Вирус зашифровал файлы(.ctbl)

[ats119]

Один из зараженных файлов http://www.fayloobmennik.net/3943044

[Info_bot]

Уважаемый(ая) ats119, спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[thyrex]

Выполните скрипт в AVZ

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\WINDOWS\Temp\evthjtk.exe','');
 QuarantineFile('C:\WINDOWS\lucoms.exe','');
 QuarantineFile('C:\WINDOWS\launch.exe','');
 QuarantineFile('C:\WINDOWS\jucheck.exe','');
 QuarantineFile('C:\WINDOWS\Temp\unpack.exe','');
 QuarantineFile('C:\WINDOWS\Temp\run.exe','');
 QuarantineFile('C:\WINDOWS\Temp\lucoms.exe','');
 QuarantineFile('C:\WINDOWS\Temp\jucheck.exe','');
 QuarantineFile('C:\WINDOWS\Temp\iexplore.exe','');
 QuarantineFile('C:\WINDOWS\Temp\convert.exe','');
 QuarantineFile('C:\WINDOWS\Temp\agent.exe','');
 QuarantineFile('C:\WINDOWS\Temp\019d3426.exe','');
 QuarantineFile('C:\Program Files\Realtek\InstallShield\qttask.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\Office12\wisptis.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\Office12\unpack.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\Office12\run.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\Office12\hkcr.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\MEDIA\OFFICE12\AUTOSHAP\defwatch.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\MEDIA\OFFICE12\1049\nvxdsync.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\MEDIA\OFFICE12\1049\lucoms.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1049\jucheck.exe','');
 QuarantineFile('C:\Program Files\Microsoft Office\Document Themes 12\Theme Effects\upgrade.exe','');
 QuarantineFile('C:\Program Files\Java\jre7\bin\wisptis.exe','');
 QuarantineFile('C:\Program Files\Java\jre7\bin\winlogon.exe','');
 QuarantineFile('C:\Program Files\Java\jre7\bin\jucheck.exe','');
 QuarantineFile('C:\Program Files\Java\jre7\bin\hkcr.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\zi\Africa\convert.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\run.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\unpack.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\lucoms.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jucheck.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\iexplore.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\agent.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\wisptis.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\jucheck.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\hkcr.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\chrome\content\play.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\bin\lucoms.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\bin\launch.exe','');
 QuarantineFile('C:\Program Files\Java\jre6\bin\hkcr.exe','');
 QuarantineFile('C:\Program Files\Common Files\Microsoft Shared\OFFICE12\unpack.exe','');
 QuarantineFile('C:\Program Files\Ahead\batch.exe','');
 QuarantineFile('C:\Program Files\Ahead\Nero\naprdmgr.exe','');
 QuarantineFile('C:\Program Files\Ahead\ImageDrive\launch.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\jucheck.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\file.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Scripts\winlogon.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Scripts\file.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Scripts\avguard.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\zcfgsvc.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\wisptis.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\winlogon.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\unpack.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\point32.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\jucheck.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\Process Duotones\avguard.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\PANTONE(R) Duotones\zcfgsvc.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\Gray-Black Duotones\jucheck.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Black and White\unpack.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Black and White\mscorsvw.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Actions\run.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-Ins\Automate\winlogon.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-Ins\ADM\taskman.exe','');
 QuarantineFile('C:\Program Files\AIMP2\Encoders\avguard.exe','');
 QuarantineFile('C:\Program Files\AIMP2\unpack.exe','');
 QuarantineFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-Ins\3D Engines\winlogon.exe','');
 QuarantineFile('C:\Program Files\AIMP2\winlogon.exe','');
 QuarantineFile('C:\Documents\freegames197@BestOffers\chrome\content\lucoms.exe','');
 QuarantineFile('C:\Documents and Settings\User\init.exe','');
 QuarantineFile('C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\msugrzos.scr','');
 DeleteFile('C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\msugrzos.scr','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','10538');
 DeleteFile('C:\Documents and Settings\User\init.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SessionInit');
 DeleteFile('C:\Program Files\AIMP2\winlogon.exe','32');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-Ins\3D Engines\winlogon.exe','32');
 DeleteFile('C:\Program Files\AIMP2\unpack.exe','32');
 DeleteFile('C:\Program Files\AIMP2\Encoders\avguard.exe','32');
 DeleteFile('C:\Documents\freegames197@BestOffers\chrome\content\lucoms.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TimeVerifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TimeSaver');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TrayVerifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','IconChecker');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','IconInformer');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-Ins\ADM\taskman.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FolderVerifyer');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Plug-Ins\Automate\winlogon.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NetworkNotifyer');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Actions\run.exe','32');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Black and White\mscorsvw.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','IconSaver');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DesktopSaver');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Black and White\unpack.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DatabaseChecker');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\Gray-Black Duotones\jucheck.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CrashReportNotifyer');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\PANTONE(R) Duotones\zcfgsvc.exe','32');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\Process Duotones\avguard.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TrayNotifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DesktopChecker');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\jucheck.exe','32');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Duotones\Duotones\point32.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DatabaseVerifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MediaChecker');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\unpack.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MediaSaver');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\winlogon.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DatabaseNotifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CrashReportSaver');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Repousse\zcfgsvc.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DesktopNotifyer');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Scripts\avguard.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TimeUpdater');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Scripts\file.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DesktopVerifyer');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\Presets\Scripts\winlogon.exe','32');
