помогите решить проблему

**владимир111111** · 28.12.2017, 18:00

после амиго мой компьютер начал тормозить

Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

**Info_bot** · 28.12.2017, 18:02

Уважаемый(ая) владимир111111, спасибо за обращение на наш форум!

Помощь в лечении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

SQ · 03.01.2018, 18:03

Здравствуйте,

AVZ выполнить следующий скрипт.
Важно на ОС: Windows Vista/7/8/8.1 AVZ запускайте через контекстное меню проводника от имени Администратора.

Код:

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.'+#13#10+'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true); 
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
DelBHO('{8DAE90AD-4583-4977-9DD4-4360F7A45C74}');
 DelBHO('{96AF5545-BC30-4E5D-8E36-836D000A1455}');
 DelBHO('{C0D38E5A-7CF8-4105-8FE8-31B81443A114}');
 DelBHO('{E4625B55-9401-4B40-B5BA-9134A41BFAA0}');
 TerminateProcessByName('c:\program files\gbemzxqzbie\wdybfcouod.exe');
 TerminateProcessByName('c:\program files\system native\main services\service.exe');
 TerminateProcessByName('c:\programdata\appriabus\appriabus.exe');
 TerminateProcessByName('c:\programdata\prefssecure\nettrans.exe');
 TerminateProcessByName('c:\programdata\tiser\run.exe');
 TerminateProcessByName('c:\users\anna\appdata\local\onesystemcare\onesystemcarez.exe');
 TerminateProcessByName('c:\users\anna\appdata\roaming\epicnet inc\cloudnet\cloudnet.exe');
 TerminateProcessByName('c:\windows\microsoft\svchost.exe');
 TerminateProcessByName('c:\windows\rss\csrss.exe');
 TerminateProcessByName('c:\windows\system32\ea3host.exe');
 TerminateProcessByName('c:\windows\windefender.exe');
 StopService('AppriabuS');
 StopService('Ea3Host');
 StopService('Nettrans');
 StopService('SvcHost Service Host');
 StopService('WinDefender');
 StopService('backlh');
 StopService('service_box.exe');
 StopService('tiser');
 DeleteService('AppriabuS');
 DeleteService('Ea3Host');
 DeleteService('Nettrans');
 DeleteService('SvcHost Service Host');
 DeleteService('WinDefender');
 DeleteService('backlh');
 DeleteService('service_box.exe');
 DeleteService('tiser');
 QuarantineFile('C:\PROGRA~1\FASTDA~1\FASTDA~1.EXE','');
 QuarantineFile('C:\PROGRA~1\ONESYS~1\SYSTEM~1.EXE','');
 QuarantineFile('C:\Program Files\Common Files\999D6D32-4296-41FB-B4AB-5E6BBE9B1627\0278382B-948D-41C4-A6BD-431856DE6403.exe','');
 QuarantineFile('C:\Program Files\GBeMZXQZBIE\IBNEvc.dll','');
 QuarantineFile('C:\Program Files\GBeMZXQZBIE\kkTQJtp.dll','');
 QuarantineFile('C:\Program Files\JjappltlpJj2X3ZA\.t13appltlpt13.vbs','');
 QuarantineFile('C:\Program Files\RrHYXuUpocPTIXdsppR\rVvaWxo.dll','');
 QuarantineFile('C:\Program Files\Snp Boost\Snp Boost.dll','');
 QuarantineFile('C:\Program Files\TwPufLOWyrxU2\FDsRuaPkOjwDf.dll','');
 QuarantineFile('C:\Program Files\Twilight Tech\KWHYTRQBTK\LJOGJGPDPZ.exe','');
 QuarantineFile('C:\Program Files\Zaxar\ZaxarLoader.exe','');
 QuarantineFile('C:\Program Files\aohGTEheqdnWC\VPLylhM.dll','');
 QuarantineFile('C:\Program Files\umkISPBbU\DRakjD.dll','');
 QuarantineFile('C:\ProgramData\7d4b4917701b4e1b941090e5e3c173cf\xvvqnDa21ch.exe','');
 QuarantineFile('C:\ProgramData\AppriabuS\AppriabuS.exe','');
 QuarantineFile('C:\ProgramData\AppriabuS\Itdomstock.reg','');
 QuarantineFile('C:\ProgramData\AppriabuS\Strongtam.dll','');
 QuarantineFile('C:\ProgramData\PrefsSecure\Nettrans.exe','');
 QuarantineFile('C:\ProgramData\bf3ead22c009470da76ad0e1cbfe84e4\O6HulQA.exe','');
