помогите пожалуйста
помогите пожалуйста
Уважаемый(ая) Юрий Миронов, спасибо за обращение на наш форум!
Удаление вирусов - абсолютно бесплатная услуга на VirusInfo.Info. Хелперы в самое ближайшее время ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.
Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.
+ лог FRST
Выполните скрипт в AVZ:Компьютер перезагрузится.Код:begin TerminateProcessByName('c:\program files (x86)\tencent\qqpcmgr\10.7.16066.216\taoframe.exe'); TerminateProcessByName('c:\users\1\appdata\local\smartweb\smartwebhelper.exe'); TerminateProcessByName('c:\users\1\appdata\local\smartweb\smartwebapp.exe'); TerminateProcessByName('c:\program files (x86)\tencent\qqpcmgr\10.7.16066.216\qqpcrtp.exe'); TerminateProcessByName('c:\program files (x86)\xtab\protectservice.exe'); TerminateProcessByName('c:\users\1\appdata\roaming\4c4c4544-1431453160-4a10-8042-b2c04f303232\nsr7f90.tmpfs'); TerminateProcessByName('c:\users\1\appdata\local\kometa\kometaup.exe'); TerminateProcessByName('c:\program files (x86)\elex-tech\yac\isafetray.exe'); TerminateProcessByName('c:\program files (x86)\elex-tech\yac\isafesvc2.exe'); TerminateProcessByName('c:\program files (x86)\elex-tech\yac\isafesvc.exe'); SetServiceStart('TSDefenseBt', 4); SetServiceStart('iSafeKrnlBoot', 4); SetServiceStart('TSSysKit', 4); SetServiceStart('TSCPM', 4); SetServiceStart('TS888x64', 4); SetServiceStart('TFsFlt', 4); SetServiceStart('TAOKernelDriver', 4); SetServiceStart('TAOAccelerator', 4); SetServiceStart('QQSysMonX64', 4); SetServiceStart('QMUdisk', 4); SetServiceStart('iSafeNetFilter', 4); SetServiceStart('iSafeKrnlR3', 4); SetServiceStart('iSafeKrnlMon', 4); SetServiceStart('iSafeKrnlKit', 4); SetServiceStart('iSafeKrnl', 4); StopService('TAOFrame'); StopService('serverca'); StopService('QQPCRTP'); StopService('bexoruqe'); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\Uninst.exe', ''); QuarantineFile('C:\Program Files (x86)\ver6BlockAndSurf\J6BlockAndSurfR79.exe', ''); QuarantineFile('C:\Program Files (x86)\XTab\SupTab.dll', ''); QuarantineFile('C:\Users\1\AppData\Roaming\Browsers\exe.resworb.bat', ''); QuarantineFile('C:\Users\1\AppData\Roaming\Browsers\exe.erolpxei.bat', ''); QuarantineFile('C:\Users\1\AppData\Local\Mail.Ru\MailRuUpdater.exe', ''); QuarantineFile('C:\Users\1\AppData\Local\4C4C4544-1431464042-4A10-8042-B2C04F303232\bnsr71F8.exe', ''); QuarantineFile('C:\ProgramData\{c3ca822d-c98c-40ea-c3ca-a822dc9808b7}\hqghumeaylnlf.exe', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\FileSmash\QMSoftExt64.dll', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\FileSmash\QMSoftExt.dll', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQPCTray.exe', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMContextUninstall64.dll', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMContextScan64.dll', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TSDefenseBT64.sys', ''); QuarantineFile('C:\Windows\system32\DRIVERS\iSafeKrnlBoot.sys', ''); QuarantineFile('C:\Windows\system32\Drivers\webinstrNewH.sys', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TSSysKit64.sys', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\tscpm64.sys', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TS888x64.sys', ''); QuarantineFile('C:\Windows\system32\Drivers\TFsFltX64.sys', ''); QuarantineFile('C:\Windows\system32\Drivers\TAOKernel64.sys', ''); QuarantineFile('C:\Windows\system32\Drivers\TAOAccelerator64.sys', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQSysMonX64.sys', ''); QuarantineFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMUdisk64.sys', ''); QuarantineFile('C:\Windows\system32\DRIVERS\iSafeNetFilter.sys', ''); QuarantineFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys', ''); QuarantineFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys', ''); QuarantineFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys', ''); QuarantineFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys', ''); QuarantineFile('C:\Users\1\AppData\Local\ConvertAd\CASrv.exe', ''); QuarantineFile('C:\Windows\system32\drivers\ccnfd_1_10_0_4.sys', ''); QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.7.16066.216\taoframe.exe', ''); QuarantineFile('c:\users\1\appdata\local\smartweb\smartwebhelper.exe', ''); QuarantineFile('c:\users\1\appdata\local\smartweb\smartwebapp.exe', ''); QuarantineFile('c:\program files (x86)\tencent\qqpcmgr\10.7.16066.216\qqpcrtp.exe', ''); QuarantineFile('c:\program files (x86)\xtab\protectservice.exe', ''); QuarantineFile('c:\users\1\appdata\roaming\4c4c4544-1431453160-4a10-8042-b2c04f303232\nsr7f90.tmpfs', ''); QuarantineFile('c:\users\1\appdata\local\kometa\kometaup.exe', ''); QuarantineFile('c:\program files (x86)\elex-tech\yac\isafetray.exe', ''); QuarantineFile('c:\program files (x86)\elex-tech\yac\isafesvc2.exe', ''); QuarantineFile('c:\program files (x86)\elex-tech\yac\isafesvc.exe', ''); DeleteFile('c:\program files (x86)\elex-tech\yac\isafesvc.exe', '32'); DeleteFile('c:\program files (x86)\elex-tech\yac\isafesvc2.exe', '32'); DeleteFile('c:\program files (x86)\elex-tech\yac\isafetray.exe', '32'); DeleteFile('c:\users\1\appdata\local\kometa\kometaup.exe', '32'); DeleteFile('c:\users\1\appdata\local\smartweb\smartwebapp.exe', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\curlpp.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iCommon.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iCommu.