При проверке утилита Drweb находит троян и тут же компьютер выключается

[Type R]

Помогите! Ось XP.
При выходе в интернет через USB модем, через некоторое время система виснет! При проверке утилитой Dweb, обнаруживается троян Trojan.Inject.27435, но при нажатии лечить/переместить компъютер перезагружается.Отключены многие функции администрирования. Не работал диспетчер задач, включил. Незадана служба системы восстановления, включил. Также запрещен редактирование реестра.
Спасибо!

[thyrex]

Пофиксите в HiJack

R3 - URLSearchHook: (no name) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - (no file)
R3 - URLSearchHook: (no name) -  - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O4 - HKCU\..\Run: [lajal] C:\Documents and Settings\Администратор\Application Data\Microsoft\mounnipoogyn.exe
O4 - HKCU\..\Run: [josiz] C:\Documents and Settings\Администратор\Application Data\Microsoft\gajesoo.exe
O4 - HKCU\..\Run: [poutti] C:\Documents and Settings\Администратор\Application Data\Microsoft\kiry.exe
O4 - HKCU\..\Run: [zooquy] C:\Documents and Settings\Администратор\Application Data\Microsoft\lufounoug.exe
O4 - HKCU\..\Run: [bezirik] C:\Documents and Settings\Администратор\Application Data\Microsoft\vaquydi.exe
O4 - HKCU\..\Run: [noolem] C:\Documents and Settings\Администратор\Application Data\Microsoft\pymurywo.exe
O4 - HKCU\..\Run: [nygouc] C:\Documents and Settings\Администратор\Application Data\Microsoft\moucoocoo.exe
O4 - HKCU\..\Run: [cipow] C:\Documents and Settings\Администратор\Application Data\Microsoft\bocamyp.exe
O4 - HKCU\..\Run: [soobouli] C:\Documents and Settings\Администратор\Application Data\Microsoft\pyboob.exe
O4 - HKCU\..\Run: [dimmizoug] C:\Documents and Settings\Администратор\Application Data\Microsoft\dadouz.exe
O4 - HKCU\..\Run: [tecoogoos] C:\Documents and Settings\Администратор\Application Data\Microsoft\tooroloo.exe
O4 - HKCU\..\Run: [hebuve] C:\Documents and Settings\Администратор\Application Data\Microsoft\vapooqueka.exe
O4 - HKCU\..\Run: [cehi] C:\Documents and Settings\Администратор\Application Data\Microsoft\coobuw.exe
O4 - HKCU\..\Run: [loguk] C:\Documents and Settings\Администратор\Application Data\Microsoft\moucoocoo.exe
O4 - HKCU\..\Run: [kodu] C:\Documents and Settings\Администратор\Application Data\Microsoft\koulooqui.exe
O4 - HKCU\..\Run: [wybahe] C:\Documents and Settings\Администратор\Application Data\Microsoft\fepoze.exe
O4 - HKCU\..\Run: [toofu] C:\Documents and Settings\Администратор\Application Data\Microsoft\koulooqui.exe
O4 - HKCU\..\Run: [rougy] C:\Documents and Settings\Администратор\Application Data\Microsoft\wivouraku.exe
O4 - HKCU\..\Run: [quounnocas] C:\Documents and Settings\Администратор\Application Data\Microsoft\mysov.exe
O4 - HKCU\..\Run: [nounulo] C:\Documents and Settings\Администратор\Application Data\Microsoft\bissu.exe
O4 - HKCU\..\Run: [fukity] C:\Documents and Settings\Администратор\Application Data\Microsoft\zimmacuhi.exe
O4 - HKCU\..\Run: [hufek] C:\Documents and Settings\Администратор\Application Data\Microsoft\vicyvoov.exe
O4 - HKCU\..\Run: [pannoo] C:\Documents and Settings\Администратор\Application Data\Microsoft\tousou.exe
O4 - HKCU\..\Run: [livapu] C:\Documents and Settings\Администратор\Application Data\Microsoft\motton.exe
O4 - HKUS\S-1-5-18\..\Run: [cipow] C:\Documents and Settings\LocalService\Application Data\Microsoft\zajip.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [soobouli] C:\Documents and Settings\LocalService\Application Data\Microsoft\pyboob.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [dimmizoug] C:\Documents and Settings\LocalService\Application Data\Microsoft\dadouz.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [hebuve] C:\Documents and Settings\LocalService\Application Data\Microsoft\vapooqueka.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [cehi] C:\Documents and Settings\LocalService\Application Data\Microsoft\coobuw.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [kodu] C:\Documents and Settings\LocalService\Application Data\Microsoft\koulooqui.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [toofu] C:\Documents and Settings\LocalService\Application Data\Microsoft\ruzoulof.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [quounnocas] C:\Documents and Settings\LocalService\Application Data\Microsoft\mysov.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [nounulo] C:\Documents and Settings\LocalService\Application Data\Microsoft\bissu.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [fukity] C:\Documents and Settings\LocalService\Application Data\Microsoft\zimmacuhi.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [livapu] C:\Documents and Settings\LocalService\Application Data\Microsoft\motton.exe (User 'SYSTEM')
O20 - AppInit_DLLs: C:\WINDOWS\system32\cKYAL.dll

