[zirreX]

Скопируйте текст ниже в блокнот и сохраните как файл с названием CFScript.txt на рабочий стол.

Код:

KillAll::


File::
c:\windows\system32\a6d5cc4f.exe
c:\windows\system32\ewmkwci.exe

Driver::

Folder::

Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\persistentroutes]
"75.125.82.0,255.255.255.0,95.53.178.37,1"=-
"78.108.86.0,255.255.255.0,95.53.178.37,1"=-
"78.137.164.0,255.255.255.0,95.53.178.37,1"=-
"78.47.87.0,255.255.255.0,95.53.178.37,1"=-
"79.125.5.0,255.255.255.0,95.53.178.37,1"=-
"80.153.193.0,255.255.255.0,95.53.178.37,1"=-
"80.190.130.0,255.255.255.0,95.53.178.37,1"=-
"80.190.154.0,255.255.255.0,95.53.178.37,1"=-
"80.237.132.0,255.255.255.0,95.53.178.37,1"=-
"80.86.107.0,255.255.255.0,95.53.178.37,1"=-
"81.176.66.0,255.255.255.0,95.53.178.37,1"=-
"81.177.31.0,255.255.255.0,95.53.178.37,1"=-
"81.24.35.0,255.255.255.0,95.53.178.37,1"=-
"82.117.238.0,255.255.255.0,95.53.178.37,1"=-
"82.151.107.0,255.255.255.0,95.53.178.37,1"=-
"82.165.103.0,255.255.255.0,95.53.178.37,1"=-
"82.98.86.0,255.255.255.0,95.53.178.37,1"=-
"83.202.175.0,255.255.255.0,95.53.178.37,1"=-
"83.222.23.0,255.255.255.0,95.53.178.37,1"=-
"83.222.31.0,255.255.255.0,95.53.178.37,1"=-
"83.223.117.0,255.255.255.0,95.53.178.37,1"=-
"84.40.30.0,255.255.255.0,95.53.178.37,1"=-
"85.12.57.0,255.255.255.0,95.53.178.37,1"=-
"85.17.210.0,255.255.255.0,95.53.178.37,1"=-
"85.214.106.0,255.255.255.0,95.53.178.37,1"=-
"85.255.19.0,255.255.255.0,95.53.178.37,1"=-
"85.31.222.0,255.255.255.0,95.53.178.37,1"=-
"87.106.242.0,255.255.255.0,95.53.178.37,1"=-
"87.106.254.0,255.255.255.0,95.53.178.37,1"=-
"87.230.79.0,255.255.255.0,95.53.178.37,1"=-
"87.238.48.0,255.255.255.0,95.53.178.37,1"=-
"87.242.72.0,255.255.255.0,95.53.178.37,1"=-
"87.242.74.0,255.255.255.0,95.53.178.37,1"=-
"87.242.79.0,255.255.255.0,95.53.178.37,1"=-
"88.221.119.0,255.255.255.0,95.53.178.37,1"=-
"89.108.66.0,255.255.255.0,95.53.178.37,1"=-
"89.111.176.0,255.255.255.0,95.53.178.37,1"=-
"89.202.149.0,255.255.255.0,95.53.178.37,1"=-
"89.202.157.0,255.255.255.0,95.53.178.37,1"=-
"90.156.159.0,255.255.255.0,95.53.178.37,1"=-
"90.183.101.0,255.255.255.0,95.53.178.37,1"=-
"91.121.97.0,255.255.255.0,95.53.178.37,1"=-
"91.199.212.0,255.255.255.0,95.53.178.37,1"=-
"91.209.196.0,255.255.255.0,95.53.178.37,1"=-
"92.123.155.0,255.255.255.0,95.53.178.37,1"=-
"92.53.106.0,255.255.255.0,95.53.178.37,1"=-
"93.184.71.0,255.255.255.0,95.53.178.37,1"=-
"93.191.13.0,255.255.255.0,95.53.178.37,1"=-
"94.23.206.0,255.255.255.0,95.53.178.37,1"=-
"94.236.0.0,255.255.255.0,95.53.178.37,1"=-
"95.140.225.0,255.255.255.0,95.53.178.37,1"=-
"74.55.74.0,255.255.255.0,95.53.178.37,1"=-
"75.125.185.0,255.255.255.0,95.53.178.37,1"=-
"174.120.186.0,255.255.255.0,95.53.178.37,1"=-
"208.43.71.0,255.255.255.0,95.53.178.37,1"=-
"74.53.70.0,255.255.255.0,95.53.178.37,1"=-
"74.86.232.0,255.255.255.0,95.53.178.37,1"=-
"74.54.139.0,255.255.255.0,95.53.178.37,1"=-
"174.133.38.0,255.255.255.0,95.53.178.37,1"=-
"174.120.185.0,255.255.255.0,95.53.178.37,1"=-
"174.120.184.0,255.255.255.0,95.53.178.37,1"=-
"74.54.130.0,255.255.255.0,95.53.178.37,1"=-
"74.54.46.0,255.255.255.0,95.53.178.37,1"=-
"75.125.189.0,255.255.255.0,95.53.178.37,1"=-
"75.125.43.0,255.255.255.0,95.53.178.37,1"=-
"74.86.125.0,255.255.255.0,95.53.178.37,1"=-
"75.125.212.0,255.255.255.0,95.53.178.37,1"=-
"207.44.254.0,255.255.255.0,95.53.178.37,1"=-
"83.102.130.0,255.255.255.0,95.53.178.37,1"=-
"87.242.75.0,255.255.255.0,95.53.178.37,1"=-
"81.176.67.0,255.255.255.0,95.53.178.37,1"=-
"212.59.118.0,255.255.255.0,95.53.178.37,1"=-
"188.40.74.0,255.255.255.0,95.53.178.37,1"=-
"208.43.44.0,255.255.255.0,95.53.178.37,1"=-
"62.67.184.0,255.255.255.0,95.53.178.37,1"=-
"74.55.143.0,255.255.255.0,95.53.178.37,1"=-
"195.222.17.0,255.255.255.0,95.53.178.37,1"=-
"81.176.230.0,255.255.255.0,95.53.178.37,1"=-
"194.67.52.0,255.255.255.0,95.53.178.37,1"=-
"184.84.67.0,255.255.255.0,95.53.178.37,1"=-
"80.239.197.0,255.255.255.0,95.53.178.37,1"=-
"74.125.77.0,255.255.255.0,95.53.178.37,1"=-
"38.117.98.0,255.255.255.0,95.53.178.37,1"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17472:TCP"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"

FileLook::

DirLook::


FCopy::

После сохранения переместите CFScript.txt на пиктограмму ComboFix.exe.

Когда сохранится новый отчет ComboFix, запакуйте ComboFix.txt и прикрепите к сообщению.

Запакуйте пожалуйста папку C:\Qoobox\Quarantine\ с паролем virus и отправьте на quarantine@virusnet.info, в названии темы укажите – "Проверка карантина". В теле сообщения укажите адрес своей темы на форуме. Результаты ответа сообщите здесь, в теме.



Скачайте Malwarebytes' Anti-Malware или с зеркала, установите, обновите базы, выберите "Perform Full Scan", нажмите "Scan", после сканирования - Ok - Show Results (показать результаты) - Откройте лог и скопируйте в блокнот и прикрепите его к следующему посту.