Погомогите с лечением ноутбука

**kassilass24** · 16.08.2017, 11:24

Постоянно открывает десктопный браузер, пытаясь перейти на различные сайты. Файлы копируются по всему диску, формат EXE.
В основном каждая вредоносная программа выдает себя за установленное приложение. Копирует файлы с непонятными символами в названии, и деинсталлятор себя. Каждый вредоносный файл заносится в Program Files системы в отдельную папку, с тем же названием то и файл-вирус. Антивирусы не стояли. Поймали вирусняк с торрент-EXEшника. Ребенок пытался скачать игру через торрент. В итоге после перезагрузки, стали прописываться ключи в реестр Windows 7. И открываться окна Internet Explorer с непонятным содержимым. Окон влезает сразу после загрузки системы около 50-ти, и система виснет намертво. Не можем справиться. Может быть вы сможете помочь. Заранее благодарны.

Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

**Info_bot** · 16.08.2017, 11:26

Уважаемый(ая) kassilass24, спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

**thyrex** · 18.08.2017, 08:20

Выполните скрипт в AVZ

Код:

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
 QuarantineFile('C:\Program Files\GXZiGyYLSHyU2\DINCirs.dll','');
 QuarantineFile('C:\Users\User\AppData\Roaming\SysMon\sysmon.exe','');
 QuarantineFile('C:\Program Files\deEybYPnrVdU2\YCb1G4L.dll','');
 QuarantineFile('C:\Users\User\AppData\Local\Hostinstaller\974585956_installcube.exe','');
 QuarantineFile('C:\Program Files\ScreenUp\future_helper.exe','');
 QuarantineFile('C:\ProgramData\WindowsReporting\wermgr.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\HTTPFI~1\app.py','');
 QuarantineFile('C:\Users\User\AppData\Local\FilterStart\FilterStart.exe','');
 QuarantineFile('C:\Program Files\thzXuJvjU\xyF9nmM.dll','');
 QuarantineFile('C:\Program Files\KKYLxeyFU\PYZWGDQ.dll','');
 QuarantineFile('C:\Program Files\Driver Updater Plus\dup.exe','');
 DelBHO('{6197F4E0-3807-407F-A59E-29D6443B9B53}');
 DelBHO('{C0D38E5A-7CF8-4105-8FE8-31B81443A114}');
 QuarantineFile('C:\Program Files\QYERbvxRHIE\kRE7uG3.dll','');
 QuarantineFile('C:\Program Files\XxqRAVXlUIE\k29PUez.dll','');
 QuarantineFile('C:\Users\User\AppData\Local\rightchose\regCheck.vbs','');
 QuarantineFile('C:\Program Files\Zaxar\ZaxarLoader.exe','');
 QuarantineFile('C:\Users\User\AppData\Local\ValidateLife\regCheck.vbs','');
 QuarantineFile('C:\Users\User\AppData\Local\LastNews\regCheck.vbs','');
 QuarantineFile('C:\ProgramData\Subair\Konkplus.dll','');
 QuarantineFile('C:\Users\User\AppData\Local\ImmediateHelp\regCheck.vbs','');
 QuarantineFile('C:\Users\User\AppData\Local\TestMenu\regCheck.vbs','');
 QuarantineFile('C:\Program Files\Download Master\D2M7TG83CLNP\5XP17#0f9.exe','');
 QuarantineFile('C:\Program Files\EP4Y1BX6AQ\EP4Y1BX6A.exe','');
 QuarantineFile('C:\Program Files\7S45BW2JG4\7S45BW2JG.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\qytw3tqrdoj\fluwutxd0hd.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\rq5kc0pstxf\ytxy2xweon4.exe','');
 QuarantineFile('C:\Program Files\X4A6NECJ68\X4A6NECJ6.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\0ydv2z0l3yo\it0vupu2gyv.exe','');
 QuarantineFile('C:\Program Files\KLO18VAJ7P\KLO18VAJ7.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\bwpvtno2ach\z15gkvln12s.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\rumwz21o4yv\wpp2201t3gd.exe','');
 QuarantineFile('C:\Program Files\FBML04WEXD\FBML04WEX.exe','');
 QuarantineFile('C:\Program Files\CKBFFBH80V\CKBFFBH80.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\oovqjaw11v3\15i1uddxtif.exe','');
 QuarantineFile('C:\Program Files\9WBX565YUE\4AS4XAVHP.exe','');
 QuarantineFile('C:\Users\User\AppData\Local\59f23ac38258438680a7f97e74317e05\FuACmUMmWYHtAQ.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\ihmabtnuqbq\zzweqjin132.exe','');
 QuarantineFile('C:\Program Files\2JVPY9Y6CZ\2JVPY9Y6C.exe','');
