Zaxar, UC, nw.com и многое другое - все вместе

Windows 7 - хотела поставить драйвер для смартфона Lenovo - теперь у меня и UCбраузер, и юнити, и мейлру, и всплывающая реклама от nw.cov, и ссылки на игры и т.д. - пробовала удалять вручную, чистила и комп и реестр - на утро все появляется снова.

Уважаемый(ая) [B]Олена Фурсович[/B], спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в [URL="http://virusinfo.info/pravila.html"]правилах оформления запроса о помощи[/URL].

[INFORMATION]Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом [URL="http://virusinfo.info/content.php?r=613-sub_pomogite"]Помогите+[/URL].[/INFORMATION]

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"]поддержите проект[/URL].

[B]Здравствуйте![/B]

Вам необходимо:

[B]1.[/B] [URL="http://virusinfo.info/showthread.php?t=7239"]Выполнить[/URL] следующий скрипт в AVZ:
[CODE]
begin
TerminateProcessByName('c:\program files\zaxar\zaxarloader.exe');
TerminateProcessByName('c:\program files\zaxar\zaxargamebrowser.exe');
TerminateProcessByName('c:\program files\vf4o60swym\vf4o60swy.exe');
TerminateProcessByName('c:\program files\ucbrowser\application\ucbrowser.exe');
TerminateProcessByName('c:\program files\u6zpv8ax1w\u6zpv8ax1.exe');
TerminateProcessByName('c:\program files\diskp\swofudf9kzcdf58.exe');
TerminateProcessByName('c:\program files\diskp\rwnwilfiki76lgv.exe');
TerminateProcessByName('c:\users\Сергей\appdata\local\a15b2ca0-1487111894-11dc-8ccd-001d606f8180\qnsgc17c.tmp');
TerminateProcessByName('c:\program files\e7da388a-5790-417b-8709-28422ee226151487011440\prote7da388a-5790-417b-8709-28422ee22615.tmpfs');
TerminateProcessByName('c:\users\Сергей\appdata\roaming\vdi\shared\product updater\produpd.exe');
TerminateProcessByName('c:\program files\my web shield\mweshieldup.exe');
TerminateProcessByName('c:\program files\my web shield\mweshield.exe');
TerminateProcessByName('c:\users\Сергей\appdata\roaming\vdi\shared\product updater\monhost.exe');
TerminateProcessByName('c:\program files\e7da388a-5790-417b-8709-28422ee226151487011440\knse7da388a-5790-417b-8709-28422ee22615.tmpfs');
TerminateProcessByName('c:\program files\diskp\i4uao5n1dh4hk9l.exe');
TerminateProcessByName('c:\program files\youtube adblock\ieef\fh34mti.exe');
TerminateProcessByName('c:\program files\kg0vzjj348\eui2rn9mz.exe');
TerminateProcessByName('c:\program files\diskp\e67iy0cfzo5sshq.exe');
TerminateProcessByName('c:\program files\8f4b2jb2rd\2tljun1lm.exe');
StopService('ucdrv');
StopService('mwescontroller');
StopService('iThemes5');
StopService('xegylopo');
StopService('UCBrowserSvc');
StopService('mweshieldup');
StopService('mweshield');
StopService('gemeloki');
QuarantineFile('C:\Users\Сергей\appdata\roaming\mydesktop\linkme.exe', '');
QuarantineFile('C:\Program Files\UCBrowser\Application\6.0.1121.13\Installer\chrmstp.exe', '');
QuarantineFile('C:\Program Files\UCBrowser\Security\uclauncher.exe', '');
QuarantineFile('C:\Users\Сергей\AppData\Roaming\Adobe\Manager.exe', '');
QuarantineFile('C:\ProgramData\vCore\VCore.exe', '');
QuarantineFile('C:\Program Files\UCBrowser\Application\update_task.exe', '');
QuarantineFile('C:\Program Files\Drecaward Client\local32spl.dll', '');
QuarantineFile('C:\Program Files\Youtube AdBlock\IEEF\Duq_uyc.dll', '');
QuarantineFile('C:\Program Files\Zaxar\ZaxarLoader.exe', '');
QuarantineFile('C:\Windows\Temp\8AE5A360-F77CA8A8-A50F44B8-E8201618\qNM3XWH2t4.exe', '');
QuarantineFile('C:\Users\Сергей\AppData\Roaming\WinSnare\WinSnare.dll', '');
QuarantineFile('C:\ProgramData\WinSAPSvc\WinSAP.dll', '');
QuarantineFile('C:\Program Files\Aruwucult\cahiphagn.dll', '');
QuarantineFile('C:\Program Files\Wsuiedfuloing\graqoryclerhepysch.dll', '');
QuarantineFile('C:\Program Files\WinArcher\Archer.dll', '');
QuarantineFile('C:\Program Files\MDWG7HEGCZ\KC3QFQ94U.exe', '');
QuarantineFile('C:\Program Files\QJ7SIE2QEE\QJ7SIE2QE.exe', '');
QuarantineFile('C:\Program Files\6DVCBC213R\I22RJB822.exe', '');
QuarantineFile('C:\Program Files\UCBrowser\Security:ucdrv-x86.sys', '');
QuarantineFileF('C:\Program Files\DiskP', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('C:\ProgramData\vCore', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFile('C:\Program Files\Realtek\Realtekedaabee.dll', '');
