[Techno88]

Выполните в АВЗ:

Код:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 ClearQuarantine;
 TerminateProcessByName('c:\docume~1\admin\applic~1\umxsys32.exe');
 TerminateProcessByName('c:\windows\jodriv~1.exe');
 TerminateProcessByName('c:\documents and settings\admin\application data\e8.tmp');
 TerminateProcessByName('c:\documents and settings\admin\application data\e7.tmp');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\3582-490\dadvmg~1.exe');
 TerminateProcessByName('c:\docume~1\admin\applic~1\addoon32.exe');
 QuarantineFile('C:\WINDOWS\svchost.com','');
 QuarantineFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost0.com','');
 QuarantineFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost.com','');
 QuarantineFile('C:\WINDOWS\system32\c9mgr.exe','');
 QuarantineFile('C:\WINDOWS\jodrive32.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1413\syitm.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Мои документы\SkyMonk.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\igfxtray.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\umxsys32.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\dadvmgr32.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\addoon32.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Fhqeqj.exe','');
 QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\3582-490\PRAETO~1.EXE','');
 QuarantineFile('c:\docume~1\admin\applic~1\umxsys32.exe','');
 QuarantineFile('c:\windows\jodriv~1.exe','');
 QuarantineFile('c:\documents and settings\admin\application data\e8.tmp','');
 QuarantineFile('c:\documents and settings\admin\application data\e7.tmp','');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\3582-490\dadvmg~1.exe','');
 QuarantineFile('c:\docume~1\admin\applic~1\addoon32.exe','');
 QuarantineFile('C:\WINDOWS\csfvo.exe','');
 QuarantineFile('C:\WINDOWS\ukcns.exe','');
 QuarantineFile('C:\WINDOWS\dosno.exe','');
 DeleteFile('c:\docume~1\admin\applic~1\addoon32.exe');
 DeleteFile('c:\docume~1\admin\locals~1\temp\3582-490\dadvmg~1.exe');
 DeleteFile('c:\documents and settings\admin\application data\e7.tmp');
 DeleteFile('c:\documents and settings\admin\application data\e8.tmp');
 DeleteFile('c:\windows\jodriv~1.exe');
 DeleteFile('c:\docume~1\admin\applic~1\umxsys32.exe');
 DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\3582-490\PRAETO~1.EXE');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Fhqeqj.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\addoon32.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\dadvmgr32.exe');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\umxsys32.exe');
 DeleteFile('C:\Documents and Settings\Admin\Главное меню\Программы\Автозагрузка\igfxtray.exe');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1413\syitm.exe');
 DeleteFile('C:\WINDOWS\jodrive32.exe');
 DeleteFile('C:\WINDOWS\system32\c9mgr.exe');
 DeleteFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost.com');
 DeleteFile('C:\Documents and Settings\Admin\DoctorWeb\Quarantine\svchost0.com');
 DeleteFile('C:\WINDOWS\svchost.com');
 DeleteFile('C:\WINDOWS\csfvo.exe');
 DeleteFile('C:\WINDOWS\ukcns.exe');
 DeleteFile('C:\WINDOWS\dosno.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Praetorian');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Fhqeqj');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','adonpdf');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dadv');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','umx0');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Tnaww');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Config Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Config Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','c9mgr');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows NT\CurrentVersion\Winlogon', 'Taskman');
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data','*.tmp',false);
 DeleteFileMask('C:\WINDOWS','*.tmp',false);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Компьютер перезагрузится

После перезагрузки:
- Выполните в АВЗ:

Код:

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
end.

Файл quarantine.zip из папки AVZ загрузите через форму. Укажите ссылку на тему и ник на форуме.

Это Ваше? C:\Documents and Settings\Admin\Мои документы\SkyMonk.exe

Восстановите ассоциацию EXE файлов (скачайте и запустите)

Повторите логи.

Скачайте Malwarebytes' Anti-Malware или с зеркала, установите, обновите базы, выберите "Полное сканирование", нажмите "Сканирование", после сканирования - Ok - "Показать результаты" - Откройте лог и скопируйте в блокнот и прикрепите его к следующему посту.