 QuarantineFile('C:\Program Files\NQPD771SN6\NQPD771SN.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\3zv5fiyhvmk\4lsq0eanfii.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\rs4pnciudiq\mlnry153jau.exe','');
 QuarantineFile('C:\Program Files\HKZ3Y1H1M3\HKZ3Y1H1M.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\cfc2fvxit55\2lgpwdrch4h.exe','');
 QuarantineFile('C:\Program Files\J9FX7F08O8\J9FX7F08O.exe','');
 QuarantineFile('C:\Program Files\844UNUT2S6\844UNUT2S.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\s0je3hbt2za\fh1tma3oeys.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\1kwvbca2idl\h5zgcfdj1f2.exe','');
 QuarantineFile('C:\Program Files\2A4VYJUKF8\FZBA6I0LE.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\oklgaiqw4i4\rtmyhdtn1vh.exe','');
 QuarantineFile('C:\Program Files\XJMDOBOGTQ\XJMDOBOGT.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\5tn3x4j5tfl\iur4r2bqlv4.exe','');
 QuarantineFile('C:\Program Files\DWP77165OO\DWP77165O.exe','');
 QuarantineFile('C:\Program Files\XP2DR0Q8OO\XP2DR0Q8O.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\wewut3wugzz\ezmfvuekepm.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\stt53koibnb\dfrc245rpux.exe','');
 QuarantineFile('C:\Program Files\CK3OEJ22IK\CK3OEJ22I.exe','');
 QuarantineFile('C:\Program Files\RT6F9X7XMC\RT6F9X7XM.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\ak0l2dhulpt\on5no5dirwi.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\makvbp3lf2d\14uuux5brz1.exe','');
 QuarantineFile('C:\Program Files\H4HOMMUMUR\H4HOMMUMU.exe','');
 QuarantineFile('C:\Program Files\BAV8N5HY6Q\BAV8N5HY6.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\1qj2deh0zqp\zbioh5yxvtd.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\hi5vv1k1p4x\vucalc5tv1t.exe','');
 QuarantineFile('C:\Program Files\TK215AEEV4\TK215AEEV.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\gujrpjthwca\daklab1omys.exe','');
 QuarantineFile('C:\Program Files\S93F1RFOY2\S93F1RFOY.exe','');
 QuarantineFile('C:\Program Files\AH14MFJENJ\AH14MFJEN.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\ak3b1b3ihlt\jg2gcreowv3.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\cvt5pswazq3\brls4cktqx2.exe','');
 QuarantineFile('C:\Users\User\AppData\Local\FileSystemOptions\regCheck.vbs','');
 QuarantineFile('C:\Program Files\OOGZAD1T9V\8GB0IF3E3.exe','');
 QuarantineFile('C:\ProgramData\a55ef1d308874951a4fdce1bab717dbe\PXdGmC0.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\0zntguojhoj\kzsc4o3clxw.exe','');
 QuarantineFile('C:\Users\User\AppData\Local\Mail.Ru\MailRuUpdater.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\2iftsig5ds2\hhpisjalbeq.exe','');
 QuarantineFile('C:\Program Files\2FRIA769VV\2FRIA769V.exe','');
 QuarantineFile('C:\Program Files\TYJX3CHYBR\TYJX3CHYB.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\5ka25vj5ixl\xdvpwe0tiiv.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\imdyqubqgdm\1hrx0njxrfk.exe','');
 QuarantineFile('C:\Program Files\7MPYLTLUXU\7MPYLTLUX.exe','');
 QuarantineFile('C:\Program Files\2EON2WTW3L\2EON2WTW3.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\bcud0gprwu1\vtlrgfon3vu.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe','');
 QuarantineFile('C:\Program Files\LXVPI5F83Q\LXVPI5F83.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\hlnqed4ukyt\4gbfrkghahv.exe','');
 QuarantineFile('C:\Program Files\Q6SO5G64A9\Q6SO5G64A.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\oznmqzmbmag\ait0cboq35u.exe','');
 QuarantineFile('C:\Program Files\NoterSave\I8LKU.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\HolyFrog\holyfrog.exe','');
 QuarantineFile('C:\Program Files\E0WP4C5OKS\E0WP4C5OK.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\i4s11sn3m22\3owevricmjs.exe','');
 QuarantineFile('C:\Program Files\SD0197DVXD\SD0197DVX.exe','');
 QuarantineFile('C:\Program Files\Download Master\D2M7TG83CLNP\ai2nSn7y5k.exe','');
