Посмотрите пожалуйста

[alivan]

Собственно логи.

[polword]

1.Профиксите в HijackThis

F2 - REG:system.ini: Shell=explorer.exe c:\Recycler\smss.exe

2.Закройте все открытые приложения, кроме АVZ и Internet Explorer.
Отключите
- ПК от интернета/локалки
- Обязательно!!! Системное восстановление!!! как- посмотреть можно тут
- Выгрузите антивирус и/или Файрвол
- Закройте все программы
- Выполните скрипт в AVZ

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 QuarantineFile('F:\autorun.inf','');
 TerminateProcessByName('c:\recycler\smss.exe');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP98\A0011417.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011361.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011332.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011326.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011325.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011302.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011301.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011227.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011226.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011181.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011180.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011151.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011150.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011137.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011136.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011088.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0011013.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0011012.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0010985.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0010984.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP90\A0010794.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP90\A0010793.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP119\A0016719.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP119\A0016718.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016640.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016639.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016554.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016553.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016508.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016507.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016497.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016496.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016419.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016418.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016396.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016395.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP115\A0016387.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP115\A0016386.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016270.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016269.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016266.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016265.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016261.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016253.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016252.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016238.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016237.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016229.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016228.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016217.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016216.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016215.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016192.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016191.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016072.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016071.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016004.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016003.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP110\A0015999.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP110\A0015998.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP110\A0015920.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP108\A0015829.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP108\A0015828.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP107\A0015816.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP107\A0015815.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP107\A0015786.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013614.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013613.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013612.exe','');
 QuarantineFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013611.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Рабочий стол\Музыка\KasperKey2010.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Рабочий стол\мое\ответы на вопросы\.{645FF040-5081-101B-9F08-00AA002F954E}\md.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Рабочий стол\мое\.{645FF040-5081-101B-9F08-00AA002F954E}\md.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Рабочий стол\.{645FF040-5081-101B-9F08-00AA002F954E}\md.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Мои документы\KasperKey2010.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Мои документы\.{645FF040-5081-101B-9F08-00AA002F954E}\md.exe','');
 QuarantineFile('C:\Documents and Settings\usr\.{645FF040-5081-101B-9F08-00AA002F954E}\md.exe','');
 QuarantineFile('C:\Documents and Settings\usr\Application Data\Microsoft\Word\STARTUP\Winword.exe','');
 QuarantineFile('C:\Documents and Settings\usr\KasperKey2010.exe','');
 QuarantineFile('c:\recycler\smss.exe','');
 DeleteFile('c:\recycler\smss.exe');
 DeleteFile('C:\Documents and Settings\usr\KasperKey2010.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013611.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013612.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013613.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP101\A0013614.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP107\A0015786.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP107\A0015815.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP107\A0015816.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP108\A0015828.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP108\A0015829.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP110\A0015920.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP110\A0015998.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP110\A0015999.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016003.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016004.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016071.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP111\A0016072.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016191.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016192.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016215.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016216.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016217.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016228.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016229.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016237.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016238.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016252.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016253.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016261.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016265.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016266.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016269.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP113\A0016270.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP115\A0016386.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP115\A0016387.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016395.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016396.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016418.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP116\A0016419.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016496.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016497.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016507.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP117\A0016508.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016553.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016554.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016639.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP118\A0016640.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP119\A0016718.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP119\A0016719.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP90\A0010793.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP90\A0010794.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0010984.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0010985.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0011012.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP93\A0011013.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011087.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011088.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011136.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP94\A0011137.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011150.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011151.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011180.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP95\A0011181.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011226.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011227.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011301.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011302.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011325.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011326.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011332.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP96\A0011361.exe');
 DeleteFile('C:\System Volume Information\_restore{4DD8E7EA-1A80-4766-84C3-88173F50BED3}\RP98\A0011417.exe');
 DeleteFile('F:\autorun.inf');
 BC_ImportAll;
 ExecuteSysClean;
  ExecuteWizard('TSW', 2, 2, true);
 ExecuteWizard('SCU', 2, 2, true);
 RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun',221);
 BC_Activate;
 RebootWindows(true);
end.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы
- Сделайте повторные логи по правилам п.2 и 3 раздела Диагностика.(virusinfo_syscheck.zip;hijackthis.log)
- Сделайте лог MBAM

[alivan]

Карантин отправил.

[thyrex]

Удалите в МВАМ

Зараженные ключи в реестре:
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.

Зараженные файлы:
C:\WINDOWS\system32\dp1.fne (Worm.Autorun) -> No action taken.
C:\WINDOWS\system32\internet.fne (HackTool.Patcher) -> No action taken.
C:\WINDOWS\system32\com.run (Trojan.Banker) -> No action taken.
C:\WINDOWS\system32\eAPI.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\krnln.fnr (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\og.dll (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\og.EDT (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\RegEx.fnr (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\shell.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\spec.fne (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\ul.dll (Worm.AutoRun) -> No action taken.

[alivan]

Сделал.

[thyrex]

А новый лог МВАМ где? Что с проблемой?

[alivan]

Прошу прощения. Забыл отправить.
Вирусы еще бегают.

[polword]

- удалите в MBAM

Объекты реестра заражены:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe c:\Recycler\smss.exe) Good: (Explorer.exe) -> No action taken.

повторите лог

[alivan]

Сделал

[Никита Соловьев]

Чисто

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 172
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\documents and settings\\usr\\application data\\microsoft\\word\\startup\\winword.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  2. c:\\documents and settings\\usr\\kasperkey2010.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  3. c:\\documents and settings\\usr\\мои документы\\kasperkey2010.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  4. c:\\documents and settings\\usr\\мои документы\\.{645ff040-5081-101b-9f08-00aa002f954e}\\md.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  5. c:\\documents and settings\\usr\\рабочий стол\\мое\\ответы на вопросы\\.{645ff040-5081-101b-9f08-00aa002f954e}\\md.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  6. c:\\documents and settings\\usr\\рабочий стол\\мое\\.{645ff040-5081-101b-9f08-00aa002f954e}\\md.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  7. c:\\documents and settings\\usr\\рабочий стол\\музыка\\kasperkey2010.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  8. c:\\documents and settings\\usr\\рабочий стол\\.{645ff040-5081-101b-9f08-00aa002f954e}\\md.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  9. c:\\documents and settings\\usr\\.{645ff040-5081-101b-9f08-00aa002f954e}\\md.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )
  10. c:\\recycler\\smss.exe - Trojan.Win32.Siscos.acq ( DrWEB: Trojan.Siggen.46202, BitDefender: Trojan.Generic.3811626, NOD32: Win32/AutoRun.Delf.FQ worm, AVAST4: Win32:Crypt-GGI [Trj] )