пропадает рабочий стол

Вложений: 3

Здравствуйте.
Второй раз пропадает "рабочий стол". Процесс "explorer" не запускается, в безопасном режиме "Рабочий стол" отображается.
Первый раз вылечили при помощи загрузки с флэш-карты и сканирования дисков DrWeb. Сейчас удалось решить проблему запуском DrWeb из под "Диспетчера задач". После проверки были созданы данные Log-и.
Спасибо.

Уважаемый(ая) [B]SibSim 1441716028[/B], спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="http://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

Выполните скрипт в AVZ
[code]begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Program Files\content defender\nss\certutil.exe','');
QuarantineFile('C:\Program Files\content defender\nfregdrv.exe','');
QuarantineFile('C:\Program Files\content defender\import_root_cert.exe','');
QuarantineFile('C:\Program Files\content defender\contentdefenderps.dll','');
QuarantineFile('C:\Program Files\content defender\contentdefender.exe','');
QuarantineFile('C:\Program Files\content defender\condefclean.exe','');
QuarantineFile('C:\Users\Яна Сергеевна\appdata\roaming\daemon2.exe','');
QuarantineFile('C:\Windows\system32\hfpapi.dll','');
QuarantineFile('C:\Users\Яна Сергеевна\AppData\Roaming\mystartsearch\UninstallManager.exe','');
QuarantineFile('C:\Users\Яна Сергеевна\AppData\Roaming\WindowsUpdater\Updater.exe','');
QuarantineFile('C:\Users\Яна Сергеевна\AppData\Local\Web Experience Kit\xBin\WebExperienceKit.dll','');
QuarantineFile('C:\Program Files\Visual Protect Service\VSProtector.exe','');
QuarantineFile('C:\Program Files\ShopperPro\updater.exe','');
QuarantineFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','');
QuarantineFile('C:\Program Files\Zaxar\ZaxarGameBrowser.exe','');
QuarantineFile('C:\Program Files\YTDownloader\YTDownloader.exe','');
QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe','');
QuarantineFile('C:\Program Files\ShopperPro\JSDriver\1.42.1.2719\jsdrv.exe','');
QuarantineFile('C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe','');
QuarantineFile('C:\Program Files\Sound+\Sound+.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010219\gmsd_ru_005010219.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010218\gmsd_ru_005010218.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010216\gmsd_ru_005010216.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010215\gmsd_ru_005010215.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010214\gmsd_ru_005010214.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010213\gmsd_ru_005010213.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010212\gmsd_ru_005010212.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010211\gmsd_ru_005010211.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010210\gmsd_ru_005010210.exe','');
QuarantineFile('C:\Program Files\gmsd_ru_005010181\gmsd_ru_005010181.exe','');
QuarantineFile('C:\Users\Яна Сергеевна\AppData\Roaming\VOPackage\VOPackage.exe','');
DeleteService('ccnfd_1_10_0_2');
DeleteService('SPDRIVER_1.42.1.2719');
DeleteService('swsedrvr_vt_1_10_0_25');
DeleteService('wpnfd_1_10_0_4');
DeleteService('wsafd_1_10_0_19');
QuarantineFile('C:\Windows\system32\drivers\wsafd_1_10_0_19.sys','');
QuarantineFile('C:\Windows\system32\drivers\swsedrvr_vt_1_10_0_25.sys','');
QuarantineFile('C:\Program Files\ShopperPro\JSDriver\1.42.1.2719\jsdrv.sys','');
QuarantineFile('C:\Program Files\Common Files\ShopperPro\spbiw.sys','');
QuarantineFile('C:\Program Files\QualityChecker\qc.sys','');
QuarantineFile('C:\Windows\system32\drivers\ccnfd_1_10_0_2.sys','');
SetServiceStart('MPCBase', 4);
SetServiceStart('MPCKpt', 4);
DeleteService('MPCKpt');
DeleteService('MPCBase');
DeleteService('xifirydy');
DeleteService('wulezecezbt');
DeleteService('wucunuvy');
DeleteService('WdMan');
DeleteService('SysTesterSvc');
DeleteService('pywyfiru');
DeleteService('ohnuze');
DeleteService('ginoquci');
