Недавно была сильная вирусная атака.

[Olesya_GA]

У меня сильное подозрение что на мой компьютер напали вирусы. Посмотрите пожалуйста.

[Гриша]

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\system32\_scui.cpl','');
 QuarantineFile('autorun.bat','');
 DeleteService('Winyn66');
 DeleteService('Winxt44');
 DeleteService('Winxd22');
 DeleteService('Winws00');
 DeleteService('Winwn66');
 DeleteService('Winty22');
 DeleteService('Wintw55');
 DeleteService('Winsx00');
 DeleteService('Winov55');
 DeleteService('Winne66');
 DeleteService('Winna55');
 DeleteService('Winna11');
 DeleteService('Winmm66');
 DeleteService('Winmk11');
 DeleteService('Winls33');
 DeleteService('Winkp66');
 DeleteService('Winkg55');
 DeleteService('Winjs11');
 DeleteService('Winhv00');
 DeleteService('Wingn00');
 DeleteService('Wingm22');
 DeleteService('Wingc22');
 DeleteService('Winfi00');
 DeleteService('Winch00');
 DeleteService('Winca00');
 DeleteService('Winbk77');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winyn66.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winxt44.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winxd22.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winwn66.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winty22.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winsx00.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winqf33.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winov55.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winof88.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winls33.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winkp66.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winkg55.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winkf77.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winjs11.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winjj33.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winhv00.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wingn00.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wingm22.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wingc22.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winfi00.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winao88.sys','');
 DeleteService('wuauservTlntSvr');
 DeleteService('wscsvcstisvc');
 DeleteService('W32TimeWmi');
 DeleteService('TrkWksRasMan');
 DeleteService('ShellHWDetectionSCardSvr');
 DeleteService('ShellHWDetectionLmHosts');
 DeleteService('ServiceLayerRpcLocator');
 DeleteService('seclogonseclogon');
 DeleteService('ScheduleNla');
 DeleteService('SamSsxmlprov');
 DeleteService('RpcLocatorseclogon');
 DeleteService('RasAutoProtectedStorageHidServ');
 DeleteService('ProtectedStorageHidServ');
 DeleteService('NVSvcupnphost');
 DeleteService('NetmanLmHosts');
 DeleteService('NetmanAntiVirServiceUPS');
 DeleteService('NetmanAntiVirService');
 DeleteService('NetDDEdsdmAlerter');
 DeleteService('mnmsrvcDhcpServiceLayer');
 DeleteService('lanmanworkstationxmlprov');
 DeleteService('HidServAudioSrv');
 DeleteService('Google Online Services');
 QuarantineFile('Google Online Services.sys','');
 DeleteService('FastUserSwitchingCompatibilityWmdmPmSN');
 DeleteService('EventSystemNetDDEdsdm');
 DeleteService('DhcpServiceLayerServiceLayerRpcLocator');
 DeleteService('DhcpServiceLayer');
 DeleteService('CryptSvcNtmsSvc');
 DeleteService('BrowserNetman');
 QuarantineFile('srv.exe','');
 DeleteFile('srv.exe');
 DeleteFile('Google Online Services.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winao88.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winat33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winbk77.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winch00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winfi00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winft33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wingc22.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wingm22.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wingn00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winhv00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winjj33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winjs11.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winkf77.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winkg55.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winkp66.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winls33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winmk11.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winmm66.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winna11.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winna55.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winne66.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winof88.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winov55.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winqf33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winsx00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wintw55.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winty22.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winul44.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winwn66.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winws00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winxd22.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winxt44.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winyn66.sys');
 DeleteFile('WinCtrl32.dll');
 DeleteFile('autorun.bat');
 DeleteFile('C:\WINDOWS\system32\_scui.cpl');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(5 );
ExecuteRepair(6 );
RegKeyStrParamWrite('HKCU','Control Panel\International','sTimeFormat','H:mm:ss');
RegKeyStrParamWrite('HKEY_USERS','.DEFAULT\Control Panel\Desktop','Wallpaper','');
RebootWindows(true);
end.

Пришлите карантин по правилам и повторите логи...

[Olesya_GA]

Вроде бы все сделали

[Гриша]

Пофиксить

O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

begin
ClearQuarantine;    
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteService('Winca00');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winca00.sys');
BC_ImportDeletedList;
ExecuteSysClean;
BC_DeleteSvc('Winca00');    
BC_Activate;
RebootWindows(true);
end.

Повторите пункт 2 диагностики...

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 51
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\windows\\system32\\_scui.cpl - not-a-virus:FraudTool.Win32.XPSecurityCenter.bq (DrWEB: Trojan.Fakealert.2082)