Самостоятельно станавливается Crossbrowse и другие вредоносные программы [not-a-virus:WebToolbar.Win32.CroRi.fte, not-a-virus:WebToolbar.Win32.CroRi.glx ]

Вложений: 4

Прошу помочь.
Ежедневно происходит самостоятельная установка Crossbrowse, и других неизвестных программ, в браузере активизируются кликандеры, в области трея всплывают рекламные блоки.
Проблема возникла после неудачной установки Excel из неизвестного источника (при установке все чекбоксы были отключены)
Логи прикрепляю.

Уважаемый(ая) [B]Raxmetof[/B], спасибо за обращение на наш форум!

Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="http://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

Выполните скрипт в AVZ
[code]begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\mystartsearch\UninstallManager.exe','');
QuarantineFile('c:\task.vbs','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Local\Host installer\1794406550_installspro.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\U0WmHDJzXA59w9NraU.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\YragMzLsH.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\rVN1n2C0CXN7uEMqKhAav3NA.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\sakiwxmWVDtJ5.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\TQasrFYa8.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\rSNWXrkSYRip6Xwd.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\rSNWXrkSYRip6X.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\rFM4E7dIyjaYApNHc0AuPOy.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\RBfw24nSErhc.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\p9GIkJfOpscrElKl1zonaEu.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\Oloh3EL6TbBUJo8LJ6jRJ1.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\mZJW0jFoUH0Kb0.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\MHMAgSa6InQihwyfOskg.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\m4NDnIuj32lhBSfb1NIqz.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\LDuNv8oRaoq0.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\Jcs2Ecd.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\ESOIvckLHdD.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\B8YSfUEoyLp0jTnPT7RFBS.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\cEqvGQ9mLMvITeab0dDm3.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\5A6MBbePlx.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\7olJhONCjIgri0ySJNQxlwbo.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\9HVQunsdAQI8eTtZj0yJHqvAxh.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-6.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-5.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-4.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-3.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-10.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6.exe','');
QuarantineFile('C:\Users\eshtokin.a\AppData\Roaming\2c7XkGvKJd4fTYz74MZOGa1.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-6.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-5.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-4.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-3.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-10.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-7.exe','');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6.exe','');
QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe','');
QuarantineFile('C:\Windows\system32\drivers\wsafd_1_10_0_19.sys','');
DeleteService('wsafd_1_10_0_19');
SetServiceStart('WdsManPro', 4);
DeleteService('WdsManPro');
SetServiceStart('qorobury', 4);
DeleteService('qorobury');
QuarantineFile('C:\Windows\system32\drivers\wwfd_vt_1_10_0_24.sys','');
TerminateProcessByName('c:\program files (x86)\wordwizard_1.10.0.24\service\wwsvc.exe');
QuarantineFile('c:\program files (x86)\wordwizard_1.10.0.24\service\wwsvc.exe','');
TerminateProcessByName('c:\programdata\iwdsmanproi\wdsmanpro.exe');
QuarantineFile('c:\programdata\iwdsmanproi\wdsmanpro.exe','');
TerminateProcessByName('c:\program files (x86)\19d78e80-1439453513-11dd-b096-7824af9fd644\knsg37db.tmp');
QuarantineFile('c:\program files (x86)\19d78e80-1439453513-11dd-b096-7824af9fd644\knsg37db.tmp','');
TerminateProcessByName('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-64.exe');
QuarantineFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-64.exe','');
TerminateProcessByName('c:\program files (x86)\ciplus-4.5vv05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6.exe');
QuarantineFile('c:\program files (x86)\ciplus-4.5vv05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6.exe','');
TerminateProcessByName('c:\program files (x86)\ciplus-4.5vv05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-10.exe');
QuarantineFile('c:\program files (x86)\ciplus-4.5vv05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-10.exe','');
TerminateProcessByName('c:\program files (x86)\ciplus-4.5vv05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6.exe');
QuarantineFile('c:\program files (x86)\ciplus-4.5vv05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6.exe','');
DeleteFile('c:\program files (x86)\ciplus-4.5vv05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6.exe','32');
DeleteFile('c:\program files (x86)\ciplus-4.5vv05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-10.exe','32');
DeleteFile('c:\program files (x86)\ciplus-4.5vv05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-64.exe','32');
DeleteFile('c:\program files (x86)\19d78e80-1439453513-11dd-b096-7824af9fd644\knsg37db.tmp','32');
