Удаление вируса Baidu (китайский) на Windows 7 x64

[vanyaand1 0]

Запустил исполняемый файл, после которого на машине появилось много приложений с китайской локализацией и общим корнем в названии Baidu.

 

Лог в аттаче.

CollectionLog-2014.11.05-11.00.zip

[thyrex 1 472]

????2.3-->C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\uninst.exe

????2.1-->C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\uninst.exe

 

 

удалите через Установку программ (лучше в безопасном режиме)

 

Изменения в файл hosts сами вносили?

 

Выполните скрипт в AVZ

begin

BC_DeleteFile('c:\program files (x86)\baidu\baiduan\2.3.0.2225\baiduanupdate.exe');
 BC_DeleteFile('c:\program files (x86)\common files\baidu\baiduhips\1.0.0.667\baiduhips.exe');
 BC_DeleteFile('c:\program files (x86)\baidu\baidusd\2.1.0.3086\baidusdsvc.exe');
 BC_DeleteFile('c:\program files (x86)\baidu\baiduan\2.3.0.2225\bdaleakfixer.exe');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\ad.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDKitUtils.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\BDMAVEng.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\bdmantivirus\bduf.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\BDMDownload.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\BDMReport.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\dl.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\DriverManager.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\EnhanceBoost.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMNetMonMgrDll.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMProcessRunningTime.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccDataMgr.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccEngine.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\FTSOManager\BDMSOLiveAccStrategyMgr.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\FTSOManager\SysAccMgrDll.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\Plugins\BDMPatcherPlugins\BDMConnect.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\Plugins\BDMPatcherPlugins\BDMPatcher.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\BDMNetMonSusPlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\plugins\bdmsusplugins\BDMSOAccSusPlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\Plugins\bdmtrayplugins\BDMSOAccTrayPlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\Plugins\bdmtrayplugins\BDMSOCleanerTrayPlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\ad.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\HipsClient.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\plugins\RTPPlugins\BDMSOAccServicePlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\Plugins\bdmtrayplugins\BDMTrayTipsPlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\2.3.0.2225\Plugins\BDMTrayPlugins\BDMSusPlugin.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\BAV\BavCommon.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\BAV\BavEngine.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\BAV\BavFrame.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\BAV\BavScanH.dll');
 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\2.1.0.3086\BAV\BavScanM.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDMNet.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDMFrameWork.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDMBase.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDMAVEng.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDMAVCached.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDLogicUtils.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\TrustAndIso.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\DriverManager.dll');
 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.0.0.667\BDMTinyXml.dll');
 BC_DeleteFile('C:\Windows\system32\DRIVERS\bd0001.sys');
 BC_DeleteFile('C:\Windows\system32\DRIVERS\bd0002.sys');
 BC_DeleteFile('C:\Windows\system32\DRIVERS\bd0003.sys');
 BC_DeleteFile('C:\Windows\system32\DRIVERS\BDArKit.sys');
 BC_DeleteSvc('BaiduHips');
 BC_DeleteSvc('BDKVRTP');
 BC_DeleteSvc('bd0001');
 BC_DeleteSvc('bd0002');
 BC_DeleteSvc('bd0003');
 BC_DeleteSvc('BDArKit');

BC_Activate;
RebootWindows(false);
end.

Компьютер перезагрузится.

 

Сделайте новые логи

 

Сделайте лог ComboFix

[vanyaand1 0]

Сделал все операции

Хосты - мои

Логи в аттаче.

CollectionLog-2014.11.06-12.03.zip

ComboFix.txt

[thyrex 1 472]

Скопируйте текст ниже в Блокнот и сохраните как файл с названием CFScript.txt в корень диска С.

KillAll::
 
File::
c:\windows\SysWow64\drivers\BDArKit(1).sys
c:\windows\SysWow64\an.bat
c:\windows\system32\drivers\bd0001_1.sys
c:\windows\SysWow64\sd.bat
c:\windows\SysWow64\drivers\bd0003.sys
 
Driver::
BaiduHips
 
Folder::
c:\users\igorbatenko\AppData\Roaming\Baidu
c:\program files (x86)\Common Files\Baidu
c:\programdata\Baidu
 
Registry::
 
FileLook::
 
DirLook::

После сохранения переместите CFScript.txt на пиктограмму ComboFix.exe.

Когда сохранится новый отчет ComboFix.txt, прикрепите его к сообщению.

[vanyaand1 0]

Новый лог.

ComboFix.txt

[thyrex 1 472]

c:\windows\SysWow64\drivers\BDArKit(1).sys

c:\windows\SysWow64\an.bat

c:\windows\system32\drivers\bd0001_1.sys

c:\windows\SysWow64\sd.bat

c:\windows\SysWow64\drivers\bd0003.sys

 

если найдутся, удалите вручную

 

Проблема решена?

[vanyaand1 0]

 

c:\windows\SysWow64\drivers\BDArKit(1).sys

c:\windows\SysWow64\an.bat

c:\windows\system32\drivers\bd0001_1.sys

c:\windows\SysWow64\sd.bat

c:\windows\SysWow64\drivers\bd0003.sys

 

если найдутся, удалите вручную

 

Проблема решена?

 

Да, 

Огромное Спасибо!

[thyrex 1 472]

Удалите ComboFix