автоматически устанавливаются программы, появляется рекалама [not-a-virus:AdWare.Win32.Eorezo.afob ]

Самостоятельно устанавливаются программы crossbrowser, gamedesktop, istartsurf, phraseprofessor. В гугл хром появляется реклама и открываются лишние вкладки.

Уважаемый(ая) [B]talen[/B], спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

В AVZ выполните скрипт:

[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\program files\crossbrowse\crossbrowse\application\crossbrowse.exe');
TerminateProcessByName('c:\program files\gmsd_ru_005010073\gmsd_ru_005010073.exe');
TerminateProcessByName('c:\program files\00000000-1438218824-0000-0000-d43d7e51f34c\knst486e.tmpfs');
TerminateProcessByName('c:\program files\sfk\sfkex.exe');
TerminateProcessByName('c:\program files\sfk\ssfk.exe');
QuarantineFile('C:\Users\Ekonom\appdata\roaming\mystartsearch\uninstallmanager.exe','');
QuarantineFile('C:\Users\Ekonom\AppData\Local\Temp\nsx6430.tmp\blowfish.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe','');
QuarantineFile('C:\Program Files\PlusHD_1.02mV09.08\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-5.exe','');
QuarantineFile('C:\Program Files\PlusHD_1.02mV09.08\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-3.exe','');
QuarantineFile('C:\Program Files\PlusHD_1.02mV09.08\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-10.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-7.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-6.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-5.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-3.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-10.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-7.exe','');
QuarantineFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-6.exe','');
QuarantineFile('Up\11578b8b-fe3a-4981-92e7-90128622c1aa-5.exe','');
QuarantineFile('C:\Program Files\Shop Up\11578b8b-fe3a-4981-92e7-90128622c1aa-3.exe','');
QuarantineFile('C:\Program Files\Shop Up\11578b8b-fe3a-4981-92e7-90128622c1aa-10.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010073\gmsd_ru_005010073.exe','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe','');
QuarantineFile('C:\Program Files\SFK\SFKEX.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libglesv2.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libegl.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_elf.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_child.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome.dll','');
QuarantineFile('c:\program files\sfk\ssfk.exe','');
QuarantineFile('c:\program files\sfk\sfkex.exe','');
QuarantineFile('c:\program files\00000000-1438218824-0000-0000-d43d7e51f34c\knst486e.tmpfs','');
QuarantineFile('c:\program files\gmsd_ru_005010073\gmsd_ru_005010073.exe','');
QuarantineFile('c:\program files\crossbrowse\crossbrowse\application\crossbrowse.exe','');
DeleteFile('c:\program files\crossbrowse\crossbrowse\application\crossbrowse.exe','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome.dll','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_child.dll','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\chrome_elf.dll','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libegl.dll','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\39.6.2171.95\libglesv2.dll','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','GoogleChromeAutoLaunch_2AFC1742B50E2867CA9FD6C6BF1B72E9');
DeleteFile('C:\Windows\Tasks\11578b8b-fe3a-4981-92e7-90128622c1aa-10_user.job','32');
DeleteFile('C:\Program Files\Shop Up\11578b8b-fe3a-4981-92e7-90128622c1aa-10.exe','32');
DeleteFile('C:\Windows\Tasks\11578b8b-fe3a-4981-92e7-90128622c1aa-3.job','32');
DeleteFile('C:\Program Files\Shop Up\11578b8b-fe3a-4981-92e7-90128622c1aa-3.exe','32');
DeleteFile('C:\Windows\Tasks\11578b8b-fe3a-4981-92e7-90128622c1aa-5_user.job','32');
DeleteFile('C:\Program Files\Shop Up\11578b8b-fe3a-4981-92e7-90128622c1aa-5.exe','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-6.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-6.job','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-7.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-7.job','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-10.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-10_user.job','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-3.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-3.job','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-5.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-5.job','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-5_user.job','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-6.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-6.job','32');
DeleteFile('C:\Program Files\CiPlus-4.5vV27.08\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-7.exe','32');
DeleteFile('C:\Windows\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-7.job','32');
DeleteFile('C:\Program Files\PlusHD_1.02mV09.08\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-10.exe','32');
DeleteFile('C:\Windows\Tasks\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-10_user.job','32');
DeleteFile('C:\Program Files\PlusHD_1.02mV09.08\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-3.exe','32');
DeleteFile('C:\Windows\Tasks\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-3.job','32');
DeleteFile('C:\Program Files\PlusHD_1.02mV09.08\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-5.exe','32');
DeleteFile('C:\Windows\Tasks\59acf12a-3c64-4be8-ad9c-16dd07bba4c4-5_user.job','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe','32');
DeleteFile('C:\Windows\Tasks\Crossbrowse.job','32');
DeleteFile('C:\Windows\system32\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-6','32');
DeleteFile('C:\Windows\system32\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-1-7','32');
DeleteFile('C:\Windows\system32\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-5','32');
DeleteFile('C:\Windows\system32\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-6','32');
DeleteFile('C:\Windows\system32\Tasks\5526d4d8-1b4c-47a1-b4f6-135f7c7d8544-7','32');
DeleteFile('C:\Windows\system32\Tasks\Crossbrowse','32');
DeleteFile('C:\Users\Ekonom\AppData\Local\Temp\nsx6430.tmp\blowfish.dll','32');
DeleteFile('C:\Users\Ekonom\appdata\roaming\mystartsearch\uninstallmanager.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/code]