Выполните скрипт в AVZ

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\cKYAL.dll','');
DeleteFile('C:\WINDOWS\system32\cKYAL.dll');
 QuarantineFile('G:\autorun.inf','');
 QuarantineFile('G:\nice\\little.exe','');
 QuarantineFile('C:\WINDOWS\system32\sdra64.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-2326943260-3374151740-039171076-6900\djwi2kcew.exe,C:\Documents and Settings\Администратор\Application Data\mzrp.exe,C:\Documents and Settings\Администратор\Application Data\yaptm.exe,explorer.exe,C:\Documents and Settings\Администратор\fxmdk.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\yaptm.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\zimmacuhi.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\wivouraku.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vicyvoov.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vaquydi.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vapooqueka.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\tousou.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\tooroloo.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pymurywo.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pyboob.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\mysov.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\mounnipoogyn.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\moucoocoo.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\motton.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\lufounoug.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\koulooqui.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\kiry.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\gajesoo.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\fepoze.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\dadouz.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\bocamyp.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\bissu.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\zimmacuhi.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\zajip.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\vapooqueka.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\ruzoulof.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\pyboob.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\mysov.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\motton.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\lufounoug.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\koulooqui.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\dadouz.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\coobuw.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\bocamyp.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\bissu.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\soroz.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\newojawuk.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\voobah.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pifugoz.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\riquy.exe','');
 QuarantineFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\quowoopegoo.exe','');
 DeleteService('w6ybawao35ei7q');
 DeleteService('oeaiauy64ajeyyii');
 DeleteService('ocezoiua4jdgo');
 DeleteService('eti8bwmoa');
 DeleteService('aaypnnayst9oauuo');
 DeleteService('aakyiazoafadiytr');
 TerminateProcessByName('c:\documents and settings\Администратор\application data\microsoft\vapooqueka.exe');
 QuarantineFile('c:\documents and settings\Администратор\application data\microsoft\vapooqueka.exe','');
 TerminateProcessByName('c:\documents and settings\Администратор\application data\microsoft\newojawuk.exe');
 QuarantineFile('c:\documents and settings\Администратор\application data\microsoft\newojawuk.exe','');
 DeleteFile('c:\documents and settings\Администратор\application data\microsoft\newojawuk.exe');
 DeleteFile('c:\documents and settings\Администратор\application data\microsoft\vapooqueka.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\quowoopegoo.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\riquy.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pifugoz.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\voobah.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\newojawuk.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\soroz.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\bissu.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','nounulo');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\bocamyp.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','nygouc');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','nounulo');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\coobuw.exe');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','cehi');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','cehi');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','nygouc');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\dadouz.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\koulooqui.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','kodu');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','dimmizoug');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','dimmizoug');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\lufounoug.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','zooquy');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','kodu');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','zooquy');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\motton.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','livapu');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','livapu');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\mysov.exe');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','quounnocas');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','quounnocas');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\pyboob.exe');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','soobouli');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','soobouli');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\ruzoulof.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','toofu');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','toofu');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\vapooqueka.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','hebuve');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','hebuve');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\zajip.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','cipow');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','cipow');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\zimmacuhi.exe');
 RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','fukity');
 RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','fukity');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\bissu.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','nounulo');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\bocamyp.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','cehi');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','cipow');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\dadouz.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\fepoze.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','wybahe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dimmizoug');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\gajesoo.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\kiry.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\koulooqui.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','kodu');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','poutti');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','josiz');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','toofu');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\lufounoug.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\motton.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','livapu');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','zooquy');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\moucoocoo.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','loguk');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','nygouc');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\mounnipoogyn.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\mysov.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pyboob.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','soobouli');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','quounnocas');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','lajal');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pymurywo.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\tooroloo.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\tousou.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','pannoo');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','tecoogoos');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','noolem');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vapooqueka.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vaquydi.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vicyvoov.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','hufek');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','bezirik');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','hebuve');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\wivouraku.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\zimmacuhi.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','fukity');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','rougy');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\yaptm.exe');
 DeleteFile('C:\RECYCLER\S-1-5-21-2326943260-3374151740-039171076-6900\djwi2kcew.exe,C:\Documents and Settings\Администратор\Application Data\mzrp.exe,C:\Documents and Settings\Администратор\Application Data\yaptm.exe,explorer.exe,C:\Documents and Settings\Администратор\fxmdk.exe');
 DeleteFile('C:\WINDOWS\system32\sdra64.exe');
 DeleteFile('G:\nice\\little.exe');
 DeleteFile('G:\autorun.inf');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(6);
RegKeyIntParamWrite('HKLM', 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum', '{BDEADF00-C265-11D0-BCED-00A0C90AB50F}', 1); 
ExecuteRepair(11);
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RebootWindows(true);
end.