DeleteFile('c:\programdata\iwdsmanproi\wdsmanpro.exe','32');
DeleteFile('c:\program files (x86)\wordwizard_1.10.0.24\service\wwsvc.exe','32');
DeleteFile('C:\Windows\system32\drivers\wwfd_vt_1_10_0_24.sys','32');
DeleteFile('C:\Windows\system32\drivers\wsafd_1_10_0_19.sys','32');
DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Timestasks');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-10.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-3.exe','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-3.job','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-10_user.job','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-1-7.job','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-4.exe','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-4.job','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-5.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-5.exe','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-5_user.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-6.exe','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-6.job','32');
DeleteFile('C:\Windows\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-7.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\03baa81a-b065-4813-9e42-0fbcec6b5980-7.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\2c7XkGvKJd4fTYz74MZOGa1.exe','32');
DeleteFile('C:\Windows\Tasks\2c7XkGvKJd4fTYz74MZOGa1.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6.exe','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6.job','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-1-7.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-10.exe','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-10_user.job','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-3.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-3.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-4.exe','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-4.job','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-5.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-5.exe','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-5_user.job','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-6.job','32');
DeleteFile('C:\Windows\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-7.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-7.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV05.10\4523d32a-cea5-429f-8692-6b62627c9ed3-6.exe','32');
DeleteFile('C:\Windows\Tasks\5A6MBbePlx.job','32');
DeleteFile('C:\Windows\Tasks\7olJhONCjIgri0ySJNQxlwbo.job','32');
DeleteFile('C:\Windows\Tasks\9HVQunsdAQI8eTtZj0yJHqvAxh.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\9HVQunsdAQI8eTtZj0yJHqvAxh.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\7olJhONCjIgri0ySJNQxlwbo.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\5A6MBbePlx.exe','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-1-6.job','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-1-7.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV14.08\b51d1684-cda6-4748-8b55-d7d2154e48ae-1-7.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV14.08\b51d1684-cda6-4748-8b55-d7d2154e48ae-1-6.exe','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-10_user.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV14.08\b51d1684-cda6-4748-8b55-d7d2154e48ae-10.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV14.08\b51d1684-cda6-4748-8b55-d7d2154e48ae-3.exe','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-3.job','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-4.job','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV14.08\b51d1684-cda6-4748-8b55-d7d2154e48ae-4.exe','32');
DeleteFile('C:\Program Files (x86)\CiPlus-4.5vV14.08\b51d1684-cda6-4748-8b55-d7d2154e48ae-5.exe','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-5.job','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-5_user.job','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-6.job','32');
DeleteFile('C:\Windows\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-7.job','32');
DeleteFile('C:\Windows\Tasks\B8YSfUEoyLp0jTnPT7RFBS.job','32');
DeleteFile('C:\Windows\Tasks\cEqvGQ9mLMvITeab0dDm3.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\cEqvGQ9mLMvITeab0dDm3.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\B8YSfUEoyLp0jTnPT7RFBS.exe','32');
DeleteFile('C:\Windows\Tasks\Crossbrowse.job','32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe','32');
DeleteFile('C:\Windows\Tasks\ESOIvckLHdD.job','32');
DeleteFile('C:\Windows\Tasks\fH6DX334eq.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\fH6DX334eq.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\ESOIvckLHdD.exe','32');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job','32');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job','32');
DeleteFile('C:\Windows\Tasks\Jcs2Ecd.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\Jcs2Ecd.exe','32');
DeleteFile('C:\Windows\Tasks\LDuNv8oRaoq0.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\LDuNv8oRaoq0.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\m4NDnIuj32lhBSfb1NIqz.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\MHMAgSa6InQihwyfOskg.exe','32');
DeleteFile('C:\Windows\Tasks\MHMAgSa6InQihwyfOskg.job','32');
DeleteFile('C:\Windows\Tasks\m4NDnIuj32lhBSfb1NIqz.job','32');
DeleteFile('C:\Windows\Tasks\mZJW0jFoUH0Kb0.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\mZJW0jFoUH0Kb0.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\Oloh3EL6TbBUJo8LJ6jRJ1.exe','32');