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iImportLib.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\ipcproxy.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeAdless.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeBase.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafebs.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeCheckEngine.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeDisp.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeEngineBase.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeEngineDisp.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlCall.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMonCall.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlShell.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafemadwc.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafemc.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeMon.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafenpf.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafepxy.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isaferpt.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafeupbiz.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSvc.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSvc2.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPAutoClean.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPDesk.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPFeedback.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPFloaty.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPMsgCenter.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPNodisturb.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPProtect.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPPush.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPStartupAssist.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPVirus.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\libcurl.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\LIBEAY32.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\libpng.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\ouilibx.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\sqlite3.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\SSLEAY32.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\AntiRK.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\filau.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\filcmn.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\filvss.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\fupd.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\lsf.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\tsc.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\twsdk.dll', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\tws\twsupd.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\Common.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\communic.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\dr.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\libexpatw.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\oDayProtect.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\QMBDScanner.dat', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\QMCloudInter\QMCloudInter.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\QMCpm.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\QMHips.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\QMHipsEngine.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\QMRepairPlugin.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\RtpCommon.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\SpecialPlugin\QMHipsSpecial.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\ptrate.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMAssocScan.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMAVProxy.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMCommon.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMDns.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMExt.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMFileMon.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMIpc.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMNetworkMgr.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMRtpCheck.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMRtpDLL.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMSafeBoxHelperDll.dll', '32'); DeleteFile('c:\program files (x86)\tencent\qqpcmgr\10.7.16066.216\qmscripthost.dll', '32'); DeleteFile('c:\program files (x86)\tencent\qqpcmgr\10.7.16066.216\qmsysrepprov.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMTrayPlugin\QMPerfCtrl\QMPerf.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMUl.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQFileFlt.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQPCHardware.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\SoftMgr\processlogdll.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\sqlite.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\SXComBase.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAOBase.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAOKernelControl.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAVCache.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAVEng.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAVInterface.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TavPedc.