 QuarantineFile('C:\Users\User\AppData\Roaming\HTTPFI~1\ml.py','');
 QuarantineFile('C:\Users\User\AppData\Local\OneClick\OneClickApp.32.exe','');
 QuarantineFile('C:\Users\User\AppData\Local\FilterOptions\regCheck.vbs','');
 QuarantineFile('C:\Users\User\AppData\Local\DateOption\regCheck.vbs','');
 QuarantineFile('C:\Program Files\NoterSave\NoterSave.exe','');
 DeleteService('ServiceMgr');
 QuarantineFile('C:\Windows\ServiceMgr.sys','');
 QuarantineFile('C:\ProgramData\Subair\Subair.exe','');
 QuarantineFile('C:\ProgramData\PrefsSecure\Nettrans.exe','');
 QuarantineFile('C:\ProgramData\Logic Cramble\set.exe','');
 DeleteService('WinDefender');
 QuarantineFile('C:\Windows\windefender.exe','');
 DeleteFile('C:\Windows\windefender.exe','32');
 DeleteFile('C:\ProgramData\Logic Cramble\set.exe','32');
 DeleteFile('C:\ProgramData\PrefsSecure\Nettrans.exe','32');
 DeleteFile('C:\Windows\ServiceMgr.sys','32');
 DeleteFile('C:\Program Files\NoterSave\NoterSave.exe','32');
 DeleteFile('C:\Users\User\AppData\Local\DateOption\regCheck.vbs','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','DateOption');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','NoterSave');
 DeleteFile('C:\Users\User\AppData\Local\FilterOptions\regCheck.vbs','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','FilterOptions');
 DeleteFile('C:\Users\User\AppData\Local\OneClick\OneClickApp.32.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\HTTPFI~1\ml.py','32');
 DeleteFile('C:\Program Files\Download Master\D2M7TG83CLNP\ai2nSn7y5k.exe','32');
 DeleteFile('C:\Program Files\SD0197DVXD\SD0197DVX.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\i4s11sn3m22\3owevricmjs.exe','32');
 DeleteFile('C:\Program Files\E0WP4C5OKS\E0WP4C5OK.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\HolyFrog\holyfrog.exe','32');
 DeleteFile('C:\Program Files\NoterSave\I8LKU.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\oznmqzmbmag\ait0cboq35u.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','jwjms0l1xpf');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Q45PQHQ8UTQ85SY');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','HolyFrog');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','99ANDW2PYTZTRJK');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','uubz1awfnnv');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','YX0GJYP6KN0TLSX');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ai2nSn7y5k.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','HttpFilter');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','OneClick');
 DeleteFile('C:\Program Files\Q6SO5G64A9\Q6SO5G64A.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\hlnqed4ukyt\4gbfrkghahv.exe','32');
 DeleteFile('C:\Program Files\LXVPI5F83Q\LXVPI5F83.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\bcud0gprwu1\vtlrgfon3vu.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','oi4qyfad2a0');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','CloudNet');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','POXWSO9TS2K39T3');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','squz14j4bo0');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','AC1HZI0CPUPKIDY');
 DeleteFile('C:\Program Files\2EON2WTW3L\2EON2WTW3.exe','32');
 DeleteFile('C:\Program Files\7MPYLTLUXU\7MPYLTLUX.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\imdyqubqgdm\1hrx0njxrfk.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\5ka25vj5ixl\xdvpwe0tiiv.exe','32');
 DeleteFile('C:\Program Files\TYJX3CHYBR\TYJX3CHYB.exe','32');
 DeleteFile('C:\Program Files\2FRIA769VV\2FRIA769V.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\2iftsig5ds2\hhpisjalbeq.exe','32');
 DeleteFile('C:\Users\User\AppData\Local\Mail.Ru\MailRuUpdater.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\0zntguojhoj\kzsc4o3clxw.exe','32');
