1. Пофиксите в hijackthis:
Код:
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
2. Выполните скрипт в AVZ (AVZ, Меню Файл\Выполнить скрипт. Подробнее...):
Код:
begin
DeleteFileMask(GetAVZDirectory+'Quarantine', '*.*', true);
SearchRootkit(true, true);
SetAVZGuardStatus(true);
QuarantineFile('C:\WINDOWS\system32\ntos.exe','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winyh53.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winxf18.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winve87.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winve08.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winvd28.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Wintb31.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winsa86.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winry86.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winpx75.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winow32.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winmt52.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlu76.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt54.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt43.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt32.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt20.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winkt87.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winjr08.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winiq53.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winiq21.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winip53.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winen32.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Windl53.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winbk54.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winbj42.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winbj30.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\glaide32.sys','');
DeleteService('Winry86');
DeleteService('Winsa86');
DeleteService('Wintb31');
DeleteService('Winvd28');
DeleteService('Winve08');
DeleteService('Winve87');
DeleteService('Winxf18');
DeleteService('Winyh53');
DeleteService('Winpx75');
DeleteService('Winow32');
DeleteService('Winmt52');
DeleteService('Winlu76');
DeleteService('Winlt86');
DeleteService('Winlt54');
DeleteService('Winip53');
DeleteService('Winen32');
DeleteService('Winiq21');
DeleteService('Winiq53');
DeleteService('Winjr08');
DeleteService('Winkt87');
DeleteService('Winlt20');
DeleteService('Winlt32');
DeleteService('Winlt43');
DeleteService('Windl53');
DeleteService('Winbk54');
DeleteService('Winbj42');
DeleteService('Winbj30');
DeleteService('glaide32');
DeleteFile('C:\WINDOWS\System32\Drivers\Winbj30.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winbj42.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winbk54.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Windl53.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winen32.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winip53.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winiq21.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winiq53.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winjr08.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winkt87.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt20.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt32.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt43.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt54.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlu76.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winmt52.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winow32.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winpx75.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winry86.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winsa86.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wintb31.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winvd28.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winve08.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winve87.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxf18.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winyh53.sys');
DeleteFile('C:\WINDOWS\system32\ntos.exe');
DeleteFile('C:\WINDOWS\Installer\6c5e82.msi');
DeleteFile('C:\WINDOWS\system32\drivers\glaide32.sys');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
RebootWindows(true);
end.
После выполнения скрипта компьютер перезагрузится.
Файл quarantine.zip из папки AVZ закачайте по ссылке прислать запрошенный карантин вверху темы. Сделайте новый копмлект логов + лог GMER (ссылка в подписи)