завелся Win32/Adware.Virtumonde и Win32/PrivacyRemover.M64

[SHAXTER]

всем добрый день, вобщем у меня ситуация многократно описанная, вместо картинки окно в котором про оба вируса, вместо скринсервера синий экран. Сделал сбор информации и прикрепил лог файл.

[pig]

Лучше, наверное, пока так.

[akok]

Скачайте Icesword
Запустите программу.
Внизу слева выберите меню File.
Появится аналог проводника. Найдите в нем файл руткита:
C:\WINDOWS\System32\drivers\Winub52.sys
C:\WINDOWS\system32\WinCtrl32.dll
Нажмите по нему правой кнопкой мыши и выберите force delete.
На запрос потверждения ответьте "да".
Перезагрузите компьютер.

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 QuarantineFile('c:\windows\system32\svchost.exe','');
 QuarantineFile('C:\WINDOWS\system32\MicrSoft.exe','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\tcpip.sys','');
 QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
 QuarantineFile('c:\windows\system32\avscan32.exe','');
 DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 DeleteFile('C:\WINDOWS\System32\drivers\Winub52.sys');
 DeleteFile('c:\windows\system32\avscan32.exe');
 DeleteFile('C:\WINDOWS\system32\blphceeoj0egca.scr');
 DeleteFile('C:\WINDOWS\system32\MicrSoft.exe');
 DeleteFile('WinCtrl32.dll');
 DeleteFile('avscan32.exe');
 DeleteService('xmlprovRasAutoHidServ');
 DeleteService('WudfSvcEventSystemWZCSVCMessengerRDSessMgr');
 DeleteService('WudfSvcEventSystemWZCSVCMessenger');
 DeleteService('srserviceAppMgmtlanmanworkstation');
 DeleteService('srserviceAppMgmt');
 DeleteService('SharedAccessHidServ');
 DeleteService('ScheduleRpcLocator');
 DeleteService('SamSshelpsvcTlntSvrShellHWDetection');
 DeleteService('RSVPTapiSrv');
 DeleteService('RpcLocatorSharedAccess');
 DeleteService('RasManMessengersrserviceDhcpNetlogon');
 DeleteService('RasAutoHidServMessengersrservice');
 DeleteService('RasAutoHidServ');
 DeleteService('ProtectedStoragewscsvc');
 DeleteService('PlugPlayTrkWks');
 DeleteService('NWCWorkstationhelpsvc');
 DeleteService('NtmsSvcMDMRpcSs');
 DeleteService('NtmsSvcMDM');
 DeleteService('NlaHidServ');
 DeleteService('NetmanMDMaspnet_state');
 DeleteService('NetlogonsrserviceAppMgmtlanmanworkstation');
 DeleteService('Netlogonhpqwmiex');
 DeleteService('MSIServerPolicyAgent');
 DeleteService('mnmsrvcVSS');
 DeleteService('mnmsrvcose');
 DeleteService('mnmsrvcodserv');
 DeleteService('MessengersrserviceUPSWebClientMSDTC');
 DeleteService('MessengersrserviceUPS');
 DeleteService('MessengersrserviceSharedAccess');
 DeleteService('MessengersrserviceDhcpNetlogon');
 DeleteService('MessengersrserviceDhcp');
 DeleteService('Messengersrservice');
 DeleteService('MDMaspnet_stateEventlog');
 DeleteService('MDMaspnet_state');
 DeleteService('lanmanserverRSVP');
 DeleteService('HTTPFilterBITS');
 DeleteService('helpsvcTlntSvrShellHWDetection');
 DeleteService('helpsvcdmadmin');
 DeleteService('EventSystemWZCSVCMessenger');
 DeleteService('EventSystemWZCSVC');
 DeleteService('EventSystemwinmgmt');
 DeleteService('EventSystemTlntSvr');
 DeleteService('EventSystemShellHWDetectionwinmgmtDcomLaunchRasManMessengersrserviceDhcpNetlogon');
 DeleteService('EventSystemShellHWDetectionwinmgmt');
 DeleteService('EventSystemShellHWDetection');
 DeleteService('EventSystemCryptSvc');
 DeleteService('Eventlogseclogon');
 DeleteService('DcomLaunchRasManMessengersrserviceDhcpNetlogon');