 DeleteFile('C:\ProgramData\a55ef1d308874951a4fdce1bab717dbe\PXdGmC0.exe','32');
 DeleteFile('C:\Program Files\OOGZAD1T9V\8GB0IF3E3.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','R93K8QWRH2BB9YK');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','PXdGmC0.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','gbmoaff1yn1');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MailRuUpdater');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','wdyn0cfwfh2');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','5HBICX8OH1OBR0T');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MGP68VA16R1GYGK');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','m21i1j0pwm4');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','bnzjxjo2bi5');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','IH516E73KY0STT3');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','CKMJEONYNJBTI9N');
 DeleteFile('C:\Users\User\AppData\Local\FileSystemOptions\regCheck.vbs','32');
 DeleteFile('C:\Users\User\AppData\Roaming\cvt5pswazq3\brls4cktqx2.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\ak3b1b3ihlt\jg2gcreowv3.exe','32');
 DeleteFile('C:\Program Files\AH14MFJENJ\AH14MFJEN.exe','32');
 DeleteFile('C:\Program Files\S93F1RFOY2\S93F1RFOY.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\gujrpjthwca\daklab1omys.exe','32');
 DeleteFile('C:\Program Files\TK215AEEV4\TK215AEEV.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\hi5vv1k1p4x\vucalc5tv1t.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\1qj2deh0zqp\zbioh5yxvtd.exe','32');
 DeleteFile('C:\Program Files\BAV8N5HY6Q\BAV8N5HY6.exe','32');
 DeleteFile('C:\Program Files\H4HOMMUMUR\H4HOMMUMU.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','TYZ8P0Q3WCZWGGA');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','RT91WZ3M32EI1PS');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','xwiy02pnzdb');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','cwiodevjotm');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','KYSM3P64QN0MPPP');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ch5dzh1bj54');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','F7NN2U4PLOS1PBD');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','4Y7DRYBHJJUUAYH');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','tpjnvid5cfs');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','3wur1gtpnr2');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','FileSystemOptions');
 DeleteFile('C:\Users\User\AppData\Roaming\makvbp3lf2d\14uuux5brz1.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\ak0l2dhulpt\on5no5dirwi.exe','32');
 DeleteFile('C:\Program Files\RT6F9X7XMC\RT6F9X7XM.exe','32');
 DeleteFile('C:\Program Files\CK3OEJ22IK\CK3OEJ22I.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\stt53koibnb\dfrc245rpux.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\wewut3wugzz\ezmfvuekepm.exe','32');
 DeleteFile('C:\Program Files\XP2DR0Q8OO\XP2DR0Q8O.exe','32');
 DeleteFile('C:\Program Files\DWP77165OO\DWP77165O.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\5tn3x4j5tfl\iur4r2bqlv4.exe','32');
 DeleteFile('C:\Program Files\XJMDOBOGTQ\XJMDOBOGT.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','NKEP932S5PBC4WK');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','d0bpmlezdy4');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','TE3RUMB59HO1M0L');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','O0Z16EXO878X2G9');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dmkcs10usmg');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','slkuxf4eigh');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','2U1CSW9H33QNXW9');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','N0MLF0XH3ASLSEZ');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','fifthxgodtr');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','a0ujjbmkns0');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','cgpavvfn3wx');