DeleteService('Dripkix');
DeleteService('dlohn');
DeleteService('bitykywy');
QuarantineFile('C:\Program Files\46364331-1447640982-4242-4139-3744FFFFFFFF\hnsvA1AD.tmp','');
QuarantineFile('C:\Program Files\46364331-1445829997-4242-4139-3744FFFFFFFF\knsjFE7B.tmp','');
QuarantineFile('C:\ProgramData\vWdMv\WdMan.exe','');
QuarantineFile('C:\Program Files\Dripkix\packages\0e8f0b15-4e6b-4393-99b0-d22b6d749d20\runner.exe','');
QuarantineFile('C:\Program Files\46364331-1439969468-4242-4139-3744FFFFFFFF\knsmA779.tmp','');
QuarantineFile('C:\ProgramData\ohnuze\ohnuze.exe','');
QuarantineFile('C:\Users\F835~1\AppData\Local\Temp\nst1513.tmp','');
QuarantineFile('C:\Program Files\Dripkix\Dripkix.exe','');
QuarantineFile('C:\ProgramData\dlohn\dlohn.exe','');
QuarantineFile('C:\Program Files\46364331-1445829997-4242-4139-3744FFFFFFFF\knse20F6.tmp','');
QuarantineFile('C:\Windows\System32\drivers\MPCBase.sys','');
QuarantineFile('C:\Windows\system32\DRIVERS\MPCKpt.sys','');
TerminateProcessByName('c:\program files\mpc cleaner\mpcnews.exe');
QuarantineFile('c:\program files\mpc cleaner\mpcnews.exe','');
DeleteFile('c:\program files\mpc cleaner\mpcnews.exe','32');
DeleteFile('C:\Windows\system32\DRIVERS\MPCKpt.sys','32');
DeleteFile('C:\Windows\System32\drivers\MPCBase.sys','32');
DeleteFile('C:\Program Files\46364331-1445829997-4242-4139-3744FFFFFFFF\knse20F6.tmp','32');
DeleteFile('C:\ProgramData\dlohn\dlohn.exe','32');
DeleteFile('C:\Program Files\Dripkix\Dripkix.exe','32');
DeleteFile('C:\Users\F835~1\AppData\Local\Temp\nst1513.tmp','32');
DeleteFile('C:\ProgramData\ohnuze\ohnuze.exe','32');
DeleteFile('C:\Program Files\46364331-1439969468-4242-4139-3744FFFFFFFF\knsmA779.tmp','32');
DeleteFile('C:\Program Files\Dripkix\packages\0e8f0b15-4e6b-4393-99b0-d22b6d749d20\runner.exe','32');
DeleteFile('C:\ProgramData\vWdMv\WdMan.exe','32');
DeleteFile('C:\Program Files\46364331-1445829997-4242-4139-3744FFFFFFFF\knsjFE7B.tmp','32');
DeleteFile('C:\Program Files\46364331-1453685836-4242-4139-3744FFFFFFFF\knsaBAFE.tmp','32');
DeleteFile('C:\Program Files\46364331-1447640982-4242-4139-3744FFFFFFFF\hnsvA1AD.tmp','32');
DeleteFile('C:\Windows\system32\drivers\ccnfd_1_10_0_2.sys','32');
DeleteFile('C:\Program Files\QualityChecker\qc.sys','32');
DeleteFile('C:\Program Files\Common Files\ShopperPro\spbiw.sys','32');
DeleteFile('C:\Program Files\ShopperPro\JSDriver\1.42.1.2719\jsdrv.sys','32');
DeleteFile('C:\Windows\system32\drivers\swsedrvr_vt_1_10_0_25.sys','32');
DeleteFile('C:\Windows\system32\drivers\wsafd_1_10_0_19.sys','32');
DeleteFile('C:\Users\Яна Сергеевна\AppData\Roaming\VOPackage\VOPackage.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\RunOnce-','Update');
DeleteFile('C:\Program Files\baidu\ppt.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\apphide','command');
DeleteFile('C:\Program Files\gmsd_ru_005010183\gmsd_ru_005010183.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010204\gmsd_ru_005010204.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010210\gmsd_ru_005010210.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010211\gmsd_ru_005010211.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010212\gmsd_ru_005010212.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010213\gmsd_ru_005010213.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010214\gmsd_ru_005010214.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010215\gmsd_ru_005010215.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010216\gmsd_ru_005010216.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010218\gmsd_ru_005010218.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_005010219\gmsd_ru_005010219.