Trojan.Crypt.XPACK.GEN

[Reichstag]

Здравствуйте, возникла проблема, помогите пожайлуста.
Spyware Terminator определяет вирус так Trojan.Crypt.XPACK.GEN, на экране висит картинка с сообщением об обнаружении вируса:Warning!Win32/Adware.Virtumonde

[V_Bond]

терминатора -деинсталировать ...
скачайте C:\WINDOWS\System32\Drivers\Winbh38.sys - force delete
выполните скрипт

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DelCLSID('4D25FB7A-8902-4291-960E-9ADA051CFBBF');
 DelCLSID('1C311AAA-D8B1-4A0A-BEE5-2387FEC583DA');
 QuarantineFile('C:\WINDOWS\system32\b4fm.dll','');
 DelBHO('{4B3803EA-5230-4DC3-A7FC-33638F3D3542}');
 DelBHO('{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}');
 DeleteService('Winsy16');
 DeleteService('Winpv52');
 DeleteService('Winci41');
 DeleteService('Winbh38');
 DeleteService('WudfSvclanmanworkstation');
 DeleteService('wscsvcSymantecWMPNetworkSvc');
 DeleteService('WmdmPmSNRpcSs');
 DeleteService('WebClientProtectedStorage');
 DeleteService('WebClientDefWatch');
 DeleteService('UPSSymantecWMPNetworkSvcRpcLocator');
 DeleteService('UPSSymantecWMPNetworkSvc');
 DeleteService('TlntSvrProtectedStorage');
 DeleteService('TermServiceAudioSrvTrkWks');
 DeleteService('TermServiceAudioSrv');
 DeleteService('TapiSrvRemoteAccess');
 DeleteService('TapiSrv Smart');
 DeleteService('SymantecWMPNetworkSvc');
 DeleteService('SNDSrvcAppMgmtxmlprov');
 DeleteService('SamSsseclogon');
 DeleteService('RDSessMgrWMPNetworkSvc');
 DeleteService('RDSessMgrdmserverUPS');
 DeleteService('PlugPlayWZCSVC');
 DeleteService('HidServose');
 DeleteService('EventlogThemes');
 DeleteService('dmserverUPS');
 DeleteService('BrowserSwPrv');
 DeleteService('ATIRDSessMgr');
 DeleteService('AtiProtectedStorage');
 DeleteService('AtiNtLmSspDnscache');
 DeleteService('AtiNtLmSsp');
 DeleteService('AppMgmtxmlprov');
 DeleteService('AppMgmtTapiSrv');
 DeleteService('AdobeDhcp');
 QuarantineFile('C:\WINDOWS\system32\Drivers\Winbh38.sys','');
 QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
 DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 DeleteFile('C:\WINDOWS\system32\Drivers\Winbh38.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winci41.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winpv52.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winsy16.sys');
 DeleteFile('C:\WINDOWS\system32\blphcvgbj0eee9.scr');
 DeleteFile('WinCtrl32.dll');
 DeleteFile('C:\PROGRA~1\Crawler\Toolbar\ctbr.dll');
 DeleteFile('C:\WINDOWS\system32\b4fm.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

пришлите карантин согласно приложения 3 правил
повторите логи

[Reichstag]

Терминатора убрал, но скрипт не помогает, файл вручную не удал.

[V_Bond]

что не помогает ... ?
1 скрипт выполнить
2 логи повторить ...