появляется окно "Warning! Spyware detected on your computer! + заражен файл c:\Windows\SYSTEM32\winctrl32.dll

При загрузке системы появляется окно "Warning! Spyware detected on your computer! Install an antivirus or spyware remover to clean your computer". Также в свойствах экрана перестали отображаться вкладки "рабочий стол" и "заставка".

+ заражен файл c:\Windows\SYSTEM32\winctrl32.dll

выполните скрипт ....
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\drivers\Winqv61.sys','');
QuarantineFile('C:\WINDOWS\system32\syst251.dll','');
QuarantineFile('C:\WINDOWS\system32\rsnmp32.dll','');
QuarantineFile('C:\WINDOWS\system32\oembios.exe','');
QuarantineFile('C:\WINDOWS\system32\ntos.exe','');
QuarantineFile('C:\WINDOWS\BYSASCAJ.exe','');
DeleteService('Winaf48');
DeleteService('Winaf61');
DeleteService('Winbg72');
DeleteService('Winch50');
DeleteService('Windi04');
DeleteService('Winej37');
DeleteService('Winfk72');
DeleteService('Wingk48');
DeleteService('Wingl61');
DeleteService('Winhl37');
DeleteService('Winhm15');
DeleteService('Winhm37');
DeleteService('Winjo50');
DeleteService('Winko50');
DeleteService('Winkp61');
DeleteService('Winlq72');
DeleteService('Winlq83');
DeleteService('Winmr83');
DeleteService('Winot26');
DeleteService('Winpu26');
DeleteService('Winpv48');
DeleteService('Winrw48');
DeleteService('Winty26');
DeleteService('Winvb15');
DeleteService('WZCSVCWebClientwscsvc');
DeleteService('wuauservSCardSvrRemoteAccessWebClient');
DeleteService('wuauservSCardSvr');
DeleteService('WmiNtmsSvc');
DeleteService('WmdmPmSN Driver HPZ12');
DeleteService('WebClientwscsvc');
DeleteService('WebClientMSDTC');
DeleteService('WebClientDcomLaunch');
DeleteService('Spoolerdmadmin');
DeleteService('SharedAccesswuauserv');
DeleteService('SENSmnmsrvcPolicyAgent');
DeleteService('RpcLocatorstisvc');
DeleteService('RemoteRegistrySCardSvr');
DeleteService('RemoteAccessWebClientmnmsrvcPolicyAgentRDSessMgr');
DeleteService('RemoteAccessWebClient');
DeleteService('RasManRemoteRegistrySCardSvr');
DeleteService('RasManLmHosts');
DeleteService('PolicyAgentSpooler');
DeleteService('PolicyAgentSchedule');
DeleteService('NlaRasManUMWdf');
DeleteService('NlaRasMan');
DeleteService('NlaPolicyAgentSchedule');
DeleteService('NetDDEPlugPlay');
DeleteService('mnmsrvcPolicyAgentRDSessMgrTrkWks');
DeleteService('mnmsrvcPolicyAgentRDSessMgr');
DeleteService('EventlogWmiApSrvClipSrvWmiApSrv');
DeleteService('FastUserSwitchingCompatibilityDcomLaunch');
DeleteService('FirebirdGuardianDefaultInstanceNlaRasMan');
DeleteService('FirebirdGuardianDefaultInstanceNlaRasManRSVP');
DeleteService('ClipSrvWmiApSrv');
DeleteService('BITSERSvc');
DeleteService('AudioSrvmnmsrvc');
DeleteService('ALGEventSystem');
QuarantineFile('srv.exe','');
DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
DeleteFile('srv.exe');
DeleteFile('C:\WINDOWS\System32\Drivers\Winaf48.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winaf61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winbg72.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winch50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winfk72.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wingk48.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wingl61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wingm26.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winhl37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winhm15.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winhm37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winin50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winio61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winjo50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winko50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winkp61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlq72.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlq83.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winmr83.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winot26.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winpu26.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winpv48.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winrw48.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winty26.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winvb15.sys');
DeleteFile('C:\WINDOWS\system32\blphcvl6j0epf9.scr');
DeleteFile('C:\WINDOWS\BYSASCAJ.exe');
DeleteFile('C:\WINDOWS\system32\ntos.exe');
DeleteFile('C:\WINDOWS\system32\oembios.exe');
DeleteFile('C:\WINDOWS\system32\rsnmp32.dll');
DeleteFile('WinCtrl32.dll');
DeleteFile('C:\WINDOWS\system32\syst251.dll');
DeleteFile('C:\WINDOWS\system32\drivers\Winqv61.sys');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(5);
ExecuteRepair(6);
ExecuteRepair(8);
BC_Activate;
RebootWindows(true);
end.
[/code]
пришлите карантин согласно приложения 3 правил ...
повторите логи ...

карантин закачал.
заново сгенерировать логи и выложить?
PS:
надо ли предварительно удалить имеющиеся логи?

сделать новые логи ... старые удалять не нужно...

вот логи:

выполните скрипт ...
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('Winxe04');
DeleteService('Winej37');
DeleteService('Windi04');
DeleteService('RPSPUSRQ');
QuarantineFile('C:\WINDOWS\system32\drivers\RPSPUSRQ.sys','');
QuarantineFile('C:\WINDOWS\TEMP\3aa07293.tmp srv','');
DeleteService('mnmsrvcPolicyAgent');
DeleteService('WebClientMSDTCHTTPFilter');
DeleteFile('srv.exe');
DeleteFile('C:\WINDOWS\TEMP\3aa07293.tmp srv');
DeleteFile('C:\WINDOWS\system32\drivers\RPSPUSRQ.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Windi04.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winej37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxe04.sys');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/code]
пришлите карантин согласно приложения 3 правил ...
повторите логи ...

карантин закачал.

логи:

Пофиксите в HijackThis:
[code]
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [syscache] C:\Program Files\Windows NT\NTmon.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\
[/code]
Очистите папку:
C:\Program Files\DrWeb Enterprise Suite\Infected.!!!

Больше ничего плохого не видно.

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]2[/B][*]Обработано файлов: [B]10[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]