDeletedList;
ExecuteSysClean;
BC_DeleteFile('C:\WINDOWS\system32\drivers\TDSSmaxt.sys');
BC_DeleteSvc('Ekq85');
BC_DeleteSvc('ati0pvxx');
BC_DeleteSvc('ati8joxx');
BC_DeleteSvc('ati7joxx');
BC_DeleteSvc('ati5otxx');
BC_DeleteSvc('ati2puxx');
BC_DeleteSvc('ati1joxx');
BC_DeleteSvc('ati0sxxx');
BC_DeleteSvc('RSVPMSDTC');
BC_DeleteSvc('Microsoft Memory Driver');
BC_DeleteSvc('AudioSrvRpcLocator');
BC_Activate;
ExecuteWizard('TSW', 1, 1, true);
ExecuteWizard('BT', 1, 1, true);
RebootWindows(true);
end.
Компьютер перезагрузится.
Выполнить скрипт в AVZ.
Код:
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
quarantine.zip из папки AVZ отправьте на
thyrex2002@tut.by. В теле письма укажите ссылку на тему
2. Пофиксить в HiJack
Код:
R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - (no file)
Повторите все логи