 QuarantineFile('C:\ProgramData\de1ca2c9767e4d00b6efdc64a73dc694\rpCcGukFNR8.exe','');
 QuarantineFile('C:\ProgramData\tiser\run.exe','');
 QuarantineFile('C:\Users\Anna\AppData\LocalLow\DuckGo\duckgo.dll','');
 QuarantineFile('C:\Users\Anna\AppData\Local\Adobe\PPAPI\CAB549D1-95E1-4326-86A5-84B85257A605\FBA3571D-05CA-43C9-BC15-558EF4FCE369.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Local\DuckGo\duckgo.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Local\Mail.Ru\MailRuUpdater.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Local\Microsoft\Extensions\extsetup.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Local\OneSystemCare\OneSystemCarez.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Roaming\SETUPS~1\ml.py','');
 QuarantineFile('C:\Users\Anna\AppData\Roaming\curl\curl.exe','');
 QuarantineFile('C:\Users\Anna\AppData\Roaming\setupsk\ml.py','');
 QuarantineFile('C:\Users\Anna\AppData\Roaming\setupsk\python\pythonw.exe','');
 QuarantineFile('C:\Users\Anna\appdata\local\duckgo\duckgo.exe','');
 QuarantineFile('C:\Users\Anna\appdata\local\microsoft\extensions\extsetup.exe','');
 QuarantineFile('C:\Windows\Microsoft\svchost.exe','');
 QuarantineFile('C:\Windows\System32\drivers\Winmon.sys','');
 QuarantineFile('C:\Windows\System32\ihctrl32.dll','');
 QuarantineFile('C:\Windows\microsoft\svchost.exe','');
 QuarantineFile('C:\Windows\rss\csrss.exe','');
 QuarantineFile('C:\Windows\system32\DRIVERS\avgidsshimx.sys','');
 QuarantineFile('C:\Windows\system32\Ea3Host.exe','');
 QuarantineFile('C:\Windows\system32\ea3host.exe','');
 QuarantineFile('C:\Windows\system32\ihctrl32.dll','');
 QuarantineFile('C:\Windows\system32\wsaudio.dll','');
 QuarantineFile('C:\Windows\windefender.exe','');
 QuarantineFile('D:\tmp\75ce2b9d8b3f482e975d1b20c14e1327\BGVBAVQWWX.exe','');
 QuarantineFile('D:\tmp\75ce2b9d8b3f482e975d1b20c14e1327\chipset.exe','');
 QuarantineFile('D:\tmp\a50ebadb6ef34475af07938e6a508d87\NVJLWRUZJU.exe','');
 QuarantineFile('D:\tmp\a50ebadb6ef34475af07938e6a508d87\chipset.exe','');
 QuarantineFile('D:\tmp\a5a13d21f51c43fcaeca796bae992ec7\chipset.exe','');
 QuarantineFile('D:\tmp\g695F.tmp.exe','');
 QuarantineFile('c:\program files\gbemzxqzbie\wdybfcouod.exe','');
 QuarantineFile('c:\program files\system native\main services\service.exe','');
 QuarantineFile('c:\program files\system native\main services\service_box.exe','');
 QuarantineFile('c:\program files\system native\main services\start.exe','');
 QuarantineFile('c:\programdata\appriabus\appriabus.exe','');
 QuarantineFile('c:\programdata\logic cramble\set.exe','');
 QuarantineFile('c:\programdata\prefssecure\nettrans.exe','');
 QuarantineFile('c:\programdata\tiser\run.exe','');
 QuarantineFile('c:\users\anna\appdata\local\kingosoft\kingo root\update_54326\bin\kingosoftservice.exe','');
 QuarantineFile('c:\users\anna\appdata\local\onesystemcare\onesystemcarez.exe','');
 QuarantineFile('c:\users\anna\appdata\roaming\epicnet inc\cloudnet\cloudnet.exe','');
 QuarantineFile('c:\windows\microsoft\svchost.exe','');
 QuarantineFile('c:\windows\rss\csrss.exe','');
 QuarantineFile('c:\windows\system32\ea3host.exe','');
 QuarantineFile('c:\windows\windefender.exe','');
 DeleteFile('C:\PROGRA~1\ONESYS~1\SYSTEM~1.EXE','32');
 DeleteFile('C:\Program Files\Common Files\999D6D32-4296-41FB-B4AB-5E6BBE9B1627\0278382B-948D-41C4-A6BD-431856DE6403.exe','32');
 DeleteFile('C:\Program Files\GBeMZXQZBIE\IBNEvc.dll','32');
 DeleteFile('C:\Program Files\GBeMZXQZBIE\kkTQJtp.dll','32');
