Сообщение о заражении AdwareVirtumonde и PrivacyRemover.M64

[vfes2]

При загрузке рабочий стол стал синим с оранжевым предупреждением о инфицировании этими вирусами. Ярлыков не стало. Компьютер завис, ни на что не реагирует. Провел все, что вычитал по диагностике. Прилагаю логи.

[V_Bond]

выполните скрипт ...

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('D:\autorun.inf','');
 QuarantineFile('C:\Program Files\Internet Explorer\msvcrt.dll','');
 QuarantineFile('karina.dat','');
 QuarantineFile('buritos.exe','');
 DeleteService('Winvd63');
 DeleteService('Winou85');
 DeleteService('wscsvcImapiService');
 DeleteService('W32TimeAudioSrvRDSessMgr');
 DeleteService('SwPrvHTTPFilter');
 DeleteService('stisvcAppMgmtNetDDENetlogonclr_optimization_v2.0.50727_32');
 DeleteService('stisvcAppMgmtNetDDE');
 DeleteService('SSDPSRVsrservice');
 DeleteService('ShellHWDetectionNetmanRSVP');
 DeleteService('ShellHWDetectionNetman');
 DeleteService('SharedAccessAlerterUPS');
 DeleteService('ScReadSpoolRpcLocator');
 DeleteService('ScReadSpoolRpcLocatorseclogon');
 DeleteService('SchedulePolicyAgent');
 DeleteService('SCardSvrxmlprovRSVPMSIServer');
 DeleteService('SCardSvrxmlprovRSVP');
 DeleteService('SCardSvrxmlprov');
 DeleteService('SCardSvrAlerterUPS');
 DeleteService('RSVPhelpsvcwuauserv');
 DeleteService('RpcSsERSvc');
 DeleteService('RpcLocatordmadmindmadminEventSystem');
 DeleteService('RpcLocatordmadmin');
 DeleteService('RDSessMgrNetlogon');
 DeleteService('RasAutoNlaRemoteRegistryBthServ');
 DeleteService('RasAutoNlaRemoteRegistry');
 DeleteService('RasAutoNla');
 DeleteService('RasAutoMSIServer');
 DeleteService('RasAutoCryptSvc');
 DeleteService('NtLmSspWebClient');
 DeleteService('Netlogonclr_optimization_v2.0.50727_32');
 DeleteService('NetDDEEventSystemNetDDEdsdmVSS');
 DeleteService('NetDDEdsdmVSSCryptSvc');
 DeleteService('NetDDEdsdmVSS');
 DeleteService('NBServiceSCardSvrxmlprovRSVP');
 DeleteService('MessengerDcomLaunchPlugPlay');
 DeleteService('lanmanworkstationScReadSpoolDcomLaunch');
 DeleteService('lanmanworkstationScReadSpool');
 DeleteService('helpsvcwuauserv');
 DeleteService('ERSvcRpcLocator');
 DeleteService('DnscacheClipSrv');
 DeleteService('dmserverDhcp');
 DeleteService('dmadminEventSystem');
 DeleteService('CryptSvcRpcLocatorlanmanserverDcomLaunch');
 DeleteService('CryptSvcRpcLocator');
 DeleteService('ClipSrvERSvc');
 DeleteService('CiSvcRpcLocatorRasMan');
 DeleteService('CiSvcRpcLocator');
 DeleteService('CiSvcALG');
 DeleteService('BthServNtLmSsp');
 DeleteService('BITSNetDDEDnscache');
 DeleteService('BITSNetDDE');
 DeleteService('AudioSrvRDSessMgr');
 DeleteService('ATISamSs');
 DeleteService('AtiRpcSsdmadminEventSystem');
 DeleteService('AtiRpcSs');
 DeleteService('AppMgmtNetDDEProtectedStorage');
 DeleteService('AppMgmtNetDDE');
 DeleteService('AppMgmtAppMgmt');
 DeleteService('AlerterUPSATISamSs');
 DeleteService('AlerterUPS');
 QuarantineFile('srv.exe','');
 QuarantineFile('dwshd.sys','');
 DeleteFile('dwshd.sys');
 DeleteFile('srv.exe');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winou85.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winvd63.sys');
 DeleteFile('buritos.exe');
 DeleteFile('karina.dat');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(5);
ExecuteRepair(6);
ExecuteRepair(8);
BC_Activate;
RebootWindows(true);
end.

пришлите карантин согласно приложения 3 правил ...
повторите логи ...

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 2
• Обработано файлов: 26
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\windows\\system32\\lsass.exe - Trojan.Win32.Patched.cx