Помогите. zahar games и все вытекающие

[vorobyevds]

Добрый день! история такая, устанавливаются программы опера, вконтакте, одноклассники и еще zahargames, zaharbrowse/Удалял, все чистил. не помогает. вирусов не обнаружено(...windows xp

[Info_bot]

Уважаемый(ая) vorobyevds, спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитами АВЗ и HiJackThis, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[Vvvyg]

Выполните скрипт в AVZ:

begin
ExecuteAVUpdate;
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 TerminateProcessByName('c:\program files\amazingtab\amztab.exe');
 TerminateProcessByName('c:\program files\gmsd_ru_005010150\gmsd_ru_005010150.exe');
 TerminateProcessByName('c:\program files\gmsd_ru_005010151\gmsd_ru_005010151.exe');
 TerminateProcessByName('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\hnsg139.tmp');
 TerminateProcessByName('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\jnsg133.tmp');
 TerminateProcessByName('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\knsd11a.tmpfs');
 TerminateProcessByName('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\knsu359.tmp');
 TerminateProcessByName('c:\program files\mail.ru\mailruupdater\mailruupdater.exe');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\mail.ru\mailruupdater.exe');
 TerminateProcessByName('c:\program files\note-up\note-up.exe');
 TerminateProcessByName('c:\docume~1\admin\locals~1\temp\nsk7a.tmp');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\7c74f9c0-1448013597-11d5-9d38-001bfcdd10da\qnsm193.tmp');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\smartweb\smartwebapp.exe');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\smartweb\smartwebhelper.exe');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\7c74f9c0-1447934531-11d5-9d38-001bfcdd10da\snst15d.tmp');
 TerminateProcessByName('c:\program files\common files\shopperpro\spbiu.exe');
 TerminateProcessByName('c:\program files\sfk\ssfk.exe');
 TerminateProcessByName('c:\program files\swiftsearch_1.10.0.25\service\swsesrvc.exe');
 TerminateProcessByName('c:\documents and settings\admin\local settings\application data\gmsd_ru_005010151\upgmsd_ru_005010151.exe');
 TerminateProcessByName('c:\documents and settings\all users\application data\3wminipro3\wminipro.exe');
 TerminateProcessByName('c:\program files\zaxar\zaxargamebrowser.exe');
 TerminateProcessByName('c:\program files\zaxar\zaxarloader.exe');
 StopService('AmazingTab Update');
 StopService('bykesute');
 StopService('fedytilu');
 StopService('ginoquci');
 StopService('kuludosy');
 StopService('myfejozi');
 StopService('SPBIUpd');
 StopService('SSFK');
 StopService('swsesrvc_1.10.0.25');
 StopService('Updater.Mail.Ru');
 StopService('WdsManPro');
 StopService('xowijysy');
 StopService('SPBIUpdd');
 StopService('swsedrvr_vt_1_10_0_25');
 QuarantineFileF('c:\program files\amazingtab', '*', true, '', 0 , 0);
 QuarantineFileF('c:\program files\mail.ru', '*', true, '', 0 , 0);
 QuarantineFileF('c:\documents and settings\admin\local settings\application data\mail.ru', '*', true, '', 0 , 0);
 QuarantineFileF('c:\program files\note-up', '*', true, '', 0 , 0);
 QuarantineFileF('c:\documents and settings\admin\local settings\application data\smartweb', '*', true, '', 0 , 0);
 QuarantineFileF('c:\program files\common files\shopperpro', '*', true, '', 0 , 0);
 QuarantineFileF('c:\program files\sfk', '*', true, '', 0 , 0);
 QuarantineFileF('c:\program files\swiftsearch_1.10.0.25', '*', true, '', 0 , 0);
 QuarantineFileF('c:\documents and settings\all users\application data\3wminipro3', '*', true, '', 0 , 0);
 QuarantineFileF('c:\program files\zaxar', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin', '*', true, '', 0 , 0);
 QuarantineFileF('C:\PROGRA~1\YTDOWN~1', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Documents and Settings\Admin\Local Settings\Application Data\Amigo', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Program Files\AskPartnerNetwork', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Program Files\IQIYI Video', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Program Files\YTDownloader', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Documents and Settings\Admin\Application Data\18393', '*', true, '', 0 , 0);
 QuarantineFileF('C:\DOCUME~1\NETWOR~1\APPLIC~1\METACR~1', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Documents and Settings\All Users\Application Data\ShopperPro', '*', true, '', 0 , 0);
 QuarantineFileF('C:\Documents and Settings\Admin\Application Data\WindowsUpdater', '*', true, '', 0 , 0);
 QuarantineFile('c:\program files\amazingtab\amztab.exe', '');
 QuarantineFile('c:\program files\gmsd_ru_005010150\gmsd_ru_005010150.exe', '');
