После удаления вирусов остались хвосты [not-a-virus:RiskTool.Win32.BitCoinMiner.frk, ]

[JaneYa]

После удаления вирусов остались хвосты.
Часть я обрезал. Но не уверен, что всё.
Подскажите, остались хвосты от вирусов или вирусы?

[Info_bot]

Уважаемый(ая) JaneYa, спасибо за обращение на наш форум!

Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[thyrex]

Выполните скрипт в AVZ

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('c:\docume~1\alluse~1\dxnwir.exe','');
 QuarantineFile('C:\RECYCLER\webhost.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5826412\absprox.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681\atnxwa1.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681478\atnxwa8.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-56814789\atnxwa9.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-568147819\atnxw1a9.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-568146\atnxwa6.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-56813\atnxwa3.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-56812\atnxwa2.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5618147819\atnxw11a9.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5332112\xyzpro00.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-533071\proooxxxy.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-518642113\prox12p1.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5181719\enowpea40.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5135689\hbweaaa.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-51117819\a111a1a9.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-50311241\a361111.exe','');
 QuarantineFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-41701\8dqa00.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\ScreenSaverPro.scr','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Vzayat.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Uzayas.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Tyayar.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Syayaq.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Rzayap.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Ryayap.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Pzayan.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Gyayae.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Czayaa.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Cyayaa.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\MSOCache\winhelp.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Identities\aafso\aafso.exe','');
 QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\Adobe\Reader_sl.exe','');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\Browse\plugins.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\ytht.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\ytht.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\sdfg.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\sdfg.exe','');
 TerminateProcessByName('c:\documents and settings\admin\application data\minerg.exe');
 QuarantineFile('c:\documents and settings\admin\application data\minerg.exe','');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\bdie.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\bdie.exe');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\a9.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\a9.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\a8.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\a8.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\a7.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\a7.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\a6.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\a6.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\a4.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\a4.exe','');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\a3.exe');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\a3.exe','');
 DeleteFile('c:\docume~1\admin\locals~1\temp\a3.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\a4.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\a6.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\a7.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\a8.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\a9.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\bdie.exe','32');
 DeleteFile('c:\documents and settings\admin\application data\minerg.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\sdfg.exe','32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\ytht.exe','32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Browse\plugins.exe','32');
 DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\Adobe\Reader_sl.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Adobe System Incorporated');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','dafsfdsvgfszzz');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Identities\aafso\aafso.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Windows Update');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\MSOCache\winhelp.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','pieceofshittycakechikewddcns');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Cyayaa.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Cyayaa');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Czayaa');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Czayaa.exe','32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Pzayan.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Pzayan');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Gyayae');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Ryayap.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Ryayap');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Rzayap.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Rzayap');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Syayaq.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Syayaq');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Tyayar.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Tyayar');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Uzayas.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Uzayas');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\Microsoft\Vzayat.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Vzayat');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\ScreenSaverPro.scr','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Screen Saver Pro 3.1');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-41701\8dqa00.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','8dqa00');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-50311241\a361111.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','a361111');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-51117819\a111a1a9.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','a111411r9');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5135689\hbweaaa.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','hbweaaa');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5181719\enowpea40.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','enowpea4');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-518642113\prox12p1.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','prox12p1');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-533071\proooxxxy.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','proooxxxy');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5332112\xyzpro00.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','xyzpro00');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5618147819\atnxw11a9.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw411r9');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-56812\atnxwa2.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r2');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-56813\atnxwa3.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r3');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-568146\atnxwa6.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r6');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681477\atnxwa7.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r7');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-568147819\atnxw1a9.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw41r9');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-56814789\atnxwa9.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r9');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681478\atnxwa8.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r8');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5681\atnxwa1.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','antaw4r19');
 DeleteFile('C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5826412\absprox.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','absprox');
 DeleteFile('C:\RECYCLER\webhost.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Windows Firewall TCP Manager');
 DeleteFile('c:\docume~1\alluse~1\dxnwir.exe','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','52447');
 BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
RebootWindows(false);
end.

Компьютер перезагрузится.

Пришлите карантин согласно Приложения 2 правил по красной ссылке Прислать запрошенный карантин вверху темы

Сделайте новые логи

[JaneYa]

Сделал.

[thyrex]

Плохого не увидел

[JaneYa]

Благодарю!!!

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 91
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\documents and settings\admin\application data\minerg.exe - not-a-virus:RiskTool.Win32.BitCoinMiner.frk ( DrWEB: Tool.BtcMine.130, BitDefender: Application.BitCoinMiner.BK )