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAVUpload.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\tinyxml.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TSSysKitProxy.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\zlib.dll', '32'); DeleteFile('C:\Users\1\AppData\Local\SmartWeb\swhk.dll', '32'); DeleteFile('C:\Windows\system32\drivers\ccnfd_1_10_0_4.sys', '32'); DeleteFile('C:\Users\1\AppData\Roaming\4C4C4544-1431453160-4A10-8042-B2C04F303232\nsr7F90.tmpfs', '32'); DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQPCRTP.exe', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TAOFrame.exe', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys', '32'); DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys', '32'); DeleteFile('C:\Windows\system32\DRIVERS\iSafeNetFilter.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMUdisk64.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQSysMonX64.sys', '32'); DeleteFile('C:\Windows\system32\Drivers\TAOAccelerator64.sys', '32'); DeleteFile('C:\Windows\system32\Drivers\TAOKernel64.sys', '32'); DeleteFile('C:\Windows\system32\Drivers\TFsFltX64.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TS888x64.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\tscpm64.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TSSysKit64.sys', '32'); DeleteFile('C:\Windows\system32\Drivers\webinstrNewH.sys', '32'); DeleteFile('C:\Windows\system32\DRIVERS\iSafeKrnlBoot.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\TSDefenseBT64.sys', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMContextScan64.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QMContextUninstall64.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\QQPCTray.exe', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\FileSmash\QMSoftExt.dll', '32'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\plugins\FileSmash\QMSoftExt64.dll', '32'); DeleteFile('C:\ProgramData\{c3ca822d-c98c-40ea-c3ca-a822dc9808b7}\hqghumeaylnlf.exe', '32'); DeleteFile('C:\Users\1\AppData\Local\Amigo\Application\amigo.exe', '32'); DeleteFile('C:\Users\1\AppData\Local\Amigo\Application\ok.exe', '32'); DeleteFile('C:\Users\1\AppData\Local\Mail.Ru\MailRuUpdater.exe', '32'); DeleteFile('C:\Users\1\AppData\Local\SmartWeb\SmartWebHelper.exe', '32'); DeleteFile('C:\Program Files (x86)\XTab\SupTab.dll', '32'); DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job', '64'); DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '64'); DeleteFile('C:\Program Files (x86)\ver6BlockAndSurf\J6BlockAndSurfR79.exe', '32'); DeleteFile('C:\Windows\Tasks\BlockAndSurf Update.job', '64'); DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16066.216\Uninst.exe', '32'); DeleteFile('C:\Windows\system32\Tasks\{0A787EF1-FE9F-44F9-B4E6-8A4DDADEEDCC}', '64'); DeleteFile('C:\Users\1\appdata\local\convertad\casrv.exe', '32'); DeleteService('TSDefenseBt'); DeleteService('iSafeKrnlBoot'); DeleteService('webinstrNewH'); DeleteService('TSSysKit'); DeleteService('TSCPM'); DeleteService('TS888x64'); DeleteService('TFsFlt'); DeleteService('TAOKernelDriver'); DeleteService('TAOAccelerator'); DeleteService('QQSysMonX64'); DeleteService('QMUdisk'); DeleteService('iSafeNetFilter'); DeleteService('iSafeKrnlR3'); DeleteService('iSafeKrnlMon'); DeleteService('iSafeKrnlKit'); DeleteService('iSafeKrnl'); DeleteService('ccsvc_1.10.0.4'); DeleteService('TAOFrame'); DeleteService('serverca'); DeleteService('QQPCRTP'); DeleteService('IHProtect Service'); DeleteService('bexoruqe'); DeleteFileMask('C:\Users\1\appdata\local\convertad', '*', true); DeleteFileMask('C:\Program Files (x86)\Tencent', '*', true); DeleteFileMask('C:\Program Files (x86)\ver6BlockAndSurf', '*', true); DeleteFileMask('C:\Program Files (x86)\XTab', '*', true); DeleteFileMask('C:\Users\1\AppData\Local\SmartWeb', '*', true); DeleteFileMask('C:\Users\1\AppData\Local\4C4C4544-1431464042-4A10-8042-B2C04F303232', '*', true); DeleteFileMask('C:\Program Files (x86)\Elex-tech', '*', true); DeleteFileMask('c:\users\1\appdata\local\kometa', '*', true); DeleteDirectory('C:\Users\1\appdata\local\convertad'); DeleteDirectory('C:\Program Files (x86)\Tencent'); DeleteDirectory('C:\Program Files (x86)\ver6BlockAndSurf'); DeleteDirectory('C:\Program Files (x86)\XTab'); DeleteDirectory('C:\Users\1\AppData\Local\SmartWeb'); DeleteDirectory('C:\Users\1\AppData\Local\4C4C4544-1431464042-4A10-8042-B2C04F303232'); DeleteDirectory('C:\Program Files (x86)\Elex-tech'); DeleteDirectory('c:\users\1\appdata\local\kometa'); DelBHO('{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}'); ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP1" /F', 0, 15000, true); ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP2" /F', 0, 15000, true); ExecuteFile('schtasks.exe', '/delete /TN "APSnotifierPP3" /F', 0, 15000, true); ExecuteFile('schtasks.exe', '/delete /TN "BlockAndSurf Update' /F', 0, 15000, true); ExecuteFile('schtasks.exe', '/delete /TN "SmartWeb Upgrade Trigger Task" /F', 0, 15000, true); ExecuteFile('schtasks.exe', '/delete /TN "{0A787EF1-FE9F-44F9-B4E6-8A4DDADEEDCC}" /F', 0, 15000, true); DelCLSID('{754DF2CE-51E8-4895-B53C-6381418B84AE}'); DelCLSID('{63332668-8CE1-445D-A5EE-25929176714E}'); ExecuteSysClean; ExecuteRepair(2); ExecuteRepair(4); ExecuteRepair(3); ExecuteRepair(23); ExecuteWizard('SCU', 2, 2, true); ExecuteWizard('TSW', 2, 2, true); RebootWindows(true); end.