DeleteFile('C:\Windows\Tasks\Oloh3EL6TbBUJo8LJ6jRJ1.job','32');
DeleteFile('C:\Windows\Tasks\p9GIkJfOpscrElKl1zonaEu.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\p9GIkJfOpscrElKl1zonaEu.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\RBfw24nSErhc.exe','32');
DeleteFile('C:\Windows\Tasks\RBfw24nSErhc.job','32');
DeleteFile('C:\Windows\Tasks\rFM4E7dIyjaYApNHc0AuPOy.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\rFM4E7dIyjaYApNHc0AuPOy.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\rSNWXrkSYRip6X.exe','32');
DeleteFile('C:\Windows\Tasks\rSNWXrkSYRip6X.job','32');
DeleteFile('C:\Windows\Tasks\rSNWXrkSYRip6Xwd.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\rSNWXrkSYRip6Xwd.exe','32');
DeleteFile('C:\Windows\Tasks\rVN1n2C0CXN7uEMqKhAav3NA.job','32');
DeleteFile('C:\Windows\Tasks\sakiwxmWVDtJ5.job','32');
DeleteFile('C:\Windows\Tasks\TQasrFYa8.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\TQasrFYa8.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\sakiwxmWVDtJ5.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\rVN1n2C0CXN7uEMqKhAav3NA.exe','32');
DeleteFile('C:\Windows\Tasks\U0WmHDJzXA59w9NraU.job','32');
DeleteFile('C:\Windows\Tasks\YragMzLsH.job','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\YragMzLsH.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\U0WmHDJzXA59w9NraU.exe','32');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-10_user','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-3','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-4','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-5','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-5_user','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-6','64');
DeleteFile('C:\Windows\system32\Tasks\03baa81a-b065-4813-9e42-0fbcec6b5980-7','64');
DeleteFile('C:\Windows\system32\Tasks\2c7XkGvKJd4fTYz74MZOGa1','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-10_user','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-3','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-4','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-5','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-5_user','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-6','64');
DeleteFile('C:\Windows\system32\Tasks\4523d32a-cea5-429f-8692-6b62627c9ed3-7','64');
DeleteFile('C:\Windows\system32\Tasks\5A6MBbePlx','64');
DeleteFile('C:\Windows\system32\Tasks\7olJhONCjIgri0ySJNQxlwbo','64');
DeleteFile('C:\Windows\system32\Tasks\9HVQunsdAQI8eTtZj0yJHqvAxh','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-1-6','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-1-7','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-10_user','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-3','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-4','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-5','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-5_user','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-6','64');
DeleteFile('C:\Windows\system32\Tasks\b51d1684-cda6-4748-8b55-d7d2154e48ae-7','64');
DeleteFile('C:\Windows\system32\Tasks\B8YSfUEoyLp0jTnPT7RFBS','64');
DeleteFile('C:\Windows\system32\Tasks\C45982F1-F30-4C6E-8791-70BFDAB61DD9','64');
DeleteFile('C:\Windows\system32\Tasks\cEqvGQ9mLMvITeab0dDm3','64');
DeleteFile('C:\Windows\system32\Tasks\Crossbrowse','64');
DeleteFile('C:\Windows\system32\Tasks\ESOIvckLHdD','64');
DeleteFile('C:\Windows\system32\Tasks\fH6DX334eq','64');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineCore','64');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineUA','64');
DeleteFile('C:\Windows\system32\Tasks\Jcs2Ecd','64');
DeleteFile('C:\Windows\system32\Tasks\LDuNv8oRaoq0','64');
DeleteFile('C:\Windows\system32\Tasks\m4NDnIuj32lhBSfb1NIqz','64');
DeleteFile('C:\Windows\system32\Tasks\MHMAgSa6InQihwyfOskg','64');
DeleteFile('C:\Windows\system32\Tasks\mZJW0jFoUH0Kb0','64');
DeleteFile('C:\Windows\system32\Tasks\Oloh3EL6TbBUJo8LJ6jRJ1','64');
DeleteFile('C:\Windows\system32\Tasks\p9GIkJfOpscrElKl1zonaEu','64');
DeleteFile('C:\Windows\system32\Tasks\RBfw24nSErhc','64');
DeleteFile('C:\Windows\system32\Tasks\rFM4E7dIyjaYApNHc0AuPOy','64');
DeleteFile('C:\Windows\system32\Tasks\rSNWXrkSYRip6X','64');
DeleteFile('C:\Windows\system32\Tasks\rSNWXrkSYRip6Xwd','64');
DeleteFile('C:\Windows\system32\Tasks\runTask','64');
DeleteFile('C:\Users\eshtokin.a\AppData\Local\Temp\Updater.exe','32');
DeleteFile('C:\Windows\system32\Tasks\rVN1n2C0CXN7uEMqKhAav3NA','64');
DeleteFile('C:\Windows\system32\Tasks\sakiwxmWVDtJ5','64');
DeleteFile('C:\Users\eshtokin.a\AppData\Local\Host installer\1794406550_installspro.exe','32');
DeleteFile('C:\Windows\system32\Tasks\Soft installer','64');
DeleteFile('C:\Windows\system32\Tasks\TQasrFYa8','64');
DeleteFile('C:\Windows\system32\Tasks\U0WmHDJzXA59w9NraU','64');
DeleteFile('C:\Windows\system32\Tasks\updateTask','64');
DeleteFile('c:\task.vbs','32');
DeleteFile('C:\Windows\system32\Tasks\YragMzLsH','64');
DeleteFile('C:\Windows\system32\Tasks\{7C72143F-1EB7-4E05-B762-8C12E5D229B1}','64');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\mystartsearch\UninstallManager.exe','32');
DeleteFile('C:\Users\eshtokin.a\AppData\Roaming\istartsurf\UninstallManager.exe','32');
DeleteFile('C:\Windows\system32\Tasks\{BA3F566E-1412-49B8-B04E-587B91406954}','64');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.[/code]Будет выполнена перезагрузка компьютера.