 DeleteFile('C:\Users\User\AppData\Roaming\oklgaiqw4i4\rtmyhdtn1vh.exe','32');
 DeleteFile('C:\Program Files\2A4VYJUKF8\FZBA6I0LE.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\1kwvbca2idl\h5zgcfdj1f2.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\s0je3hbt2za\fh1tma3oeys.exe','32');
 DeleteFile('C:\Program Files\844UNUT2S6\844UNUT2S.exe','32');
 DeleteFile('C:\Program Files\J9FX7F08O8\J9FX7F08O.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\cfc2fvxit55\2lgpwdrch4h.exe','32');
 DeleteFile('C:\Program Files\HKZ3Y1H1M3\HKZ3Y1H1M.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\rs4pnciudiq\mlnry153jau.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\3zv5fiyhvmk\4lsq0eanfii.exe','32');
 DeleteFile('C:\Program Files\NQPD771SN6\NQPD771SN.exe','32');
 DeleteFile('C:\Program Files\2JVPY9Y6CZ\2JVPY9Y6C.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','KD2YIN0TJ3RWALF');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','QVFK08P8HGZ1055');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','0kup0sokqqv');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','wb5agypv3vn');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','M7NUB0WWN5U41OM');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','g5qxa5ohrjj');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','V63O03HRXWEV6G0');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','3JCBPWFOR2Y52ZR');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','5zxhn23bvrs');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','2cmv5irzuco');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','SYQBA5D7S6TBUYF');
 DeleteFile('C:\Users\User\AppData\Roaming\ihmabtnuqbq\zzweqjin132.exe','32');
 DeleteFile('C:\Users\User\AppData\Local\59f23ac38258438680a7f97e74317e05\FuACmUMmWYHtAQ.exe','32');
 DeleteFile('C:\Program Files\9WBX565YUE\4AS4XAVHP.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\oovqjaw11v3\15i1uddxtif.exe','32');
 DeleteFile('C:\Program Files\FBML04WEXD\FBML04WEX.exe','32');
 DeleteFile('C:\Program Files\CKBFFBH80V\CKBFFBH80.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\rumwz21o4yv\wpp2201t3gd.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\bwpvtno2ach\z15gkvln12s.exe','32');
 DeleteFile('C:\Program Files\KLO18VAJ7P\KLO18VAJ7.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\0ydv2z0l3yo\it0vupu2gyv.exe','32');
 DeleteFile('C:\Program Files\X4A6NECJ68\X4A6NECJ6.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\rq5kc0pstxf\ytxy2xweon4.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','yimbrq1efeh');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ZR3QPUBVA1K0EXD');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','x1yrabyjqhq');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','YWXQ8CJS71XW4WG');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','fcauwahjrwv');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','yyc3f0oh15j');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','O7ZGP6P3ILINW1F');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','TAUCWIFBT7NY5VF');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','vfco2gaybwx');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','FuACmUMmWYHtAQ.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','qamlbs22cjs');
 DeleteFile('C:\Users\User\AppData\Roaming\qytw3tqrdoj\fluwutxd0hd.exe','32');
 DeleteFile('C:\Program Files\7S45BW2JG4\7S45BW2JG.exe','32');
 DeleteFile('C:\Program Files\EP4Y1BX6AQ\EP4Y1BX6A.exe','32');
 DeleteFile('C:\Program Files\Download Master\D2M7TG83CLNP\5XP17#0f9.exe','32');
 DeleteFile('C:\Users\User\AppData\Local\TestMenu\regCheck.vbs','32');
 DeleteFile('C:\Users\User\AppData\Local\ImmediateHelp\regCheck.vbs','32');
