-
Junior Member
- Вес репутации
- 56
Баннер при загрузке Windows
Приветствую всех. Пишу с зараженного ПК соседа, симптомы заражения такие: при загрузке выплывает светло-синий баннер о том, что Windows заблокирован. Мышь за пределы экрана баннера не может вылезти, диспетчер задач автоматом закрывается. Рабочего стола нету, "Пуска" тоже нету. В безопасный режим не войти, тоже выплывает этот баннер. Каким-то чудом обошли этот баннер и просканировали систему через 2 утилиты. Посмотрите пожалуйста эти файлы.
Последний раз редактировалось Dark_KRONOS; 02.02.2011 в 15:20.
-
Будь в курсе!
Будь в курсе!
Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:
-
Junior Member
- Вес репутации
- 56
После проверки avz запустился рабочий стол (через диспетчер задач запустил explorer.exe).
-
Выполните скрипт в AVZ
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
QuarantineFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
','');
DeleteFile('C:\Documents and Settings\Женя\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Opera\Opera\temporary_downloads\flash_player.exe
');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
Компьютер перезагрузится.
Пришлите карантин согласно Приложения 3 правил по красной ссылке Прислать запрошенный карантин вверху темы
Очистите кэш Опера
Сделайте новые логи
Microsoft MVP 2012-2016 Consumer Security
Microsoft MVP 2016 Reconnect
-