Выполните скрипт в AVZ
[code]begin
CreateQurantineArchive('c:\quarantine.zip');
end.[/code][b]c:\quarantine.zip[/b] пришлите по красной ссылке [color="Red"][u][b]Прислать запрошенный карантин[/b][/u][/color] [b]над первым сообщением[/b] в Вашей теме.

[B][COLOR="Red"]Выполните правила ЕЩЕ РАЗ и предоставьте НОВЫЕ логи[/COLOR][/B]

Спасибо. Все сделал, новые логи прикрепил. Проблема сохраняется.

Кто Вас просил править логи в первом сообщении? Новые логи прикрепляют к очередному сообщению в теме

Сделайте лог [url="http://virusinfo.info/showthread.php?t=53070&p=1104657&viewfull=1#post1104657"]полного сканирования МВАМ[/url]

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]21[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\users\eshtokin.a\appdata\roaming\b8ysfueoylp0jtnpt7rfbs.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\ceqvgq9mlmviteab0ddm3.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\esoivcklhdd.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\jcs2ecd.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\ldunv8oraoq0.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\mhmagsa6inqihwyfoskg.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\mzjw0jfouh0kb0.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\m4ndniuj32lhbsfb1niqz.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\rbfw24nserhc.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\rfm4e7diyjayapnhc0aupoy.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\rsnwxrksyrip6x.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\rsnwxrksyrip6xwd.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\rvn1n2c0cxn7uemqkhaav3na.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\sakiwxmwvdtj5.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\tqasrfya8.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\u0wmhdjzxa59w9nrau.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\yragmzlsh.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\2c7xkgvkjd4ftyz74mzoga1.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.fte[/B][*] c:\users\eshtokin.a\appdata\roaming\5a6mbbeplx.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][*] c:\users\eshtokin.a\appdata\roaming\7oljhoncjigri0ysjnqxlwbo.exe - [B]not-a-virus:WebToolbar.Win32.CroRi.glx[/B][/LIST][/LIST]