QuarantineFile('C:\ProgramData\service.exe', '');
QuarantineFile('C:\Program Files\Common Files\Services\iThemes.dll', '');
QuarantineFile('C:\Program Files\UCBrowser\Application\UCService.exe', '');
QuarantineFile('C:\Windows\system32\drivers\mwescontroller.sys', '');
QuarantineFile('C:\Users\Сергей\AppData\Roaming\Reogtion\Reerwispthereward.dll', '');
QuarantineFile('C:\Users\Сергей\AppData\Roaming\Grjelyckojule\Shuwit.dll', '');
QuarantineFile('c:\program files\vf4o60swym\vf4o60swy.exe', '');
QuarantineFile('c:\program files\ucbrowser\application\ucbrowser.exe', '');
QuarantineFile('c:\program files\u6zpv8ax1w\u6zpv8ax1.exe', '');
QuarantineFile('c:\program files\diskp\swofudf9kzcdf58.exe', '');
QuarantineFile('c:\program files\diskp\rwnwilfiki76lgv.exe', '');
QuarantineFile('c:\users\Сергей\appdata\local\a15b2ca0-1487111894-11dc-8ccd-001d606f8180\qnsgc17c.tmp', '');
QuarantineFile('c:\program files\e7da388a-5790-417b-8709-28422ee226151487011440\prote7da388a-5790-417b-8709-28422ee22615.tmpfs', '');
QuarantineFile('c:\users\Сергей\appdata\roaming\vdi\shared\product updater\produpd.exe', '');
QuarantineFile('c:\program files\my web shield\mweshieldup.exe', '');
QuarantineFile('c:\program files\my web shield\mweshield.exe', '');
QuarantineFile('c:\users\Сергей\appdata\roaming\vdi\shared\product updater\monhost.exe', '');
QuarantineFile('c:\program files\e7da388a-5790-417b-8709-28422ee226151487011440\knse7da388a-5790-417b-8709-28422ee22615.tmpfs', '');
QuarantineFile('c:\program files\diskp\i4uao5n1dh4hk9l.exe', '');
QuarantineFile('c:\program files\youtube adblock\ieef\fh34mti.exe', '');
QuarantineFile('c:\program files\kg0vzjj348\eui2rn9mz.exe', '');
QuarantineFile('c:\program files\diskp\e67iy0cfzo5sshq.exe', '');
QuarantineFile('c:\program files\8f4b2jb2rd\2tljun1lm.exe', '');
DeleteFile('c:\program files\youtube adblock\ieef\fh34mti.exe', '32');
DeleteFile('c:\users\Сергей\appdata\local\a15b2ca0-1487111894-11dc-8ccd-001d606f8180\qnsgc17c.tmp', '32');
DeleteFile('c:\program files\ucbrowser\application\ucbrowser.exe', '32');
DeleteFile('c:\program files\zaxar\zaxargamebrowser.exe', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\6.0.1471.813\chrome.dll', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\6.0.1471.813\chrome_child.dll', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\6.0.1471.813\chrome_elf.dll', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\6.0.1471.813\libmp3lame.DLL', '32');
DeleteFile('C:\Program Files\Youtube AdBlock\IEEF\Duq_uyc.dll', '32');
DeleteFile('C:\Program Files\Youtube AdBlock\IEEF\UjIFuo.dll', '32');
DeleteFile('C:\Users\Сергей\AppData\Roaming\Grjelyckojule\Shuwit.dll', '32');
DeleteFile('C:\Users\Сергей\AppData\Roaming\Reogtion\Reerwispthereward.dll', '32');
DeleteFile('\Program Files\UCBrowser\Security', '32');
DeleteFile('C:\Program Files\UCBrowser\Security:ucdrv-x86.sys', '32');
DeleteFile('C:\Program Files\e7da388a-5790-417b-8709-28422ee226151487011440\prote7da388a-5790-417b-8709-28422ee22615.tmpfs', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\UCService.exe', '32');
DeleteFile('C:\Program Files\e7da388a-5790-417b-8709-28422ee226151487011440\knse7da388a-5790-417b-8709-28422ee22615.tmpfs', '32');
DeleteFile('C:\Program Files\Common Files\Services\iThemes.dll', '32');
DeleteFile('C:\ProgramData\service.exe', '32');
DeleteFile('C:\Program Files\DiskP\I4UAO5N1DH4HK9L.exe', '32');
DeleteFile('C:\Program Files\DiskP\E67IY0CFZO5SSHQ.exe', '32');
DeleteFile('C:\Program Files\DiskP\RWNWILFIKI76LGV.exe', '32');
DeleteFile('C:\Program Files\DiskP\SWOFUDF9KZCDF58.exe', '32');
DeleteFile('C:\Program Files\U6ZPV8AX1W\U6ZPV8AX1.exe', '32');
DeleteFile('C:\Program Files\8F4B2JB2RD\2TLJUN1LM.exe', '32');
DeleteFile('C:\Program Files\KG0VZJJ348\EUI2RN9MZ.exe', '32');
DeleteFile('C:\Program Files\VF4O60SWYM\VF4O60SWY.exe', '32');
DeleteFile('C:\Program Files\6DVCBC213R\I22RJB822.exe', '32');
DeleteFile('C:\Program Files\QJ7SIE2QEE\QJ7SIE2QE.exe', '32');
DeleteFile('C:\Program Files\MDWG7HEGCZ\KC3QFQ94U.exe', '32');
DeleteFile('C:\Program Files\WinArcher\Archer.dll', '32');
DeleteFile('C:\Program Files\Wsuiedfuloing\graqoryclerhepysch.dll', '32');
