explorasi.exe и куча других вирусов - зачистка после них

Стандартные скрипты выполнены. Проверьте не осталось ли гадов.

Выполните скрипт в AVZ:
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\phqesvm.dll','');
DeleteFile('C:\WINDOWS\system32\phqesvm.dll');
DeleteFile('C:\WINDOWS\Tasks\At1.job');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(17);
ExecuteRepair(13);
ExecuteRepair(6);
ExecuteRepair(8);
RegKeyIntParamWrite( 'HKLM', 'SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum', '{BDEADF00-C265-11D0-BCED-00A0C90AB50F}', 1);
RebootWindows(true);
end.[/code]
Компьютер перезагрузится.
Пришлите карантин согласно приложению 3 правил
(загружать тут: [url]http://virusinfo.info/upload_virus.php?tid=101104[/url]).
Сделайте новые логи (только п.2 и 3 раздела Диагностика).

Файл сохранён как 110420_132447_virus_4daede9f3902c.zip
Размер файла 28729
MD5 2a458e47027b489205313a0bb99fabb6

логи

Чисто.

Сделайте лог [url="http://virusinfo.info/showpost.php?p=457118&postcount=1"]полного сканирования МВАМ[/url]

Лог mbam:

- [URL="http://virusinfo.info/showpost.php?p=493584&postcount=2"]удалите[/URL] в [B]MBAM[/B]
[CODE]
Заражённые папки:
c:\documents and settings\Admin\local settings\application data\bron.tok-12-20 (Worm.Brontok) -> No action taken.
c:\documents and settings\Admin\application data\winxrar (Trojan.Agent) -> No action taken.

Заражённые файлы:
c:\WINDOWS\system32\dp1.fne (Worm.Autorun) -> No action taken.
c:\WINDOWS\system32\spec.fne (Worm.AutoRun) -> No action taken.
c:\WINDOWS\system32\internet.fne (HackTool.Patcher) -> No action taken.
c:\WINDOWS\system32\RegEx.fne (Worm.Autorun) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00001.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00002.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00003.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00004.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00005.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00006.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00007.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00008.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00009.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00010.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00011.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00012.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00013.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00014.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00015.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00016.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00017.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00018.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00019.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00020.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00021.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00022.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00023.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00024.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00025.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00026.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00027.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00028.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00029.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\Antivir\avz4\avz4\Infected\2011-04-20\avz00030.dta (Trojan.Dropper) -> No action taken.
d:\Distribs\реестр\ctfmon.exe (Trojan.FakeMS) -> No action taken.
c:\WINDOWS\system32\com.run (Trojan.Banker) -> No action taken.
c:\WINDOWS\system32\eAPI.fne (Worm.AutoRun) -> No action taken.
c:\WINDOWS\system32\krnln.fnr (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\og.dll (Worm.AutoRun) -> No action taken.
c:\WINDOWS\system32\og.EDT (Worm.AutoRun) -> No action taken.
c:\WINDOWS\system32\RegEx.fnr (Worm.AutoRun) -> No action taken.
c:\WINDOWS\system32\shell.fne (Worm.AutoRun) -> No action taken.
c:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\after.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\dir.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\dot.gif (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\htmlayout.dll (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\logo.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\logo2.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\myriadwebpro-condensed.ttf (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\rules.css (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\s.htm (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-h-scroll-next.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-h-scroll-prev.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-scroll-back.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-scroll-base.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-scroll-slider.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-v-scroll-next.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sb-v-scroll-prev.png (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\scroll.css (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\sview (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\winxrar.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\winxrarview.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\winxrar\xsendexe.tmp (Trojan.Agent) -> No action taken.
[/CODE]
- Сделайте повторный лог [URL="http://virusinfo.info/showpost.php?p=457118&postcount=1"][COLOR="Blue"][B]MBAM[/B][/COLOR][/URL]

А можете написать скрипт для AVZ чтобы не удалять вручную зараженные файлы и папки в mbam ?

Удаляйте в МВАМ. Как сделать, написано по ссылке

повторный лог MBAM:

больше подозрительного нет

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]1[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\\windows\\system32\\phqesvm.dll - [B]Trojan.Win32.Zapchast.exd[/B] ( DrWEB: Trojan.Mayachok.based, BitDefender: Trojan.Generic.5515130, AVAST4: Win32:Vundo-JQ [Trj] )[/LIST][/LIST]