 DeleteFile('C:\ProgramData\Subair\Konkplus.dll','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','ImmediateHelp');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','TestMenu');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','LX6WPSSD9ZTRZNS');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ZXYVWIHGWG0YI53');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','qrikg4fleqh');
 DeleteFile('C:\Users\User\AppData\Local\LastNews\regCheck.vbs','32');
 DeleteFile('C:\Users\User\AppData\Local\ValidateLife\regCheck.vbs','32');
 DeleteFile('C:\Program Files\Zaxar\ZaxarLoader.exe','32');
 DeleteFile('C:\Users\User\AppData\Local\rightchose\regCheck.vbs','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','ValidateLife');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','LastNews');
 DeleteFile('C:\Program Files\XxqRAVXlUIE\k29PUez.dll','32');
 DeleteFile('C:\Program Files\QYERbvxRHIE\kRE7uG3.dll','32');
 DeleteFile('C:\Program Files\Driver Updater Plus\dup.exe','32');
 DeleteFile('C:\Program Files\KKYLxeyFU\PYZWGDQ.dll','32');
 DeleteFile('C:\Program Files\thzXuJvjU\xyF9nmM.dll','32');
 DeleteFile('C:\Windows\Tasks\DriverUpdaterPlus_UPDATES.job','32');
 DeleteFile('C:\Windows\Tasks\PjQtjfvBLCNiHHs.job','32');
 DeleteFile('C:\Windows\Tasks\uuxHwpnMkRCRpJh.job','32');
 DeleteFile('C:\Users\User\AppData\Local\FilterStart\FilterStart.exe','32');
 DeleteFile('C:\Users\User\AppData\Roaming\HTTPFI~1\app.py','32');
 DeleteFile('C:\Windows\system32\Tasks\HttpFilter2','32');
 DeleteFile('C:\Windows\system32\Tasks\HttpFilter','32');
 DeleteFile('C:\Windows\system32\Tasks\FastDataX Task','32');
 DeleteFile('C:\Windows\system32\Tasks\DriverUpdaterPlus_UPDATES','32');
 DeleteFile('C:\Windows\system32\Tasks\DriverUpdaterPlusRunAtStartup','32');
 DeleteFile('C:\Windows\system32\Tasks\Base Standart Manager','32');
 DeleteFile('C:\ProgramData\WindowsReporting\wermgr.exe','32');
 DeleteFile('C:\Program Files\ScreenUp\future_helper.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\Request Additional Helper','32');
 DeleteFile('C:\Windows\system32\Tasks\Private Additional Manager','32');
 DeleteFile('C:\Windows\system32\Tasks\PjQtjfvBLCNiHHs2','32');
 DeleteFile('C:\Windows\system32\Tasks\PjQtjfvBLCNiHHs','32');
 DeleteFile('C:\Windows\system32\Tasks\Microsoft\Windows\Windows Error Reporting\ErrorReporting','32');
 DeleteFile('C:\Users\User\AppData\Local\Hostinstaller\974585956_installcube.exe','32');
 DeleteFile('C:\Program Files\deEybYPnrVdU2\YCb1G4L.dll','32');
 DeleteFile('C:\Users\User\AppData\Roaming\SysMon\sysmon.exe','32');
 DeleteFile('C:\Windows\system32\Tasks\SystemHealer Task','32');
 DeleteFile('C:\Windows\system32\Tasks\SystemHealer Run Delay','32');
 DeleteFile('C:\Windows\system32\Tasks\System HealerStartUp','32');
 DeleteFile('C:\Windows\system32\Tasks\Soft installer','32');
 DeleteFile('C:\Windows\system32\Tasks\RwyxCJvLBnrtTv','32');
 DeleteFile('C:\Windows\system32\Tasks\RunAtStartup','32');
 DeleteFile('C:\Program Files\GXZiGyYLSHyU2\DINCirs.dll','32');
 DeleteFile('C:\Windows\system32\Tasks\{0E7D0C47-0878-0A0B-0D11-7A7E097F110F}','32');
 DeleteFile('C:\Windows\system32\Tasks\uuxHwpnMkRCRpJh2','32');
 DeleteFile('C:\Windows\system32\Tasks\uuxHwpnMkRCRpJh','32');
 DeleteFile('C:\Windows\system32\Tasks\urlopener','32');
 DeleteFile('C:\Windows\system32\Tasks\TnqpiRJoXWMCwN','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Будет выполнена перезагрузка компьютера.

Выполните скрипт в AVZ

Код:

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

c:\quarantine.zip пришлите по красной ссылке Прислать запрошенный карантин над первым сообщением темы.

Пожалуйста, ЕЩЕ РАЗ запустите Autologger в обычном, а не безопасном, режиме, прикрепите к следующему сообщению НОВЫЕ логи.

**CyberHelper** · 18.08.2017, 08:30

Статистика проведенного лечения:

Получено карантинов: 1
Обработано файлов: 6
В ходе лечения вредоносные программы в карантинах не обнаружены

Погомогите с лечением ноутбука (заявка № 214682)

Опции темы