Компьютер перезагрузится.

Пришлите карантин согласно Приложения 3 правил по красной ссылке Прислать запрошенный карантин вверху темы

Скачайте AVZ 4.35, обновите его базы

Сделайте новые логи

[Type R]

Все сделал! Выкладываю скрипты с последней версии avz 4.35 с обнавленными базами. При проверке утилитой D.web попрежнему обнаруживается Trojan.Inject.27435 и при нажатии лечить компъютер перезагружается. Также заблокирована учетка Админа, даже антивирусник установить невозможно.

[Bratez]

Отключите восстановление системы!

Пофиксите в HijackThis:

O4 - HKCU\..\Run: [HW_OPENEYE_OUC_MegaFon Internet] "C:\Program Files\MegaFon Internet\UpdateDog\ouc.exe"
O4 - HKCU\..\Run: [cake] C:\Documents and Settings\Администратор\Application Data\Microsoft\zounede.exe
O4 - HKCU\..\Run: [nootoqu] C:\Documents and Settings\Администратор\Application Data\Microsoft\buhena.exe
O4 - HKCU\..\Run: [fycoz] C:\Documents and Settings\Администратор\Application Data\Microsoft\cori.exe
O4 - HKCU\..\Run: [wouwam] C:\Documents and Settings\Администратор\Application Data\Microsoft\fygoronnoo.exe
O4 - HKCU\..\Run: [regab] C:\Documents and Settings\Администратор\Application Data\Microsoft\rave.exe
O4 - HKCU\..\Run: [camougouw] C:\Documents and Settings\Администратор\Application Data\Microsoft\woussouhooko.exe
O4 - HKCU\..\Run: [hebuve] C:\Documents and Settings\Администратор\Application Data\Microsoft\vapooqueka.exe
O4 - HKCU\..\Run: [loguk] C:\Documents and Settings\Администратор\Application Data\Microsoft\moucoocoo.exe
O4 - HKCU\..\Run: [hufek] C:\Documents and Settings\Администратор\Application Data\Microsoft\vicyvoov.exe
O4 - HKUS\S-1-5-18\..\Run: [wybahe] C:\Documents and Settings\LocalService\Application Data\Microsoft\fepoze.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [wouwam] C:\Documents and Settings\LocalService\Application Data\Microsoft\fygoronnoo.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [camougouw] C:\Documents and Settings\LocalService\Application Data\Microsoft\woussouhooko.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [loguk] C:\Documents and Settings\LocalService\Application Data\Microsoft\moucoocoo.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [hufek] C:\Documents and Settings\LocalService\Application Data\Microsoft\vicyvoov.exe (User 'SYSTEM')