DeleteFile('C:\Program Files\Aruwucult\cahiphagn.dll', '32');
DeleteFile('C:\ProgramData\WinSAPSvc\WinSAP.dll', '32');
DeleteFile('C:\Users\Сергей\AppData\Roaming\WinSnare\WinSnare.dll', '32');
DeleteFile('C:\Windows\Temp\8AE5A360-F77CA8A8-A50F44B8-E8201618\qNM3XWH2t4.exe', '32');
DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe', '32');
DeleteFile('C:\Program Files\Drecaward Client\local32spl.dll', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\update_task.exe', '32');
DeleteFile('C:\ProgramData\vCore\VCore.exe', '32');
DeleteFile('C:\Program Files\UCBrowser\Security\uclauncher.exe', '32');
DeleteFile('C:\Program Files\UCBrowser\Application\6.0.1121.13\Installer\chrmstp.exe', '32');
DeleteFile('C:\Program Files\my web shield\mweshieldup.exe', '32');
DeleteFile('C:\Program Files\my web shield\mweshield.exe', '32');
DeleteFile('C:\Users\Сергей\appdata\roaming\vdi\shared\product updater\produpd.exe', '32');
DeleteFile('C:\Users\Сергей\appdata\roaming\vdi\shared\product updater\monhost.exe', '32');
DeleteFile('C:\Users\Сергей\appdata\roaming\mydesktop\linkme.exe', '32');
DeleteFile('C:\Users\Сергей\appdata\roaming\adobe\manager.exe', '32');
DeleteFile('C:\Windows\system32\Drivers\mwescontroller.sys', '32');
DeleteService('ucdrv');
DeleteService('mwescontroller');
DeleteService('iThemes5');
DeleteService('xegylopo');
DeleteService('UCBrowserSvc');
DeleteService('mweshieldup');
DeleteService('mweshield');
DeleteService('gemeloki');
DeleteFileMask('C:\Program Files\my web shield', '*', true);
DeleteFileMask('C:\Program Files\Zaxar', '*', true);
DeleteFileMask('C:\Program Files\UCBrowser', '*', true);
DeleteFileMask('c:\program files\diskp', '*', true);
DeleteDirectory('C:\Program Files\my web shield');
DeleteDirectory('C:\Program Files\Zaxar');
DeleteDirectory('C:\Program Files\UCBrowser');
DeleteDirectory('c:\program files\diskp');
DelBHO('{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B}');
DelCLSID('{65122CB0-EA0F-47DF-A953-017170ED12F9}');
DelCLSID('KuaiZip Shell Extension');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OMEWPRODUCT_P9DDW');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OMEWPRODUCT_Y04IA');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OMEWPRODUCT_GC8EK');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'OMEWPRODUCT_AUWS2');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'es9FMprF1s');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'zsIgi0rpKc');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'MABrNbCPmh');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', '58NRRhF9OH');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks', '{D6323A2E-EEB6-11E6-A857-64006A5CFC23}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks', '{8A2A2C62-EEB8-11E6-9AB6-64006A5CFC23}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\7BGFVZD300', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BJ7XZUHQ4Q', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\X4KO9M19NW', 'command');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\Archer\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\Covisyderderse\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\Thijutaindreigh\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\WinSAPSvc\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\WinSnare\Parameters', 'ServiceDll');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
ClearHostsFile;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 2, true);
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
RebootWindows(true);
end.
[/CODE]

Компьютер будет перезагружен.
Файл quarantine.zip из папки AVZ загрузите по ссылке [B][COLOR="#FF0000"]"Прислать запрошенный карантин"[/COLOR][/B] вверху данной темы.

[B]2.[/B] Перетащите лог Check_Browsers_LNK.log из папки с AutoLogger'ом на [URL="http://virusinfo.info/soft/tool.php?tool=ClearLNK"]утилиту ClearLNK[/URL], как показано [URL="http://dragokas.com/tools/move.gif"]на картинке[/URL].
Лог результата работы программы прикрепите в ответном письме.

[B]3.[/B] Удалите SpyHunter через "Установку и удаление программ".

[B]4.[/B] Сделайте и пришлите в ответном сообщении [URL="http://virusinfo.info/showthread.php?t=146192"]лог AdwCleaner[/URL] и новые логи AutoLogger'а.