 DeleteFile('C:\Program Files\JjappltlpJj2X3ZA\.t13appltlpt13.vbs','32');
 DeleteFile('C:\Program Files\RrHYXuUpocPTIXdsppR\rVvaWxo.dll','32');
 DeleteFile('C:\Program Files\Snp Boost\Snp Boost.dll','32');
 DeleteFile('C:\Program Files\System Native\Main Services\service_box.exe','32');
 DeleteFile('C:\Program Files\TwPufLOWyrxU2\FDsRuaPkOjwDf.dll','32');
 DeleteFile('C:\Program Files\Twilight Tech\KWHYTRQBTK\LJOGJGPDPZ.exe','32');
 DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe','32');
 DeleteFile('C:\Program Files\aohGTEheqdnWC\VPLylhM.dll','32');
 DeleteFile('C:\Program Files\fastda~1\fastda~1.exe','32');
 DeleteFile('C:\Program Files\umkISPBbU\DRakjD.dll','32');
 DeleteFile('C:\ProgramData\7d4b4917701b4e1b941090e5e3c173cf\xvvqnDa21ch.exe','32');
 DeleteFile('C:\ProgramData\AppriabuS\AppriabuS.exe','32');
 DeleteFile('C:\ProgramData\AppriabuS\Strongtam.dll','32');
 DeleteFile('C:\ProgramData\Logic Cramble\set.exe','32');
 DeleteFile('C:\ProgramData\PrefsSecure\Nettrans.exe','32');
 DeleteFile('C:\ProgramData\bf3ead22c009470da76ad0e1cbfe84e4\O6HulQA.exe','32');
 DeleteFile('C:\ProgramData\de1ca2c9767e4d00b6efdc64a73dc694\rpCcGukFNR8.exe','32');
 DeleteFile('C:\ProgramData\tiser\run.exe','32');
 DeleteFile('C:\Users\Anna\AppData\LocalLow\DuckGo\duckgo.dll','32');
 DeleteFile('C:\Users\Anna\AppData\Local\Adobe\PPAPI\CAB549D1-95E1-4326-86A5-84B85257A605\FBA3571D-05CA-43C9-BC15-558EF4FCE369.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Local\DuckGo\duckgo.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Local\Mail.Ru\MailRuUpdater.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Local\Microsoft\Extensions\extsetup.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Local\OneSystemCare\OneSystemCarez.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Roaming\SETUPS~1\ml.py','32');
 DeleteFile('C:\Users\Anna\AppData\Roaming\curl\curl.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Roaming\ee14df403d104ff5b706cc142d7aafda\cMVE2TSbS.exe','32');
 DeleteFile('C:\Users\Anna\AppData\Roaming\setupsk\ml.py','32');
 DeleteFile('C:\Users\Anna\AppData\Roaming\setupsk\python\pythonw.exe','32');
 DeleteFile('C:\Users\Anna\appdata\local\duckgo\duckgo.exe','32');
 DeleteFile('C:\Users\Anna\appdata\local\microsoft\extensions\extsetup.exe','32');
 DeleteFile('C:\Users\Anna\appdata\roaming\curl\curl.exe','32');
 DeleteFile('C:\Windows\Microsoft\svchost.exe','32');
 DeleteFile('C:\Windows\Tasks\BcyoMZkjXMgFaPP.job','32');
 DeleteFile('C:\Windows\Tasks\plaAVjRQXWCDePSecyr.job','32');
 DeleteFile('C:\Windows\Tasks\saKXaLnxQURzlMgex.job','32');
 DeleteFile('C:\Windows\microsoft\svchost.exe','32');
 DeleteFile('C:\Windows\rss\csrss.exe','32');
 DeleteFile('C:\Windows\system32\Ea3Host.exe','32');
 ExecuteFile('schtasks.exe', '/delete /TN "BcyoMZkjXMgFaPP" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "BcyoMZkjXMgFaPP2" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "DuckGo Task" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "GoogleUpdateSecurityTaskMachine_DA" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\ACAB549D1-95E1-4326-86A5-84B85257A605" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\Windows\extsetup" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\extsetup" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "Microsoft\extsetupSB" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "OneSystemCare