Выполните скрипт в AVZ:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('c:\windows\temp\dyhzmlxjakkdf5837a8.tmp');
 DeleteFile('c:\windows\temp\gexqgliddb69193.tmp');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\newojawuk.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\fadyruda.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\pisimeroo.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\buhena.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\fepoze.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\fygoronnoo.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\woussouhooko.exe');
 DeleteFile('C:\Documents and Settings\LocalService\Application Data\Microsoft\zounede.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\buhena.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\cori.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\fygoronnoo.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\rave.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\vapooqueka.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\woussouhooko.exe');
 DeleteFile('C:\Documents and Settings\Администратор\Application Data\Microsoft\zounede.exe');
 DeleteFileMask('c:\windows\temp', '*.*',true);
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(8);
 BC_DeleteSvc('aaypnnayst9oauuo');
 BC_DeleteSvc('haiuoy4yu');
 BC_DeleteSvc('oxoueh7wujevuje');
BC_Activate;
RebootWindows(true);
end.

Компьютер перезагрузится.
Сделайте новые логи.

Сделайте лог gmer.

[Type R]

Увы, компьютер сам днем отключился, и больше не включается, даже в безопасном режиме...черный экран, в безопасном режиме, начинают загружаться драйвера и останавливаются на половине. Что делать то теперь?

[Bratez]

В меню вариантов загрузки по F8 есть пункт "Последняя удачная конфигурация" - попробуйте.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 112
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\documents and settings\\localservice\\application data\\microsoft\\bissu.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  2. c:\\documents and settings\\localservice\\application data\\microsoft\\bocamyp.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  3. c:\\documents and settings\\localservice\\application data\\microsoft\\coobuw.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  4. c:\\documents and settings\\localservice\\application data\\microsoft\\dadouz.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  5. c:\\documents and settings\\localservice\\application data\\microsoft\\koulooqui.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  6. c:\\documents and settings\\localservice\\application data\\microsoft\\lufounoug.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  7. c:\\documents and settings\\localservice\\application data\\microsoft\\motton.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  8. c:\\documents and settings\\localservice\\application data\\microsoft\\mysov.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  9. c:\\documents and settings\\localservice\\application data\\microsoft\\pyboob.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  10. c:\\documents and settings\\localservice\\application data\\microsoft\\ruzoulof.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  11. c:\\documents and settings\\localservice\\application data\\microsoft\\vapooqueka.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  12. c:\\documents and settings\\localservice\\application data\\microsoft\\zajip.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  13. c:\\documents and settings\\localservice\\application data\\microsoft\\zimmacuhi.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  14. c:\\documents and settings\\администратор\\application data\\microsoft\\riquy.exe - Trojan-Dropper.Win32.VB.awau ( DrWEB: Trojan.MulDrop1.57199, BitDefender: Trojan.Generic.6073264, AVAST4: Win32:VB-RTZ [Trj] )
  15. c:\\documents and settings\\администратор\\application data\\yaptm.exe - Backdoor.Win32.VBdoor.fu ( DrWEB: BackDoor.Siggen.42021, BitDefender: Rootkit.37359, NOD32: Win32/AutoRun.AEN worm, AVAST4: Win32:AutoRun-BOA [Wrm] )