z-connect

1. Отключите восстановление системы и антивирус.
2. [URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ:[/URL]

[CODE]begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DelCLSID('67KLN5J0-4OPM-00WE-AAX5-14KC2A323342');
DelCLSID('67KLN5J0-4OPM-00WE-AAX5-74CC2A323342');
DelCLSID('67KLN5J0-4OPM-00WE-AAX5-77EF1D187322');
DelCLSID('67KLN5J0-4OPM-33WE-AAX5-24KC2A3453431');
DelCLSID('67KLN5J0-4OPM-33WE-AAX5-34KC2A3453431');
QuarantineFile('C:\SETUP\DATA\June.exe','');
QuarantineFile('c:\NEXT\FILES\NEXT.exe','');
QuarantineFile('C:\RESTORE\k-1-3542-4232123213-7676767-8888886\BLUE.exe','');
QuarantineFile('C:\BIN\RECYCLE\Bin.exe','');
QuarantineFile('C:\SYSTEM\FILES\ARMY.exe','');
DelBHO('{92780B25-18CC-41C8-B9BE-3C9C571A8263}');
DelBHO('{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}');
DelBHO('{95289393-33EA-4F8D-B952-483415B9C955}');
QuarantineFile('D:\DOCUME~1\4D8C7~1\LOCALS~1\Temp\sfareca00001.dll','');
QuarantineFile('D:\DOCUME~1\4D8C7~1\LOCALS~1\Temp\sfamcc00001.dll','');
DeleteFile('D:\DOCUME~1\4D8C7~1\LOCALS~1\Temp\sfamcc00001.dll');
DeleteFile('D:\DOCUME~1\4D8C7~1\LOCALS~1\Temp\sfareca00001.dll');
DeleteFile('D:\Documents and Settings\УССТ 4\Application Data\Microsoft\Internet Explorer\qipsearchbar.dll');
DeleteFile('C:\SYSTEM\FILES\ARMY.exe');
DeleteFile('C:\BIN\RECYCLE\Bin.exe');
DeleteFile('C:\RESTORE\k-1-3542-4232123213-7676767-8888886\BLUE.exe');
DeleteFile('c:\NEXT\FILES\NEXT.exe');
DeleteFile('C:\SETUP\DATA\June.exe');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(1);
BC_Activate;
RebootWindows(true);
end.[/CODE]
После выполнения скрипта компьютер перезагрузится!
Пришлите карантин согласно [B]приложению 3[/B] [URL="http://virusinfo.info/pravila.html"]правил.[/URL]
Загружать по ссылке: [url]http://virusinfo.info/upload_virus.php?tid=48604[/url]

3. Соединение z-connect удалите.
4. Повторите логи.