Отключите восстановление системы!
Выполните скрипт в AVZ
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\windows\dc.exe');
TerminateProcessByName('c:\windows\system\fun.exe');
TerminateProcessByName('c:\windows\system32\perfs.exe');
TerminateProcessByName('c:\windows\system32\smssv.exe');
TerminateProcessByName('c:\windows\sviq.exe');
TerminateProcessByName('c:\windows\system32\ubaacdb.exe');
SetServiceStart('wsefsea60', 4);
SetServiceStart('smssv.exe', 4);
QuarantineFile('C:\WINDOWS\system32\migpwd.exe','');
QuarantineFile('C:\WINDOWS\system\0.exe','');
QuarantineFile('C:\WINDOWS\System32\winsit.exe','');
QuarantineFile('C:\Documents and Settings\USER\Рабочий стол\сэд\Fun.exe','');
QuarantineFile('C:\Documents and Settings\All Users\Документы\Fun.exe','');
QuarantineFile('C:\WINDOWS\System32\nnnnLcCR.dll','');
QuarantineFile('C:\WINDOWS\system32\config\Win.exe','');
QuarantineFile('C:\WINDOWS\rundll32.exe','');
QuarantineFile('C:\WINDOWS\inf\Other.exe','');
QuarantineFile('C:\WINDOWS\System32\msmsgs.exe','');
QuarantineFile('C:\DOCUME~1\USER\taskmgr.exe','');
QuarantineFile('c:\windows\system32\hmyhzn.dll','');
QuarantineFile('C:\WINDOWS\System32\Wecuenscc.dll','');
QuarantineFile('C:\WINDOWS\TEMP\BClib\krnln.fne','');
QuarantineFile('C:\WINDOWS\TEMP\BClib\Exmlrpc.fne','');
QuarantineFile('C:\WINDOWS\TEMP\BClib\dp1.fne','');
QuarantineFile('c:\windows\system32\ubaacdb.exe','');
QuarantineFile('c:\windows\sviq.exe','');
QuarantineFile('c:\windows\system32\smssv.exe','');
QuarantineFile('c:\windows\system32\perfs.exe','');
QuarantineFile('c:\windows\system\fun.exe','');
QuarantineFile('c:\windows\dc.exe','');
DeleteFile('c:\windows\dc.exe');
DeleteFile('c:\windows\system\fun.exe');
DeleteFile('c:\windows\system32\perfs.exe');
DeleteFile('c:\windows\system32\smssv.exe');
DeleteFile('C:\WINDOWS\system32\migpwd.exe');
DeleteFile('c:\windows\sviq.exe');
DeleteFile('c:\windows\system32\ubaacdb.exe');
DeleteFile('C:\WINDOWS\TEMP\BClib\dp1.fne');
DeleteFile('C:\WINDOWS\TEMP\BClib\Exmlrpc.fne');
DeleteFile('C:\WINDOWS\TEMP\BClib\krnln.fne');
DeleteFile('C:\WINDOWS\System32\Wecuenscc.dll');
DeleteFile('c:\windows\system32\hmyhzn.dll');
DeleteFile('C:\DOCUME~1\USER\taskmgr.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331602.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0332584.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0332585.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0332587.EXE');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0332588.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0332597.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0332598.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1185\A0333582.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1185\A0333583.exe');
DeleteFile('C:\WINDOWS\System32\winsit.exe');
DeleteFile('C:\WINDOWS\system\0.exe');
DeleteFile('C:\WINDOWS\System32\msmsgs.exe');
DeleteFile('C:\WINDOWS\inf\Other.exe');
DeleteFile('C:\WINDOWS\rundll32.exe');
DeleteFile('C:\WINDOWS\system32\config\Win.exe');
DeleteFile('C:\Documents and Settings\All Users\Документы\Fun.exe');
DeleteFile('C:\Documents and Settings\USER\Рабочий стол\сэд\Fun.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328386.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328387.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328388.EXE');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328389.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328418.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328419.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328582.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328583.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328584.EXE');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328585.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328629.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1182\A0328630.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1183\A0330582.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1183\A0330583.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1183\A0330584.EXE');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1183\A0330585.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1183\A0330635.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1183\A0330636.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331587.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331588.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331589.EXE');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331590.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331594.exe');
DeleteFile('C:\System Volume Information\_restore{C2DE41E9-27C5-4B39-B0B4-1EF80298DEB5}\RP1184\A0331601.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Task');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Task');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Oftice');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Oftice');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Oftice');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Oftice');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dc');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Windows Driver');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Windows Driver');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Windows Driver');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Fun');
DeleteService('wsefsea60');
DeleteService('smssv.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(9);
RebootWindows(true);
end.
Компьютер перезагрузится.
Выполните скрипт в AVZ
Код:
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
quarantine.zip из папки AVZ отправьте через форму
http://support.kaspersky.ru/virlab/helpdesk.html. В строке "Подробное описание возникшей ситуации:", напишите пароль на архив "
virus"(без кавычек), в строке "Электронный адрес:" укажите свой электронный адрес. Полученный ответ сообщите здесь.
Сделайте новые логи