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010219','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010218','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010216','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010215','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010214','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010213','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010212','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010211','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010210','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010204','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010183','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010181','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_005010179','command');
DeleteFile('C:\Program Files\Sound+\Sound+.exe','32');
DeleteFile('C:\Program Files\ShopperPro\JSDriver\1.42.1.2719\jsdrv.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SPDriver','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Timestasks','command');
DeleteFile('C:\Program Files\Zaxar\ZaxarGameBrowser.exe','32');
DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarLoader','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarGameBrowser','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YTDownloader','command');
DeleteFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job','32');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP1','32');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP3','32');
DeleteFile('C:\Windows\system32\Tasks\ShopperProJSUpd','32');
DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','32');
DeleteFile('C:\Users\Яна Сергеевна\AppData\Local\SmartWeb\SmartWebHelper.exe','32');
DeleteFile('C:\Windows\system32\Tasks\SPBIW_UpdateTask_Time_333339373234303033312d235b783432415b45345a2d6c','32');
DeleteFile('C:\Windows\system32\Tasks\SPDriver','32');
DeleteFile('C:\Windows\system32\Tasks\VSProtector','32');
DeleteFile('C:\Program Files\Visual Protect Service\VSProtector.exe','32');
DeleteFile('C:\Windows\system32\Tasks\Web Experience Kit','32');
DeleteFile('C:\Windows\system32\Tasks\WindowsUpdater3','32');
DeleteFile('C:\Users\Яна Сергеевна\AppData\Roaming\WindowsUpdater\Updater.exe','32');
DeleteFile('C:\Users\Яна Сергеевна\AppData\Roaming\mystartsearch\UninstallManager.exe','32');
DeleteFile('C:\Windows\system32\Tasks\{C01C7FC8-9A00-462A-B8E1-34908CE4F96E}','32');
DeleteFile('C:\Windows\system32\Tasks\{F8878910-BD85-4973-8F60-285AD63AEC51}','32');
DeleteFile('C:\Windows\system32\hfpapi.dll','32');
DeleteFile('C:\Users\Яна Сергеевна\appdata\local\smartweb\__u.exe','32');
DeleteFile('C:\Users\Яна Сергеевна\appdata\roaming\daemon2.exe','32');
DeleteFile('C:\Program Files\content defender\condefclean.exe','32');
DeleteFile('C:\Program Files\content defender\contentdefender.exe','32');
DeleteFile('C:\Program Files\content defender\contentdefenderps.dll','32');
DeleteFile('C:\Program Files\content defender\import_root_cert.exe','32');
DeleteFile('C:\Program Files\content defender\nfregdrv.exe','32');
DeleteFile('C:\Program Files\content defender\nss\certutil.exe','32');
DeleteFile('C:\Program Files\content defender\nss\mozcrt19.dll','32');
DeleteFile('C:\Program Files\content defender\nss\nspr4.dll','32');
DeleteFile('C:\Program Files\content defender\nss\nss3.dll','32');
DeleteFile('C:\Program Files\content defender\nss\plc4.dll','32');
DeleteFile('C:\Program Files\content defender\nss\plds4.dll','32');
DeleteFile('C:\Program Files\content defender\nss\smime3.dll','32');
DeleteFile('C:\Program Files\content defender\nss\softokn3.dll','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.[/code]Будет выполнена перезагрузка компьютера.

Выполните скрипт в AVZ
[code]begin
CreateQurantineArchive('c:\quarantine.zip');
end.[/code][b]c:\quarantine.zip[/b] пришлите по красной ссылке [color="Red"][u][b]Прислать запрошенный карантин[/b][/u][/color] [b]над первым сообщением[/b] в Вашей теме.

[B][COLOR="Red"]Выполните правила ЕЩЕ РАЗ и предоставьте НОВЫЕ логи[/COLOR][/B]