После перезагрузки

[code]
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
[/code]


Пришлите карантин [b]quarantine.zip[/b] по красной ссылке [B][COLOR="Red"][U]Прислать запрошенный карантин[/U][/COLOR][/B] вверху темы.
Логи повторите.

Сделайте лог полного сканирования [b][url=http://virusinfo.info/showthread.php?t=53070]MBAM[/url][/b]

логи

В AVZ выполните скрипт:

[code]
begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\program files\gmsd_ru_005010073\gmsd_ru_005010073.exe');
TerminateProcessByName('c:\program files\00000000-1438218824-0000-0000-d43d7e51f34c\knst486e.tmpfs');
TerminateProcessByName('c:\program files\sfk\sfkex.exe');
TerminateProcessByName('c:\program files\sfk\ssfk.exe');
QuarantineFile('C:\Users\Ekonom\appdata\local\smartweb\__u.exe','');
QuarantineFile('C:\Users\Ekonom\appdata\local\smartweb\swhk.dll','');
QuarantineFile('C:\Users\Ekonom\appdata\local\smartweb\smartwebapp.exe','');
QuarantineFile('C:\Windows\system32\Drivers\wsafd_1_10_0_19.sys','');
QuarantineFile('C:\Users\Ekonom\AppData\Local\SmartWeb\SmartWebHelper.exe','');
QuarantineFile('C:\Program Files\SFK\SFKEX.dll','');
QuarantineFile('c:\program files\gmsd_ru_005010073\gmsd_ru_005010073.exe','');
DeleteService('SSFK');
DeleteService('mekyturo');
DeleteFile('c:\program files\gmsd_ru_005010073\gmsd_ru_005010073.exe','32');
DeleteFile('c:\program files\00000000-1438218824-0000-0000-d43d7e51f34c\knst486e.tmpfs','32');
DeleteFile('c:\program files\sfk\sfkex.exe','32');
DeleteFile('c:\program files\sfk\ssfk.exe','32');
DeleteFile('C:\Program Files\SFK\SFKEX.dll','32');
DeleteFile('C:\Program Files\00000000-1438218824-0000-0000-D43D7E51F34C\knst486E.tmpfs','32');
DeleteFile('C:\Program Files\SFK\SSFK.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010073\gmsd_ru_005010073.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gmsd_ru_005010073');
DeleteFile('C:\Users\Ekonom\AppData\Local\SmartWeb\SmartWebHelper.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','SmartWeb');
DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','32');
DeleteFile('C:\Windows\system32\Drivers\wsafd_1_10_0_19.sys','32');
DeleteFile('C:\Users\Ekonom\appdata\local\smartweb\smartwebapp.exe','32');
DeleteFile('C:\Users\Ekonom\appdata\local\smartweb\swhk.dll','32');
DeleteFile('C:\Users\Ekonom\appdata\local\smartweb\__u.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/code]


После перезагрузки

[code]
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
[/code]


Пришлите карантин [b]quarantine.zip[/b] по красной ссылке [B][COLOR="Red"][U]Прислать запрошенный карантин[/U][/COLOR][/B] вверху темы.

Удалите в mbam все, кроме строк содержащих
C:\ProgramData\Comodo\

Логи повторите.

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]70[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\program files\gmsd_ru_005010073\gmsd_ru_005010073.exe - [B]not-a-virus:AdWare.Win32.Eorezo.afob[/B][/LIST][/LIST]