Перейти к содержанию
Правила раздела

Вирусняк словил.

kirill_Andreich

Автор kirill_Andreich
в Помощь в удалении вирусов

 Поделиться

Рекомендуемые сообщения

kirill_Andreich

kirill_Andreich

Опубликовано
Опубликовано

Добрый день.Опять словил похожий вирус,но на другой компьютер)На раб столе стало много левых программ и комп стал сильно "тупить".

CollectionLog-2015.06.06-14.10.zip

thyrex

thyrex

Опубликовано
Опубликовано

Выполните скрипт в AVZ

 

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\Program Files\edu app\bin\36ed28a4ac0a465391ff10beb4246550.dll','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe','');
QuarantineFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','');
QuarantineFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5.exe','');
QuarantineFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11.exe','');
QuarantineFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10.exe','');
QuarantineFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7.exe','');
QuarantineFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6.exe','');
DelCLSID('{CBDECEF7-7A29-4cbf-A009-2673D82C7BF9}');
DelCLSID('{63332668-8CE1-445D-A5EE-25929176714E}');
DelCLSID('{754DF2CE-51E8-4895-B53C-6381418B84AE}');
DelCLSID('{D21D88E8-4123-48BA-B0B1-3FDBE4AE5FA4}');
DelBHO('{50F4150A-48B2-417A-BE4C-C83F580FB904}');
QuarantineFile('C:\Users\Nina\AppData\Roaming\Browsers\exe.resworb.bat','');
QuarantineFile('C:\Users\Nina\AppData\Roaming\Browsers\exe.erolpxei.bat','');
QuarantineFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe','');
SetServiceStart('TSSysKit', 4);
DeleteService('TSSysKit');
SetServiceStart('TSKSP', 4);
DeleteService('TSKSP');
SetServiceStart('TsFltMgr', 4);
DeleteService('TsFltMgr');
SetServiceStart('TSDefenseBt', 4);
DeleteService('TSDefenseBt');
SetServiceStart('TSCPM', 4);
DeleteService('TSCPM');
SetServiceStart('TS888', 4);
DeleteService('TS888');
SetServiceStart('TFsFlt', 4);
DeleteService('TFsFlt');
SetServiceStart('TAOKernelDriver', 4);
DeleteService('TAOKernelDriver');
SetServiceStart('TAOAccelerator', 4);
DeleteService('TAOAccelerator');
SetServiceStart('QQSysMon', 4);
DeleteService('QQSysMon');
SetServiceStart('QMUdisk', 4);
DeleteService('QMUdisk');
SetServiceStart('QMIEProtect', 4);
DeleteService('QMIEProtect');
SetServiceStart('kisnetm', 4);
DeleteService('kisnetm');
SetServiceStart('kisknl', 4);
DeleteService('kisknl');
SetServiceStart('KDHacker', 4);
DeleteService('KDHacker');
DeleteService('KAVBootC');
QuarantineFile('C:\Program Files\Edu App\bin\utilEduApp.exe','');
QuarantineFile('C:\Program Files\Edu App\updateEduApp.exe','');
DeleteService('Util Edu App');
DeleteService('Update Edu App');
DeleteService('TAOFrame');
QuarantineFile('C:\Program Files\Infonaut_1.10.0.14\Service\insvc.exe','');
DeleteService('insvc_1.10.0.14');
DeleteService('globalUpdatem');
DeleteService('globalUpdate');
SetServiceStart('QQPCRTP', 4);
DeleteService('QQPCRTP');
SetServiceStart('qilibyni', 4);
DeleteService('qilibyni');
SetServiceStart('kxescore', 4);
DeleteService('kxescore');
SetServiceStart('jojyhohu', 4);
DeleteService('jojyhohu');
QuarantineFile('C:\Windows\system32\Drivers\KAVBootC.sys','');
TerminateProcessByName('c:\users\nina\appdata\local\03000200-1433073257-0500-0006-000700080009\snsz89dd.tmp');
TerminateProcessByName('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpctray.exe');
TerminateProcessByName('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpcrtp.exe');
TerminateProcessByName('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpcrealtimespeedup.exe');
TerminateProcessByName('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpcpatch.exe');
TerminateProcessByName('c:\program files\tencent\qqpcmgr\10.9.16349.225\plugins\qmnetmon\qqpcnetflow.exe');
TerminateProcessByName('d:\kingg_soft\kdubba\gssll\kxetray.exe');
TerminateProcessByName('d:\kingg_soft\kdubba\gssll\kxescore.exe');
QuarantineFile('d:\kingg_soft\kdubba\gssll\kxescore.exe','');
TerminateProcessByName('c:\program files\kingsoft\shoujizhushou\kphonetray.exe');
QuarantineFile('c:\program files\kingsoft\shoujizhushou\kphonetray.exe','');
TerminateProcessByName('c:\users\nina\appdata\local\kometa\application\kometa.exe');
QuarantineFile('c:\users\nina\appdata\local\kometa\application\kometa.exe','');
TerminateProcessByName('c:\users\nina\appdata\roaming\03000200-1433051418-0500-0006-000700080009\hnsi8837.tmp');
QuarantineFile('c:\users\nina\appdata\roaming\03000200-1433051418-0500-0006-000700080009\hnsi8837.tmp','');
DeleteFile('c:\users\nina\appdata\roaming\03000200-1433051418-0500-0006-000700080009\hnsi8837.tmp','32');
DeleteFile('c:\users\nina\appdata\local\kometa\application\kometa.exe','32');
DeleteFile('c:\program files\kingsoft\shoujizhushou\kphonetray.exe','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\kxescore.exe','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\kxetray.exe','32');
DeleteFile('c:\program files\tencent\qqpcmgr\10.9.16349.225\plugins\qmnetmon\qqpcnetflow.exe','32');
DeleteFile('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpcpatch.exe','32');
DeleteFile('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpcrealtimespeedup.exe','32');
DeleteFile('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpcrtp.exe','32');
DeleteFile('c:\program files\tencent\qqpcmgr\10.9.16349.225\qqpctray.exe','32');