Task" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "OneSystemCarez" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "curl" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "plaAVjRQXWCDePSecyr" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "plaAVjRQXWCDePSecyr2" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "pnIxobGIUDXdNt" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "psv_Scottrax" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "saKXaLnxQURzlMgex" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "saKXaLnxQURzlMgex2" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "setupsk_upd" /F', 0, 15000, true); 
 ExecuteFile('schtasks.exe', '/delete /TN "{0A090C47-0D7D-7804-0411-0D0D7D04110F}" /F', 0, 15000, true); 
 DeleteFile('C:\Windows\system32\ea3host.exe','32');
 DeleteFile('C:\Windows\windefender.exe','32');
 DeleteFile('D:\tmp\75ce2b9d8b3f482e975d1b20c14e1327\BGVBAVQWWX.exe','32');
 DeleteFile('D:\tmp\75ce2b9d8b3f482e975d1b20c14e1327\chipset.exe','32');
 DeleteFile('D:\tmp\a50ebadb6ef34475af07938e6a508d87\NVJLWRUZJU.exe','32');
 DeleteFile('D:\tmp\a50ebadb6ef34475af07938e6a508d87\chipset.exe','32');
 DeleteFile('D:\tmp\a5a13d21f51c43fcaeca796bae992ec7\chipset.exe','32');
 DeleteFile('D:\tmp\g695F.tmp.exe','32');
 DeleteFile('c:\program files\gbemzxqzbie\wdybfcouod.exe','32');
 DeleteFile('c:\program files\system native\main services\service.exe','32');
 DeleteFile('c:\program files\system native\main services\service_box.exe','32');
 DeleteFile('c:\program files\system native\main services\start.exe','32');
 DeleteFile('c:\programdata\appriabus\appriabus.exe','32');
 DeleteFile('c:\programdata\tiser\run.exe','32');
 DeleteFile('c:\users\anna\appdata\local\onesystemcare\onesystemcarez.exe','32');
 DeleteFile('c:\users\anna\appdata\roaming\epicnet inc\cloudnet\cloudnet.exe','32');
 DeleteFile('c:\windows\microsoft\svchost.exe','32');
 DeleteFile('c:\windows\rss\csrss.exe','32');
 DeleteFile('c:\windows\system32\ea3host.exe','32');
 DeleteFile('c:\windows\windefender.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','CloudNet');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','setupsk_upd');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\BGVBAVQWWX.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CloudNet','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LJOGJGPDPZ.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NVJLWRUZJU.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\O6HulQA.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Zaxar','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\cMVE2TSbS.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\kI1qDmwjsg','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\rpCcGukFNR8.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\setupsk','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\setupsk_upd','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\t13N2qp4Ln','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\xvvqnDa21ch.exe','command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','AppDownloads');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','extsetupSB');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteRepair(3);
 ExecuteRepair(4);
 ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится.

После перезагрузки:
- Выполните в AVZ:

Код:

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
end.

Файл quarantine.zip из папки AVZ загрузите по ссылке "Прислать запрошенный карантин" вверху темы.

- Подготовьте лог AdwCleaner и приложите его в теме.

помогите решить проблему (заявка № 216912)

Опции темы