 QuarantineFile('c:\program files\gmsd_ru_005010151\gmsd_ru_005010151.exe', '');
 QuarantineFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\hnsg139.tmp', '');
 QuarantineFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\jnsg133.tmp', '');
 QuarantineFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\knsd11a.tmpfs', '');
 QuarantineFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\knsu359.tmp', '');
 QuarantineFile('c:\program files\mail.ru\mailruupdater\mailruupdater.exe', '');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\mail.ru\mailruupdater.exe', '');
 QuarantineFile('c:\program files\note-up\note-up.exe', '');
 QuarantineFile('c:\docume~1\admin\locals~1\temp\nsk7a.tmp', '');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\7c74f9c0-1448013597-11d5-9d38-001bfcdd10da\qnsm193.tmp', '');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\smartweb\smartwebapp.exe', '');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\smartweb\smartwebhelper.exe', '');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\7c74f9c0-1447934531-11d5-9d38-001bfcdd10da\snst15d.tmp', '');
 QuarantineFile('c:\program files\common files\shopperpro\spbiu.exe', '');
 QuarantineFile('c:\program files\sfk\ssfk.exe', '');
 QuarantineFile('c:\program files\swiftsearch_1.10.0.25\service\swsesrvc.exe', '');
 QuarantineFile('c:\documents and settings\admin\local settings\application data\gmsd_ru_005010151\upgmsd_ru_005010151.exe', '');
 QuarantineFile('c:\documents and settings\all users\application data\3wminipro3\wminipro.exe', '');
 QuarantineFile('c:\program files\zaxar\zaxargamebrowser.exe', '');
 QuarantineFile('c:\program files\zaxar\zaxarloader.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin\VirtualTotal.dll', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin\qvgpbhjt.dll', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\SmartWeb\swhk.dll', '');
 QuarantineFile('C:\Program Files\Zaxar\QtWebKit4.dll', '');
 QuarantineFile('C:\Program Files\Common Files\ShopperPro\spbiw.sys', '');
 QuarantineFile('C:\WINDOWS\system32\drivers\swsedrvr_vt_1_10_0_25.sys', '');
 QuarantineFile('C:\PROGRA~1\YTDOWN~1\sbmntr.sys', '');
 QuarantineFile('C:\WINDOWS\system32\drivers\ttqrwvnj.sys', '');
 QuarantineFile('C:\ProgramData\TimeTasks\timetasks.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010150\upgmsd_ru_005010150.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Amigo\Application\amigo.exe', '');
 QuarantineFile('C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe', '');
 QuarantineFile('C:\Program Files\IQIYI Video\Common\QyKernel.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\SysMine\run.vbs', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010142\upgmsd_ru_005010142.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010144\upgmsd_ru_005010144.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010146\upgmsd_ru_005010146.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\vmware-unity.exe', '');
 QuarantineFile('C:\Program Files\YTDownloader\YTDownloader.exe', '');
 QuarantineFile('C:\Program Files\Note-up\noteupshell0.dll', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Mail.Ru\Sputnik\IESearchPlugin.dll', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\18393\Updater.exe', '');
 QuarantineFile('C:\DOCUME~1\NETWOR~1\APPLIC~1\METACR~1\UPDATE~1\UPDATE~1.EXE', '');
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\ShopperPro\spbihe.js', '');
 QuarantineFile('C:\Program Files\SwiftSearch_1.10.0.25\Update\SwiftSearchAutoUpdateClient.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Application Data\WindowsUpdater\Updater.exe', '');
 QuarantineFile('C:\Documents and Settings\Admin\Local Settings\Temp\cfcabfibcdg.exe', '');
 QuarantineFile('C:\WINDOWS\system32\Nuyedf.dll', '');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Temp\cfcabfibcdg.exe');
 DeleteFile('C:\WINDOWS\Tasks\AmiUpdXp.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\At6.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\nethost task.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\SmartWeb Upgrade Trigger Task.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\SPBIW_UpdateTask_Time_323031333039303532332d3437415a556c2a3223346c41.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\SwiftSearch Auto Updater 1.10.0.25 Core.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\SwiftSearch Auto Updater 1.10.0.25 Pending Update.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\Virtual Total.job', '32');
 DeleteFile('C:\WINDOWS\Tasks\WindowsUpdater.job', '32');
 DeleteFile('c:\program files\gmsd_ru_005010150\gmsd_ru_005010150.exe', '32');
 DeleteFile('c:\program files\gmsd_ru_005010151\gmsd_ru_005010151.exe', '32');
 DeleteFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\hnsg139.tmp', '32');
 DeleteFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\jnsg133.tmp', '32');
 DeleteFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\knsd11a.tmpfs', '32');
 DeleteFile('c:\program files\7c74f9c0-1447923650-11d5-9d38-001bfcdd10da\knsu359.tmp', '32');
 DeleteFile('c:\program files\mail.ru\mailruupdater\mailruupdater.exe', '32');
 DeleteFile('c:\documents and settings\admin\local settings\application data\mail.ru\mailruupdater.exe', '32');
 DeleteFile('c:\program files\note-up\note-up.exe', '32');
 DeleteFile('c:\docume~1\admin\locals~1\temp\nsk7a.tmp', '32');
 DeleteFile('c:\documents and settings\admin\local settings\application data\7c74f9c0-1448013597-11d5-9d38-001bfcdd10da\qnsm193.tmp', '32');
 DeleteFile('c:\documents and settings\admin\local settings\application data\smartweb\smartwebapp.exe', '32');
 DeleteFile('c:\documents and settings\admin\local settings\application data\smartweb\smartwebhelper.exe', '32');
 DeleteFile('c:\documents and settings\admin\local settings\application data\7c74f9c0-1447934531-11d5-9d38-001bfcdd10da\snst15d.tmp', '32');
 DeleteFile('c:\program files\common files\shopperpro\spbiu.exe', '32');
 DeleteFile('c:\program files\sfk\ssfk.exe', '32');
 DeleteFile('c:\program files\swiftsearch_1.10.0.25\service\swsesrvc.exe', '32');
 DeleteFile('c:\documents and settings\admin\local settings\application data\gmsd_ru_005010151\upgmsd_ru_005010151.exe', '32');
 DeleteFile('c:\documents and settings\all users\application data\3wminipro3\wminipro.exe', '32');
 DeleteFile('c:\program files\zaxar\zaxargamebrowser.exe', '32');
 DeleteFile('c:\program files\zaxar\zaxarloader.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin\VirtualTotal.dll', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin\qvgpbhjt.dll', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\SmartWeb\swhk.dll', '32');
 DeleteFile('C:\Program Files\Zaxar\QtWebKit4.dll', '32');
 DeleteFile('C:\Program Files\Common Files\ShopperPro\spbiw.sys', '32');
 DeleteFile('C:\WINDOWS\system32\drivers\swsedrvr_vt_1_10_0_25.sys', '32');
 DeleteFile('C:\PROGRA~1\YTDOWN~1\sbmntr.sys', '32');
 DeleteFile('C:\WINDOWS\system32\drivers\ttqrwvnj.sys', '32');
 DeleteFile('C:\ProgramData\TimeTasks\timetasks.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010150\upgmsd_ru_005010150.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Amigo\Application\amigo.exe', '32');
 DeleteFile('C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe', '32');
 DeleteFile('C:\Program Files\IQIYI Video\Common\QyKernel.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\SysMine\run.vbs', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010142\upgmsd_ru_005010142.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010144\upgmsd_ru_005010144.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\gmsd_ru_005010146\upgmsd_ru_005010146.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\vmware-unity.exe', '32');
 DeleteFile('C:\Program Files\YTDownloader\YTDownloader.exe', '32');
 DeleteFile('C:\Program Files\Note-up\noteupshell0.dll', '32');
 DeleteFile('C:\Documents and Settings\Admin\Local Settings\Application Data\Mail.Ru\Sputnik\IESearchPlugin.dll', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\18393\Updater.exe', '32');
 DeleteFile('C:\DOCUME~1\NETWOR~1\APPLIC~1\METACR~1\UPDATE~1\UPDATE~1.EXE', '32');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\ShopperPro\spbihe.js', '32');
 DeleteFile('C:\Program Files\SwiftSearch_1.10.0.25\Update\SwiftSearchAutoUpdateClient.exe', '32');
 DeleteFile('C:\Documents and Settings\Admin\Application Data\WindowsUpdater\Updater.exe', '32');
 DeleteService('AmazingTab Update');
 DeleteService('bykesute');
 DeleteService('fedytilu');
 DeleteService('ginoquci');
 DeleteService('kuludosy');
 DeleteService('myfejozi');
 DeleteService('SPBIUpd');
 DeleteService('SSFK');
 DeleteService('swsesrvc_1.10.0.25');
 DeleteService('Updater.Mail.Ru');
 DeleteService('WdsManPro');
 DeleteService('xowijysy');
 DeleteService('SPBIUpdd');
 DeleteService('swsedrvr_vt_1_10_0_25');
 DeleteService('sbmntr');
 DeleteService('ttqrwvnj');
 DeleteFileMask('c:\program files\amazingtab', '*', true);
 DeleteFileMask('c:\program files\mail.ru', '*', true);
 DeleteFileMask('c:\documents and settings\admin\local settings\application data\mail.ru', '*', true);
 DeleteFileMask('c:\program files\note-up', '*', true);
 DeleteFileMask('c:\documents and settings\admin\local settings\application data\smartweb', '*', true);
 DeleteFileMask('c:\program files\common files\shopperpro', '*', true);
 DeleteFileMask('c:\program files\sfk', '*', true);
