winsyn64.exe 100 % загрузка ЦП + перегрев ЦП [Trojan-Downloader.Win32.Andromeda.gto, Trojan.Win32.Genome.akwny ]

winsyn64.exe 100 % загружает ЦП в следствии чего происходит перегрев. Если возможно окажите помощь плиз )

Кстати, при попытке закрыть его, в диспетчере, он запускается опять. Но есть возможность его приостановить и тогда всё гуд )))

Заранее благодарен!
С Уважением!
Tomas Angelo

Уважаемый(ая) [B]Tomas Angelo[/B], спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

[FONT=Century Gothic][COLOR="#ff3333"][SIZE=3]> Выполните скрипт в AVZ:[/SIZE][/COLOR][/FONT]

[CODE]
begin
ClearQuarantine;
if not IsWOW64 then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
end;
TerminateProcessByName('c:\users\skolkovo\appdata\roaming\{e9ce56e8-e32c-489e-abbe-7b863c63ad13}\winsyn64.exe');
QuarantineFile('c:\users\skolkovo\appdata\roaming\{e9ce56e8-e32c-489e-abbe-7b863c63ad13}\winsyn64.exe','');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\Umamag.exe','');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\Slamae.exe','');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\Slamae.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\Umamag.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Slamae');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Umamag');
DeleteFile('c:\users\skolkovo\appdata\roaming\{e9ce56e8-e32c-489e-abbe-7b863c63ad13}\winsyn64.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
RebootWindows(true);
end.
[/CODE]

После выполнения скрипта компьютер будет перезагружен.

> Используйте ссылку "[B]Прислать запрошенный карантин[/B]", которая находится над первым сообщением этой темы, чтобы прислать [B]quarantine.zip[/B].

> Повторите действия, указанные в правилах и подготовьте новые отчеты AVZ и hijackthis.
[COLOR="#ff3333"]_________________[/COLOR]
[SIZE=1][URL="http://virusinfo.info/showthread.php?t=7239"]> как выполнить скрипт в AVZ[/URL][/SIZE]

ответ

[FONT=Century Gothic][COLOR="#ff3333"][SIZE=3]> Исправьте при помощи hijackthis:[/SIZE][/COLOR][/FONT]

[CODE]
O4 - HKCU\..\Run: [Umamag] C:\Users\SKOLKOVO\AppData\Roaming\Umamag.exe
[/CODE]

> Сделайте [URL="http://virusinfo.info/showthread.php?t=115256"]отчёт RSIT.[/URL]
[COLOR="#ff3333"]_________________[/COLOR]
[SIZE=1][URL="http://virusinfo.info/showthread.php?t=4491"]> как исправить при помощи hijackthis[/URL][/SIZE]

Ссори, не понял что значит: "Исправьте при помощи hijackthis:"

Всё, понял =)

[COLOR="silver"]- - - Добавлено - - -[/COLOR]

RSIT

[FONT=Century Gothic][COLOR="#ff3333"][SIZE=3]> Выполните скрипт в AVZ:[/SIZE][/COLOR][/FONT]

[CODE]
begin
ClearQuarantine;
if not IsWOW64 then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
end;
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\B17F.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\A4E1.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\7825.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\6B1A.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\4ACD.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\43E9.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\3789.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\E18.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\FD.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\C7C3.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\BAD7.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\7CDD.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\707D.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\4586.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\3983.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\114A.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\577.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\E3B3.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\DBD6.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\CE3E.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\A7E8.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\9F5F.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\933E.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\FB13.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\EEE2.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\D440.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\C7D0.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\9444.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\8841.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\F158.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\DFAB.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\D8D7.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\CC96.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\A6DD.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\9F9B.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\937A.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\7021.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\5ADB.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\A61E.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\974F.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\79AD.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\71C0.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\6560.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\4274.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\2D5E.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\756.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\82.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\F4AF.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\D146.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\C5A1.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\A0C2.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\94DF.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\EDEF.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\D61A.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\E994.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\DD53.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\E300.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\DC0D.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\CF9D.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\4940.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\3BD7.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\DF5.exe','Detected by RSIT');
QuarantineFile('C:\Users\SKOLKOVO\AppData\Roaming\AB.exe','Detected by RSIT');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\B17F.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\A4E1.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\7825.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\6B1A.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\4ACD.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\43E9.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\3789.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\E18.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\FD.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\C7C3.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\BAD7.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\7CDD.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\707D.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\4586.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\3983.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\114A.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\577.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\E3B3.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\DBD6.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\CE3E.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\A7E8.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\9F5F.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\933E.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\FB13.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\EEE2.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\D440.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\C7D0.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\9444.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\8841.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\F158.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\DFAB.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\D8D7.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\CC96.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\A6DD.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\9F9B.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\937A.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\7021.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\5ADB.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\A61E.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\974F.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\79AD.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\71C0.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\6560.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\4274.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\2D5E.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\756.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\82.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\F4AF.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\D146.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\C5A1.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\A0C2.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\94DF.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\EDEF.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\D61A.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\E994.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\DD53.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\E300.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\DC0D.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\CF9D.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\4940.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\3BD7.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\DF5.exe');
DeleteFile('C:\Users\SKOLKOVO\AppData\Roaming\AB.exe');
DeleteFileMask('C:\Users\SKOLKOVO\AppData\Roaming\{64821D16-105C-4C7A-A89C-36AA41BD65F7}','*',true);
DeleteFileMask('C:\Users\SKOLKOVO\AppData\Roaming\{E9CE56E8-E32C-489E-ABBE-7B863C63AD13}','*',true);
DeleteDirectory('C:\Users\SKOLKOVO\AppData\Roaming\{E9CE56E8-E32C-489E-ABBE-7B863C63AD13}');
DeleteDirectory('C:\Users\SKOLKOVO\AppData\Roaming\{64821D16-105C-4C7A-A89C-36AA41BD65F7}');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteWizard('SCU',2,2,false);
BC_Activate;
CreateQurantineArchive(GetAVZDirectory+'quarantine_2.zip');
RebootWindows(true);
end.
[/CODE]

После выполнения скрипта компьютер будет перезагружен.

> Используйте ссылку "[B]Прислать запрошенный карантин[/B]", которая находится над первым сообщением этой темы, чтобы прислать [B][COLOR="#800080"]quarantine_2.zip[/COLOR][/B].

> Повторите действия, указанные в правилах и подготовьте новые [B]отчеты AVZ и RSIT.[/B]
[COLOR="#ff3333"]_________________[/COLOR]
[SIZE=1][URL="http://virusinfo.info/showthread.php?t=7239"]> как выполнить скрипт в AVZ[/URL][/SIZE]

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]2[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\\users\\skolkovo\\appdata\\roaming\\{e9ce56e8-e32c-489e-abbe-7b863c63ad13}\\winsyn64.exe - [B]Trojan-Downloader.Win32.Andromeda.gto[/B] ( DrWEB: Trojan.DownLoad3.21021, BitDefender: Dropped:Trojan.Generic.8706474, NOD32: Win32/CoinMiner.H trojan )[*] c:\\users\\skolkovo\\appdata\\roaming\\umamag.exe - [B]Trojan.Win32.Genome.akwny[/B] ( DrWEB: BackDoor.IRC.NgrBot.42, BitDefender: MemScan:Trojan.Generic.8594925, NOD32: Win32/TrojanDropper.Agent.QAA trojan )[/LIST][/LIST]