 DeleteService('clr_optimization_v2.0.50727_32Themes');
 DeleteService('aspnet_stateWMPNetworkSvc');
 DeleteService('WudfSvcEventSystemWZCSVC');
 DeleteService('WmiHidServ');
 DeleteService('WebClientMSDTC');
 DeleteService('W32TimeEventlogNtmsSvcMDMRpcSs');
 DeleteService('W32TimeEventlog');
 DeleteService('upnphostwinmgmt');
 DeleteService('upnphostose');
 DeleteService('TlntSvrShellHWDetection');
 BC_ImportALL;
 BC_DeleteSvc('WudfSvcEventSystemWZCSVC');
 BC_DeleteSvc('WmiHidServ');
 BC_DeleteSvc('WebClientMSDTC');
 BC_DeleteSvc('W32TimeEventlogNtmsSvcMDMRpcSs');
 BC_DeleteSvc('W32TimeEventlog');
 BC_DeleteSvc('upnphostwinmgmt');
 BC_DeleteSvc('upnphostose');
 BC_DeleteSvc('TlntSvrShellHWDetection');
 BC_DeleteSvc('srserviceAppMgmtlanmanworkstation');
 BC_DeleteSvc('srserviceAppMgmt');
 BC_DeleteSvc('SharedAccessHidServ');
 BC_DeleteSvc('ScheduleRpcLocator');
 BC_DeleteSvc('SamSshelpsvcTlntSvrShellHWDetection');
 BC_DeleteSvc('RSVPTapiSrv');
 BC_DeleteSvc('RpcLocatorSharedAccess');
 BC_DeleteSvc('RasManMessengersrserviceDhcpNetlogon');
 BC_DeleteSvc('RasAutoHidServMessengersrservice');
 BC_DeleteSvc('RasAutoHidServ');
 BC_DeleteSvc('ProtectedStoragewscsvc');
 BC_DeleteSvc('PlugPlayTrkWks');
 BC_DeleteSvc('NWCWorkstationhelpsvc');
 BC_DeleteSvc('NtmsSvcMDMRpcSs');
 BC_DeleteSvc('NtmsSvcMDM');
 BC_DeleteSvc('NlaHidServ');
 BC_DeleteSvc('NetmanMDMaspnet_state');
 BC_DeleteSvc('NetlogonsrserviceAppMgmtlanmanworkstation');
 BC_DeleteSvc('Netlogonhpqwmiex');
 BC_DeleteSvc('MSIServerPolicyAgent');
 BC_DeleteSvc('mnmsrvcVSS');
 BC_DeleteSvc('mnmsrvcose');
 BC_DeleteSvc('mnmsrvcodserv');
 BC_DeleteSvc('MessengersrserviceUPSWebClientMSDTC');
 BC_DeleteSvc('MessengersrserviceUPS');
 BC_DeleteSvc('MessengersrserviceSharedAccess');
 BC_DeleteSvc('MessengersrserviceDhcpNetlogon');
 BC_DeleteSvc('MessengersrserviceDhcp');
 BC_DeleteSvc('Messengersrservice');
 BC_DeleteSvc('MDMaspnet_stateEventlog');
 BC_DeleteSvc('MDMaspnet_state');
 BC_DeleteSvc('lanmanserverRSVP');
 BC_DeleteSvc('HTTPFilterBITS');
 BC_DeleteSvc('helpsvcTlntSvrShellHWDetection');
 BC_DeleteSvc('helpsvcdmadmin');
 BC_DeleteSvc('EventSystemWZCSVCMessenger');
 BC_DeleteSvc('EventSystemWZCSVC');
 BC_DeleteSvc('EventSystemwinmgmt');
 BC_DeleteSvc('EventSystemTlntSvr');
 BC_DeleteSvc('EventSystemShellHWDetectionwinmgmtDcomLaunchRasManMessengersrserviceDhcpNetlogon');
 BC_DeleteSvc('EventSystemShellHWDetectionwinmgmt');
 BC_DeleteSvc('EventSystemShellHWDetection');
 BC_DeleteSvc('EventSystemCryptSvc');
 BC_DeleteSvc('Eventlogseclogon');
 BC_DeleteSvc('DcomLaunchRasManMessengersrserviceDhcpNetlogon');
 BC_DeleteSvc('clr_optimization_v2.0.50727_32Themes');
 BC_DeleteSvc('aspnet_stateWMPNetworkSvc');
 ExecuteRepair(6);
 ExecuteRepair(5);
 ExecuteRepair(9);
 BC_Activate;
 ExecuteSysClean;
 RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится.
Пришлите карантин согласно приложению 3 правил

Повторите логи и подготовьте лог HJT.

Добавлено через 2 минуты

P>S> Логи повторяйте согласно предложению уважаемого pig

[SHAXTER]

Еще одна проблема состоит в том, что я не могу запустить ни эту программу, ни даже антивирусник любой.

[Rene-gad]

- Выполните скрипт

begin
executerepair(9);
executerepair(1);
executerepair(6);
executerepair(8);
executerepair(11);
executerepair(16);
executerepair(17);
RebootWindows(true);
end.

После перезагрузки попробуйте запустить IceSword.