 DeleteFileMask('c:\program files\swiftsearch_1.10.0.25', '*', true);
 DeleteFileMask('c:\documents and settings\all users\application data\3wminipro3', '*', true);
 DeleteFileMask('c:\program files\zaxar', '*', true);
 DeleteFileMask('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin', '*', true);
 DeleteFileMask('C:\PROGRA~1\YTDOWN~1', '*', true);
 DeleteFileMask('C:\Documents and Settings\Admin\Local Settings\Application Data\Amigo', '*', true);
 DeleteFileMask('C:\Program Files\AskPartnerNetwork', '*', true);
 DeleteFileMask('C:\Program Files\IQIYI Video', '*', true);
 DeleteFileMask('C:\Program Files\YTDownloader', '*', true);
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data\18393', '*', true);
 DeleteFileMask('C:\DOCUME~1\NETWOR~1\APPLIC~1\METACR~1', '*', true);
 DeleteFileMask('C:\Documents and Settings\All Users\Application Data\ShopperPro', '*', true);
 DeleteFileMask('C:\Documents and Settings\Admin\Application Data\WindowsUpdater', '*', true);
 DeleteDirectory('c:\program files\amazingtab');
 DeleteDirectory('c:\program files\mail.ru');
 DeleteDirectory('c:\documents and settings\admin\local settings\application data\mail.ru');
 DeleteDirectory('c:\program files\note-up');
 DeleteDirectory('c:\documents and settings\admin\local settings\application data\smartweb');
 DeleteDirectory('c:\program files\common files\shopperpro');
 DeleteDirectory('c:\program files\sfk');
 DeleteDirectory('c:\program files\swiftsearch_1.10.0.25');
 DeleteDirectory('c:\documents and settings\all users\application data\3wminipro3');
 DeleteDirectory('c:\program files\zaxar');
 DeleteDirectory('C:\Documents and Settings\Admin\Local Settings\Application Data\Virtual Total\xBin');
 DeleteDirectory('C:\PROGRA~1\YTDOWN~1');
 DeleteDirectory('C:\Documents and Settings\Admin\Local Settings\Application Data\Amigo');
 DeleteDirectory('C:\Program Files\AskPartnerNetwork');
 DeleteDirectory('C:\Program Files\IQIYI Video');
 DeleteDirectory('C:\Program Files\YTDownloader');
 DeleteDirectory('C:\Documents and Settings\Admin\Application Data\18393');
 DeleteDirectory('C:\DOCUME~1\NETWOR~1\APPLIC~1\METACR~1');
 DeleteDirectory('C:\Documents and Settings\All Users\Application Data\ShopperPro');
 DeleteDirectory('C:\Documents and Settings\Admin\Application Data\WindowsUpdater');
 DelSPIByFileName('C:\WINDOWS\system32\Nuyedf.dll', false);
 DelBHO('{8E8F97CD-60B5-456F-A201-73065652D099}');
 DelCLSID('{45AC2688-0253-4ED8-97DE-B5370FA7D48A}');
 DelCLSID('{DD81E8DB-AD66-43C0-8600-F6C26C928A5A}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'ZaxarGameBrowser');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'ZaxarLoader');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Timestasks');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Note-up');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SmartWeb');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'gmsd_ru_005010150');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'upgmsd_ru_005010150.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'gmsd_ru_005010151');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'upgmsd_ru_005010151.exe');
 RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'MailRuUpdater');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\amigo', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnTBMon', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\etwzhmajei', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\HCDNClient', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MailRuUpdater', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SmartWeb', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SysMine', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Timestasks', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\upgmsd_ru_005010142.exe', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\upgmsd_ru_005010144.exe', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\upgmsd_ru_005010146.exe', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\vmware-unity', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\YTDownloader', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarGameBrowser', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ZaxarLoader', 'command');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved', '{DD81E8DB-AD66-43C0-8600-F6C26C928A5A}');
BC_ImportALL;
ExecuteSysClean;
 ExecuteRepair(4);
 ExecuteRepair(3);
 ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

Компьютер перезагрузится.
Выполните в AVZ скрипт:

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Выполните 2-й стандартный скрипт в AVZ и прикрепите к своему следующему сообщению файл virusinfo_syscheck.zip.

Сделайте лог AdwCleaner (by Xplode).