Switch off: - Antivirus and disconnect from internet. Execute this script:
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\PROGRA~1\REDIFF~2\4.0\REDIFF~1.DLL','');
QuarantineFile('C:\Program Files\Rediff Toolbar\4.0\redifftoolbar.dll','');
DelBHO('{07B18EA1-A523-4961-B6BB-170DE4475CCA}');
QuarantineFile('C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL','');
DelBHO('{00A6FAF1-072E-44cf-8957-5838F569A31D}');
QuarantineFile('C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL','');
QuarantineFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe','');
QuarantineFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL','');
QuarantineFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL','');
SetServiceStart('MyWebSearchService', 4);
DeleteFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe');
DeleteFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL');
DeleteFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL');
DeleteFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe');
DeleteFile('C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL');
DeleteFile('C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL');
DeleteFile('C:\Program Files\Rediff Toolbar\4.0\redifftoolbar.dll');
DeleteFile('C:\PROGRA~1\REDIFF~2\4.0\REDIFF~1.DLL');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(6);
ExecuteRepair(8);
ExecuteRepair(9);
SetAVZPMStatus(true);
RebootWindows(true);
end.
upload quarantine (should be in kaspersky virus remover folder, avz_quarantine.Remember to zip this folder with password: virus
Do update your windows- you have sp1,it is should be sp3
Please make set of logs according to rules: http://virusinfo.info/showthread.php?t=9184