В браузере при клике на любую страницу открывает новые окна с рекламой [not-a-virus:AdWare.Win32.SubTab.e, not-a-virus:AdWare.Win32.SearchProtect.rw ]

Вложений: 3

[COLOR=#333333]Добрый день.[/COLOR]

[COLOR=#333333]В браузере при клике по любой области сайта автоматически открываются новые окна с [/COLOR][COLOR=#333333]рекламой[/COLOR][COLOR=#333333], стартовая страница стала [/COLOR]http://www.istartsurf.com/

Уважаемый(ая) [B]adept23[/B], спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

Выполните скрипт в AVZ
[code]begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Program Files\xtab\protectservice.exe','');
QuarantineFile('C:\Program Files\xtab\iewatchdog.dll','');
QuarantineFile('C:\Program Files\xtab\cmdshell.exe','');
QuarantineFile('C:\Program Files\xtab\browerwatchff.dll','');
QuarantineFile('C:\Program Files\xtab\browerwatchch.dll','');
QuarantineFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-7.exe','');
QuarantineFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-6.exe','');
QuarantineFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-7.exe','');
QuarantineFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-11.exe','');
QuarantineFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-5.exe','');
QuarantineFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-6.exe','');
DelBHO('{51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F}');
DelBHO('{ebfbdd44-c0e0-4f63-a8e6-ee5f34765238}');
QuarantineFile('C:\Program Files\Edu App\EduAppbho.dll','');
QuarantineFile('C:\Program Files\XTab\SupTab.dll','');
QuarantineFile('C:\Program Files\gmsd_re_261\gmsd_re_261.exe','');
QuarantineFile('C:\Program Files\gmsd_re_256\gmsd_re_256.exe','');
QuarantineFile('C:\Program Files\gmsd_re_253\gmsd_re_253.exe','');
DeleteService('BDEnhanceBoost');
DeleteService('bd0002');
SetServiceStart('{848705a5-8a27-403e-9b59-732d0608bcbc}Gt', 4);
DeleteService('{848705a5-8a27-403e-9b59-732d0608bcbc}Gt');
SetServiceStart('{36ed28a4-ac0a-4653-91ff-10beb4246550}Gt', 4);
DeleteService('{36ed28a4-ac0a-4653-91ff-10beb4246550}Gt');
DeleteService('BDSafeBrowser');
SetServiceStart('BDMWrench', 4);
DeleteService('BDMWrench');
SetServiceStart('BDArKit', 4);
DeleteService('BDArKit');
SetServiceStart('bd0004', 4);
DeleteService('bd0004');
SetServiceStart('bd0001', 4);
DeleteService('bd0001');
QuarantineFile('C:\Program Files\globalUpdate\Update\globalupdate.exe','');
DeleteService('globalUpdatem');
DeleteService('globalUpdate');
SetServiceStart('Util Edu App', 4);
DeleteService('Util Edu App');
SetServiceStart('Update Edu App', 4);
DeleteService('Update Edu App');
SetServiceStart('mynesele', 4);
DeleteService('mynesele');
QuarantineFile('C:\Program Files\XTab\ProtectService.exe','');
SetServiceStart('IHProtect Service', 4);
DeleteService('IHProtect Service');
SetServiceStart('BDSGRTP', 4);
DeleteService('BDSGRTP');
QuarantineFile('C:\WINDOWS\system32\drivers\{eb01aed1-bba3-4e72-8323-a77bb027b1d4}Gt.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\{848705a5-8a27-403e-9b59-732d0608bcbc}Gt.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\{36ed28a4-ac0a-4653-91ff-10beb4246550}Gt.sys','');
QuarantineFile('C:\Program Files\Edu App\bin\EduApp.expextdll.dll','');
QuarantineFile('C:\Program Files\Edu App\bin\eb01aed1bba34e728323a77bb027b1d4.dll','');
QuarantineFile('C:\Program Files\Edu App\bin\eb01aed1bba34e728323.dll','');
TerminateProcessByName('c:\program files\edu app\bin\utileduapp.exe');
QuarantineFile('c:\program files\edu app\bin\utileduapp.exe','');
TerminateProcessByName('c:\program files\edu app\updateeduapp.exe');
QuarantineFile('c:\program files\edu app\updateeduapp.exe','');
QuarantineFile('c:\windows\runsw.exe','');
TerminateProcessByName('c:\program files\xtab\protectservice.exe');
QuarantineFile('c:\program files\xtab\protectservice.exe','');
TerminateProcessByName('c:\documents and settings\user\application data\46313030-1427626889-3435-3434-3536d0544456\nsn25f.tmp');