 DeleteFile('C:\Program Files\Adobe\Adobe Photoshop CS5\file.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DesktopUpdater');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NetworkUpdater');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CrashReportVerifyer');
 DeleteFile('C:\Program Files\Ahead\ImageDrive\launch.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TraySaver');
 DeleteFile('C:\Program Files\Ahead\Nero\naprdmgr.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NetworkInformer');
 DeleteFile('C:\Program Files\Ahead\batch.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DesktopInformer');
 DeleteFile('C:\Program Files\Common Files\Microsoft Shared\OFFICE12\unpack.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MediaInformer');
 DeleteFile('C:\Program Files\Java\jre6\bin\hkcr.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NetworkVerifyer');
 DeleteFile('C:\Program Files\Java\jre6\bin\launch.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TimeChecker');
 DeleteFile('C:\Program Files\Java\jre6\bin\lucoms.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConnectionUpdater');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\chrome\content\play.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','IconVerifyer');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\hkcr.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FolderNotifyer');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\jucheck.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NetworkSaver');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ff\wisptis.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FolderInformer');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\agent.exe','32');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\iexplore.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConnectionVerifyer');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jucheck.exe','32');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\lucoms.exe','32');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\ie\unpack.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MediaUpdater');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','VideoInformer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','VideoUpdater');
 DeleteFile('C:\Program Files\Java\jre6\lib\deploy\jqs\run.exe','32');
 DeleteFile('C:\Program Files\Java\jre6\lib\zi\Africa\convert.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FolderChecker');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DatabaseSaver');
 DeleteFile('C:\Program Files\Java\jre7\bin\hkcr.exe','32');
 DeleteFile('C:\Program Files\Java\jre7\bin\jucheck.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MediaNotifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','VideoVerifyer');
 DeleteFile('C:\Program Files\Java\jre7\bin\winlogon.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConnectionNotifyer');
 DeleteFile('C:\Program Files\Java\jre7\bin\wisptis.exe','32');
 DeleteFile('C:\Program Files\Microsoft Office\Document Themes 12\Theme Effects\upgrade.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TimeNotifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FolderSaver');
 DeleteFile('C:\Program Files\Microsoft Office\MEDIA\OFFICE12\1049\lucoms.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DatabaseUpdater');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TrayUpdater');
 DeleteFile('C:\Program Files\Microsoft Office\MEDIA\OFFICE12\1049\nvxdsync.exe','32');
 DeleteFile('C:\Program Files\Microsoft Office\MEDIA\OFFICE12\AUTOSHAP\defwatch.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TrayInformer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TrayChecker');
 DeleteFile('C:\Program Files\Microsoft Office\Office12\hkcr.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FolderUpdater');
 DeleteFile('C:\Program Files\Microsoft Office\Office12\run.exe','32');
 DeleteFile('C:\Program Files\Microsoft Office\Office12\unpack.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MediaVerifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConnectionSaver');
 DeleteFile('C:\Program Files\Microsoft Office\Office12\wisptis.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NetworkChecker');
 DeleteFile('C:\Program Files\Realtek\InstallShield\qttask.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CrashReportInformer');
 DeleteFile('C:\WINDOWS\Temp\019d3426.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','IconUpdater');
 DeleteFile('C:\WINDOWS\Temp\agent.exe','32');
 DeleteFile('C:\WINDOWS\Temp\convert.exe','32');
 DeleteFile('C:\WINDOWS\Temp\iexplore.exe','32');
 DeleteFile('C:\WINDOWS\Temp\jucheck.exe','32');
 DeleteFile('C:\WINDOWS\Temp\lucoms.exe','32');
 DeleteFile('C:\WINDOWS\Temp\run.exe','32');
 DeleteFile('C:\WINDOWS\Temp\unpack.exe','32');
 DeleteFile('C:\WINDOWS\jucheck.exe','32');
 DeleteFile('C:\WINDOWS\lucoms.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','TimeInformer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','VideoChecker');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','VideoNotifyer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CrashReportChecker');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConnectionChecker');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DatabaseInformer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','ConnectionInformer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','VideoSaver');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','TimeInformer');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','CrashReportUpdater');
 DeleteFile('C:\WINDOWS\Temp\evthjtk.exe','32');
 DeleteFile('C:\WINDOWS\Tasks\xeluonl.job','32');
 BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Компьютер перезагрузится.

Пришлите карантин согласно Приложения 2 правил по красной ссылке Прислать запрошенный карантин вверху темы

Сделайте новые логи



Сделайте лог полного сканирования МВАМ