В браузере открывается реклама

[regedt64]

Повсюду различная реклама. Логи - CollectionLog-2015.05.14-19.24.zip

[thyrex]

Выполните скрипт в AVZ

 

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\Users\днс\applic~1\pennybee\update~1\update~1.exe','');
QuarantineFile('C:\Users\днс\appdata\local\convertad\casrv.exe','');
QuarantineFile('C:\Users\днс\appdata\roaming\pennybee\update~1\update~1.exe','');
QuarantineFile('C:\Users\днс\appdata\roaming\vopackage\vosrv.exe','');
QuarantineFile('C:\Program Files (x86)\ver6BlockAndSurf\J6BlockAndSurfR79.exe','');
DelBHO('{7CE987D5-11B3-44FC-9C3D-03069360D462}');
QuarantineFile('C:\Program Files (x86)\ver6BlockAndSurf\184.dll','');
QuarantineFile('C:\Program Files (x86)\offerrsoft\zE2NiMcLmFLsG3.dll','');
QuarantineFile('C:\Program Files (x86)\lowrratEa\H3Dk55wHfV21J7.dll','');
DelBHO('{e2924de2-f24f-4738-a1b6-40825220e3d7}');
DelBHO('{debf01dd-36cd-43ef-963c-a209462c49fb}');
DelBHO('{D71A683E-C9E3-F804-9685-2A9D36B20547}');
DelBHO('{1FE48F08-A2AC-44AC-A21C-0556D91C50DA}');
QuarantineFile('C:\Program Files (x86)\advPlugin\Toolbar32.dll','');
QuarantineFile('C:\ProgramData\{a094f418-0d57-eb15-a094-4f4180d5d060}\SuperOptimizer.exe','');
QuarantineFile('C:\Users\днс\AppData\Local\Kometa\Application\kometa.exe','');
SetServiceStart('iSafeKrnlMon', 4);
SetServiceStart('iSafeKrnlR3', 4);
SetServiceStart('iSafeNetFilter', 4);
SetServiceStart('pfnfd_1_10_0_8', 4);
SetServiceStart('webinstrNewH', 4);
SetServiceStart('{5eeb83d0-96ea-4249-942c-beead6847053}Gw64', 4);
DeleteService('{5eeb83d0-96ea-4249-942c-beead6847053}Gw64');
DeleteService('webinstrNewH');
DeleteService('iSafeNetFilter');
DeleteService('iSafeKrnlR3');
DeleteService('iSafeKrnlMon');
SetServiceStart('iSafeKrnlKit', 4);
DeleteService('iSafeKrnlKit');
SetServiceStart('iSafeKrnl', 4);
DeleteService('iSafeKrnl');
DeleteService('pfsvc_1.10.0.8');
SetServiceStart('Update Service for advPlugin', 4);
DeleteService('Update Service for advPlugin');
QuarantineFile('C:\WINDOWS\system32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}w64.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}Gw64.sys','');
QuarantineFile('C:\WINDOWS\system32\Drivers\webinstrNewH.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\pfnfd_1_10_0_8.sys','');
QuarantineFile('c:\program files (x86)\elex-tech\yac\isafetray.exe','');
TerminateProcessByName('c:\program files (x86)\elex-tech\yac\isafetray.exe');
TerminateProcessByName('c:\program files (x86)\advplugin\basement\extensionupdaterservice.exe');
QuarantineFile('c:\program files (x86)\advplugin\basement\extensionupdaterservice.exe','');
TerminateProcessByName('C:\Program Files (x86)\advPlugin\Basement\ExtensionUpdaterService.exe');
QuarantineFile('C:\Program Files (x86)\advPlugin\Basement\ExtensionUpdaterService.exe','');
TerminateProcessByName('c:\program files (x86)\ver6blockandsurf\blockandsurf.exe');
QuarantineFile('c:\program files (x86)\ver6blockandsurf\blockandsurf.exe','');
DeleteFile('c:\program files (x86)\ver6blockandsurf\blockandsurf.exe','32');
DeleteFile('C:\Program Files (x86)\advPlugin\Basement\ExtensionUpdaterService.exe','32');
DeleteFile('c:\program files (x86)\advplugin\basement\extensionupdaterservice.exe','32');
DeleteFile('c:\program files (x86)\elex-tech\yac\isafetray.exe','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\curlpp.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iCommon.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iCommu.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iImportLib.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafechlp.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafemc.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeMon.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafepxy.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isaferpt.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\isafesopt.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPDesk.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPFeedback.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPFloaty.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPMsgCenter.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPNodisturb.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPProtect.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPPush.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPStartupAssist.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPVirus.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iTPWifi.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\libcurl.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\LIBEAY32.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\libpng.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\ouilibx.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\sqlite3.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\SSLEAY32.dll','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\iSafeNetFilter.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\pfnfd_1_10_0_8.sys','32');
DeleteFile('C:\WINDOWS\system32\Drivers\webinstrNewH.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}Gw64.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}w64.sys','32');
DeleteFile('C:\Users\днс\AppData\Local\Kometa\Application\kometa.exe','32');
DeleteFile('C:\ProgramData\{a094f418-0d57-eb15-a094-4f4180d5d060}\SuperOptimizer.exe','32');
DeleteFile('C:\Program Files (x86)\advPlugin\Toolbar32.dll','32');
DeleteFile('C:\Program Files (x86)\lowrratEa\H3Dk55wHfV21J7.dll','32');
DeleteFile('C:\Program Files (x86)\offerrsoft\zE2NiMcLmFLsG3.dll','32');
DeleteFile('C:\Program Files (x86)\ver6BlockAndSurf\184.dll','32');
DeleteFile('C:\Program Files (x86)\ver6BlockAndSurf\J6BlockAndSurfR79.exe','32');
DeleteFile('C:\WINDOWS\Tasks\BlockAndSurf Update.job','64');
DeleteFile('C:\WINDOWS\system32\Tasks\BlockAndSurf Update','64');
DeleteFile('C:\Users\днс\appdata\roaming\vopackage\vosrv.exe','32');
DeleteFile('C:\Users\днс\appdata\roaming\pennybee\update~1\update~1.exe','32');
DeleteFile('C:\Users\днс\appdata\local\convertad\casrv.exe','32');
DeleteFile('C:\Users\днс\applic~1\pennybee\update~1\update~1.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Компьютер перезагрузится.

 

Выполните скрипт в AVZ

 

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

c:\quarantine.zip отправьте по адресу newvirus@kaspersky.com

Полученный ответ сообщите здесь (с указанием номера KLAN)

 

Скачайте ClearLNK и сохраните архив с утилитой на Рабочем столе.

• Распакуйте архив с утилитой в отдельную папку.

Перенесите Check_Browsers_LNK.log на ClearLNK как показано на рисунке

 

 

Отчет о работе ClearLNK-<Дата>.log будет сохранен в папке LOG.

Прикрепите этот отчет к своему следующему сообщению.

 

 

Сделайте новые логи по правилам

[regedt64]

Половину убило, половину сам доделал, спасибо

Изменено 17 мая, 2015 пользователем regedt64

[Roman_Five]

 

 

Сделайте новые логи по правилам