Выполните в AVZ скрипт:
В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.Код:begin CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); end.
Выполните 2-й стандартный скрипт в AVZ и прикрепите к своему следующему сообщению файл virusinfo_syscheck.zip.
Сделайте лог AdwCleaner (by Xplode).
Сделайте лог Check Browsers' LNK.
WBR,
Vadim
запрошенные логи
Перетащите лог Check_Browsers_LNK.log на утилиту ClearLNK. Отчёт о работе прикрепите.
Запустите повторно AdwCleaner (by Xplode) (в Windows Vista/7/8 необходимо запускать через правую кнопку мыши от имени администратора)), нажмите кнопку Сканировать (Scan), по окончании сканирования уберите галочки на вкладках Папки (Folders) и Реестр (Registry) со всех пунктов, где упоминаются Mail.Ru если используете соответствующие программы.
Затем нажмите Очистить (Cleaning) и по окончании удаления перезагрузите систему по требованию программы.
После входа в систему откроется отчёт AdwCleaner - файл AdwCleaner[S0].txt, прикрепите к своему следующему сообщению.
Скачайте программу Universal Virus Sniffer и сделайте полный образ автозапуска uVS.
WBR,
Vadim
Отчёт ClearLNK,AdwCleaner и полный образ
Отключите до перезагрузки антивирус и выполните скрипт в uVS:Компьютер перезагрузится.Код:;uVS v3.85.21 [http://dsrt.dyndns.org] ;Target OS: NTv6.3 v385c ;------------------------autoscript--------------------------- sreg delref C:\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESVC.EXE del C:\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESVC.EXE delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ZLIB1.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ZLIB1.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IPCPROXY.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IPCPROXY.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\SSLEAY32.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\SSLEAY32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBEAY32.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBEAY32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\CURLPP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\CURLPP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBCURL.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBCURL.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\SQLITE3.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\SQLITE3.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFERPT.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFERPT.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEPXY.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEPXY.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ICOMMU.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ICOMMU.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEUPBIZ.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEUPBIZ.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IIMPORTLIB.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IIMPORTLIB.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISVC.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISVC.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNRAR.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNRAR.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TWSDK.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TWSDK.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\LSF.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\LSF.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\W32TOOLS.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\W32TOOLS.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\QUARANTINE.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\QUARANTINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FALGORIT.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FALGORIT.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TSC.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TSC.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\DECEXP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\DECEXP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PSMGR.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PSMGR.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGMGR.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGMGR.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNEMB.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNEMB.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILAU.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILAU.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNCHM.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNCHM.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\ANTIRK.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\ANTIRK.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\EMLIB.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\EMLIB.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNSEVZIP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNSEVZIP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNMISC.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNMISC.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILCMN.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILCMN.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FGUI.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FGUI.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILPPI.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILPPI.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILVSS.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILVSS.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\MESSAGE.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\MESSAGE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\VFST.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\VFST.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\CTOOLS.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\CTOOLS.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILCPT.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILCPT.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\ZIPEXP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\ZIPEXP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNZIP32.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNZIP32.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNACEV2.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNACEV2.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TWSUPD.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TWSUPD.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FUPD.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FUPD.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLMONCALL.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLMONCALL.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEDISP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEDISP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMADWC.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMADWC.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLSHELL.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLSHELL.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEENGINEDISP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEENGINEDISP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMC.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMC.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEBASE.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEBASE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEENGINEBASE.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEENGINEBASE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLCALL.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLCALL.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFECHECKENGINE.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFECHECKENGINE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFENPF.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFENPF.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEADLESS.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEADLESS.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEBS.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEBS.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISVC2.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISVC2.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESRVMON64.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESRVMON64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFETRAY.EXE del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFETRAY.EXE delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESOPT.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESOPT.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPAUTOCLEAN.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPAUTOCLEAN.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPMSGCENTER.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPMSGCENTER.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPPUSH.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPPUSH.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPVIRUS.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPVIRUS.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPSTARTUPASSIST.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPSTARTUPASSIST.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPFLOATY.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPFLOATY.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPDESK.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPDESK.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPFEEDBACK.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPFEEDBACK.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPPROTECT.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPPROTECT.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPNODISTURB.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPNODISTURB.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBPNG.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBPNG.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ICOMMON.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ICOMMON.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\OUILIBX.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\OUILIBX.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IDSKDLLPATCH64.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IDSKDLLPATCH64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNL.SYS del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNL.SYS delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLKIT.SYS del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLKIT.SYS delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLMON.SYS del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLMON.SYS delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLR3.SYS del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLR3.SYS delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFETHLP64.EXE del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFETHLP64.EXE delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMON.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMON.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMON64.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMON64.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGINS\VIRUT.TPL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGINS\VIRUT.TPL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGINS\FILAVUTD.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGINS\FILAVUTD.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMBP.DLL del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMBP.DLL delref %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\BUGREPORT.EXE del %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\BUGREPORT.EXE delall %SystemDrive%\USERS\1\APPDATA\LOCAL\AMIGO\APPLICATION\AMIGO.EXE del %SystemDrive%\USERS\1\APPDATA\ROAMING\BROWSERS\EXE.RESWORB.BAT del %Sys32%\DRIVERS\ISAFENETFILTER.SYS delref %Sys32%\DRIVERS\ISAFENETFILTER.SYS del %Sys32%\DRIVERS\CCNFD_1_10_0_4.SYS delref %Sys32%\DRIVERS\CCNFD_1_10_0_4.SYS uidel "C:\Program Files (x86)\Tencent\QQPCMgr\10.9.16349.225\Uninst.exe" uidel C:\Program Files (x86)\Elex-tech\YAC\uninstall.exe delref %SystemDrive%\USERS\1\APPDATA\LOCAL\KOMETA\APPLICATION\42.0.2311.135\DELEGATE_EXECUTE.EXE delref %SystemDrive%\USERS\1\APPDATA\LOCAL\YANDEX\UPDATER2\BROWSERMANAGERSHOW.EXE delref %SystemDrive%\USERS\1\APPDATA\LOCAL\AMIGO\APPLICATION\32.0.1721.110\DELEGATE_EXECUTE.EXE delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.9.16349.225\NPQMEXTENSIONSIE.DLL delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.9.16349.225\TAOFRAME.EXE delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.9.16349.225\QMCONTEXTSCAN.DLL delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.9.16349.225\UNINST.EXE delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.9.16349.225\QQPCTRAY.EXE delref %SystemDrive%\PROGRAM FILES (X86)\TENCENT\QQPCMGR\10.9.16349.225\QQPCSOFTMGR.EXE deltmp areg ;-------------------------------------------------------------
В папке с UVS будет лог выполнения скрипта, текстовый файл с именем из даты и времени выполнения, прикрепите его с своему сообщению.
Сделайте полный образ автозапуска uVS, загрузите на rghost.ru и дайте ссылку в теме.