QuarantineFile('c:\documents and settings\user\application data\46313030-1427626889-3435-3434-3536d0544456\nsn25f.tmp','');
TerminateProcessByName('c:\documents and settings\user\application data\46313030-1427626889-3435-3434-3536d0544456\jnsz129.tmp');
QuarantineFile('c:\documents and settings\user\application data\46313030-1427626889-3435-3434-3536d0544456\jnsz129.tmp','');
TerminateProcessByName('c:\program files\edu app\bin\eduapp.purbrowse.exe');
QuarantineFile('c:\program files\edu app\bin\eduapp.purbrowse.exe','');
TerminateProcessByName('c:\program files\edu app\bin\eduapp.expext.exe');
QuarantineFile('c:\program files\edu app\bin\eduapp.expext.exe','');
TerminateProcessByName('c:\program files\edu app\bin\eduapp.browseradapter.exe');
QuarantineFile('c:\program files\edu app\bin\eduapp.browseradapter.exe','');
TerminateProcessByName('c:\program files\shop and save up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-6.exe');
QuarantineFile('c:\program files\shop and save up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-6.exe','');
TerminateProcessByName('c:\program files\shop and save up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-6.exe');
QuarantineFile('c:\program files\shop and save up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-6.exe','');
TerminateProcessByName('c:\program files\common files\baidu\baiduprotect1.3\1.3.0.645\baiduprotect.exe');
DeleteFile('c:\program files\common files\baidu\baiduprotect1.3\1.3.0.645\baiduprotect.exe','32');
DeleteFile('c:\program files\shop and save up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-6.exe','32');
DeleteFile('c:\program files\shop and save up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-6.exe','32');
DeleteFile('c:\program files\edu app\bin\eduapp.browseradapter.exe','32');
DeleteFile('c:\program files\edu app\bin\eduapp.expext.exe','32');
DeleteFile('c:\program files\edu app\bin\eduapp.purbrowse.exe','32');
DeleteFile('c:\documents and settings\user\application data\46313030-1427626889-3435-3434-3536d0544456\jnsz129.tmp','32');
DeleteFile('c:\documents and settings\user\application data\46313030-1427626889-3435-3434-3536d0544456\nsn25f.tmp','32');
DeleteFile('c:\program files\xtab\protectservice.exe','32');
DeleteFile('c:\program files\edu app\updateeduapp.exe','32');
DeleteFile('c:\program files\edu app\bin\utileduapp.exe','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\ad.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BDKitUtils.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BDLogicUtils.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BDMNet.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BDMReport.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\bdsg0001.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\DriverManager.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\dynplugins\BbSavior.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\plugins\BaiduRepair.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\plugins\HIPS.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\SafeBrowserDll.dll','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\SafeExplorer.dll','32');
DeleteFile('C:\Program Files\Edu App\bin\eb01aed1bba34e728323.dll','32');
DeleteFile('C:\Program Files\Edu App\bin\eb01aed1bba34e728323a77bb027b1d4.dll','32');
DeleteFile('C:\Program Files\Edu App\bin\EduApp.expextdll.dll','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\bd0001.sys','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\bd0004.sys','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\BDArKit.sys','32');
DeleteFile('C:\WINDOWS\system32\Drivers\BDMWrench.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\{36ed28a4-ac0a-4653-91ff-10beb4246550}Gt.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\{848705a5-8a27-403e-9b59-732d0608bcbc}Gt.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\{eb01aed1-bba3-4e72-8323-a77bb027b1d4}Gt.sys','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BaiduProtect.exe','32');