WBR,
Vadim
ссылка на образ
+ лог
Живучий, гад, попался
Загрузите Windows 8 в безопасном режиме и выполните скрипт в uVS:После перезагрузки - сюда новый лог выполнения скрипта и снова лог AdwCleaner сделайте.Код:;uVS v3.85.21 [http://dsrt.dyndns.org] ;Target OS: NTv6.3 v385c ; C:\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESVC2.EXE addsgn 1A32759A5583008CF42BFB3A8837072105CAFC9C88594B4BC5C32DF355D671B3561F2B1A3B559DCA16D4B7DF461610A308D78273BDEFB52C2D2ECC26C306E29B 8 ELEX-TECH ; C:\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESVC.EXE ;------------------------autoscript--------------------------- chklst delvir delall %Sys32%\DRIVERS\TAOKERNEL64.SYS delall %Sys32%\DRIVERS\TAOACCELERATOR64.SYS delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TWSUPD.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILAU.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFETRAY.EXE delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLMONCALL.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMC.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\MESSAGE.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNZIP32.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\SSLEAY32.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TSC.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPAUTOCLEAN.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\DECEXP.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEBS.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEDISP.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FUPD.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFECHECKENGINE.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEENGINEBASE.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\EMLIB.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPDESK.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPNODISTURB.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPFLOATY.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FALGORIT.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLCALL.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IIMPORTLIB.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\ZIPEXP.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEPXY.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPPROTECT.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\CURLPP.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILVSS.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNRAR.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PLUGMGR.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFENPF.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPPUSH.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEBASE.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\VFST.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNACEV2.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPSTARTUPASSIST.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESOPT.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNEMB.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISVC2.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\CTOOLS.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNSEVZIP.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFESRVMON64.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNCHM.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\PSMGR.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\W32TOOLS.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\QUARANTINE.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBPNG.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FGUI.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEUPBIZ.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILCPT.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPVIRUS.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEADLESS.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\ANTIRK.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFERPT.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\SQLITE3.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISVC.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILPPI.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEENGINEDISP.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPFEEDBACK.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBCURL.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFENETFILTER.SYS delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ZLIB1.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\FILCMN.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ICOMMU.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\LIBEAY32.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\TWSDK.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\UNMISC.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ITPMSGCENTER.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\TWS\LSF.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\IPCPROXY.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEKRNLSHELL.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFEMADWC.DLL delall %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH\YAC\ISAFETHLP.EXE ;------------------------------------------------------------- deldirex %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH deldir %SystemDrive%\PROGRAM FILES (X86)\ELEX-TECH restart
WBR,
Vadim
новые логи
Ок, осталось в AdwCleaner очистить всё оставшееся. AdwCleaner[S1].txt затем прикрепите.
WBR,
Vadim
лог
- - - - -Добавлено - - - - -
теперь антивирус можно ставить и прогонять все полностью?
Да, может, что-то по мелочам найдётся.
Запустите AdwCleaner и нажмите Удалить.
Выполните рекомендации после лечения.
WBR,
Vadim
Большущее спасибо
Статистика проведенного лечения:
- Получено карантинов: 1
- Обработано файлов: 22
- В ходе лечения обнаружены вредоносные программы:
- c:\program files (x86)\xtab\protectservice.exe - not-a-virus:AdWare.Win32.SearchProtect.sd ( DrWEB: Adware.Mutabaha.266 )
- c:\programdata\{c3ca822d-c98c-40ea-c3ca-a822dc9808b7}\hqghumeaylnlf.exe - Trojan-FakeAV.Win32.Agent.zw ( DrWEB: Program.Unwanted.295 )
- c:\users\1\appdata\local\smartweb\smartwebapp.exe - not-a-virus:AdWare.Win32.PriceGong.a ( DrWEB: Adware.Shopper.845 )
- c:\users\1\appdata\local\smartweb\smartwebhelper.e xe - not-a-virus:AdWare.Win32.PriceGong.a ( DrWEB: Adware.Shopper.845 )
- c:\users\1\appdata\roaming\browsers\exe.erolpxei.b at - Trojan-Clicker.BAT.Agent.az ( DrWEB: BAT.Hosts.147 )
- c:\users\1\appdata\roaming\browsers\exe.resworb.ba t - Trojan-Clicker.BAT.Agent.az ( DrWEB: BAT.Hosts.147 )
Уважаемый(ая) Юрий Миронов, наши специалисты оказали Вам всю возможную помощь по вашему обращению.
В целях поддержания безопасности вашего компьютера настоятельно рекомендуем:
Чтобы всегда быть в курсе актуальных угроз в области информационной безопасности и сохранять свой компьютер защищенным, рекомендуем следить за последними новостями ИТ-сферы портала Anti-Malware.ru:
Надеемся больше никогда не увидеть ваш компьютер зараженным!
Если Вас не затруднит, пополните пожалуйста нашу базу безопасных файлов.