DeleteFile('C:\Program Files\XTab\ProtectService.exe','32');
DeleteFile('C:\Program Files\globalUpdate\Update\globalupdate.exe','32');
DeleteFile('C:\Program Files\gmsd_re_253\gmsd_re_253.exe','32');
DeleteFile('C:\Program Files\gmsd_re_256\gmsd_re_256.exe','32');
DeleteFile('C:\Program Files\gmsd_re_261\gmsd_re_261.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_re_261');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_re_256');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_re_253');
DeleteFile('C:\Program Files\XTab\SupTab.dll','32');
DeleteFile('C:\Program Files\Edu App\EduAppbho.dll','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-1-6.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-1-7.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-10_user.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-11.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-3.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-5.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-6.job','32');
DeleteFile('C:\WINDOWS\Tasks\6a2f5a8c-442b-4a07-aad8-43d859fed934-7.job','32');
DeleteFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','32');
DeleteFile('C:\WINDOWS\Tasks\APSnotifierPP1.job','32');
DeleteFile('C:\WINDOWS\Tasks\APSnotifierPP2.job','32');
DeleteFile('C:\WINDOWS\Tasks\APSnotifierPP3.job','32');
DeleteFile('C:\WINDOWS\Tasks\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-6.job','32');
DeleteFile('C:\WINDOWS\Tasks\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-7.job','32');
DeleteFile('C:\WINDOWS\Tasks\d48c4fef-9f61-489e-bf3b-0a82cb6975da-11.job','32');
DeleteFile('C:\WINDOWS\Tasks\d48c4fef-9f61-489e-bf3b-0a82cb6975da-5.job','32');
DeleteFile('C:\WINDOWS\Tasks\d48c4fef-9f61-489e-bf3b-0a82cb6975da-6.job','32');
DeleteFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-6.exe','32');
DeleteFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-5.exe','32');
DeleteFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-11.exe','32');
DeleteFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-7.exe','32');
DeleteFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-1-6.exe','32');
DeleteFile('C:\WINDOWS\Tasks\d48c4fef-9f61-489e-bf3b-0a82cb6975da-7.job','32');
DeleteFile('C:\Program Files\Shop and Save Up\d48c4fef-9f61-489e-bf3b-0a82cb6975da-7.exe','32');
DeleteFile('C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job','32');
DeleteFile('C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job','32');
DeleteFile('C:\Program Files\xtab\browerwatchch.dll','32');
DeleteFile('C:\Program Files\xtab\browerwatchff.dll','32');
DeleteFile('C:\Program Files\xtab\cmdshell.exe','32');
DeleteFile('C:\Program Files\xtab\iewatchdog.dll','32');
DeleteFile('C:\Program Files\xtab\protectservice.exe','32');
DeleteFile('C:\WINDOWS\Temp\nsk242.tmp\blowfish.dll','32');
DeleteFile('C:\WINDOWS\Temp\nswF0.tmp\blowfish.dll','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.[/code]Компьютер перезагрузится.

Пришлите карантин согласно [B]Приложения 2[/B] правил по красной ссылке [COLOR="Red"][U][B]Прислать запрошенный карантин[/B][/U][/COLOR] над первым сообщением в Вашей теме.

[B][COLOR="Blue"]Сделайте новые логи по правилам[/COLOR][/B]

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]8[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\program files\xtab\browerwatchch.dll - [B]not-a-virus:AdWare.Win32.SearchProtect.rw[/B] ( DrWEB: Adware.Mutabaha.119 )[*] c:\program files\xtab\browerwatchff.dll - [B]not-a-virus:AdWare.Win32.SearchProtect.rw[/B] ( DrWEB: Adware.Mutabaha.119 )[*] c:\program files\xtab\cmdshell.exe - [B]not-a-virus:AdWare.Win32.SubTab.e[/B][*] c:\program files\xtab\iewatchdog.dll - [B]not-a-virus:AdWare.Win32.SubTab.e[/B] ( DrWEB: Adware.Mutabaha.120 )[*] c:\program files\xtab\protectservice.exe - [B]not-a-virus:AdWare.Win32.SubTab.e[/B][*] c:\program files\xtab\suptab.dll - [B]not-a-virus:AdWare.Win32.SubTab.e[/B][/LIST][/LIST]