DeleteFile('c:\users\nina\appdata\local\03000200-1433073257-0500-0006-000700080009\snsz89dd.tmp','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\floatapp.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kadbtool.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kcomponent.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kconnectengine.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kdump.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\keasyipcn.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kexamclear.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kinfoc.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kmobilescan.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kmobiletray.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kmq.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\knewsfeed.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kphquery.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kpopclt.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kpspclient.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kpspcore.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kpspmediator.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\krapidservice.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\ksfskin.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\ksoft\softmgr.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\kusbcore.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\LIBEAY32.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\passnetwork.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\skhelper.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\SSLEAY32.dll','32');
DeleteFile('C:\Program Files\kingsoft\shoujizhushou\zlib1.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\7z.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\AndroidAssistHelper.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\arkGraphic.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\Common.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\communic.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\DlForQd.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\DLProtectComm.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\dr.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\exnscan.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\GameUpgrade.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\GarbageCleaner.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\GF.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\GFCustom.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\GFFtsysCustom.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\jgIOStub.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\libexpatw.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\libjpegturbo.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\libpng.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\MemDefrag.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\NetflowMgr.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\oDayProtect.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\FileSmash\QMSoftExt.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMBDScanner.dat','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMCloudInter\QMCloudInter.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMCpm.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMHips.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMHipsEngine.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\Common.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\GF.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\jgImage.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\jgIOStub.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\libexpatw.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\libjpegturbo.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\libpng.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\tinyxml.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\xGraphic32.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\zlib.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMonPlugin.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMRepairPlugin.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\RtpCommon.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMContextUninstall.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMContextScan.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMCommon.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMBrowserSafe.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMAVProxy.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMDlder.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMDns.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMEmKit.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMEmMat.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMExt.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMFileMon.dll','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMForbiddenWinKey.dll','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\kxescan\kaeunpack.dll','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\kxescan\kae\karchive.dat','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\kxescan\kae\kaextend.dat','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\kxescan\kae\kaext2.dat','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\kxescan\kae\kaecorem.dat','32');
DeleteFile('C:\Windows\system32\Drivers\KAVBootC.sys','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\kxescan\kdhacker.sys','32');
DeleteFile('C:\Windows\system32\drivers\kisknl.sys','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\security\ksnetm\kisnetm.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMIEProtect.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMUdisk.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQSysMon.sys','32');
DeleteFile('C:\Windows\system32\Drivers\TAOAccelerator.sys','32');
DeleteFile('C:\Windows\System32\Drivers\TAOKernel.sys','32');
DeleteFile('C:\Windows\system32\Drivers\TFsFlt.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\TS888.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\tscpm.sys','32');
DeleteFile('C:\Windows\system32\DRIVERS\TSDefenseBt.sys','32');
DeleteFile('C:\Windows\system32\drivers\TsFltMgr.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\TSKsp.sys','32');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\TSSysKit.sys','32');
DeleteFile('C:\Program Files\Infonaut_1.10.0.14\Service\insvc.exe','32');
DeleteFile('C:\Program Files\Edu App\updateEduApp.exe','32');
DeleteFile('C:\Program Files\Edu App\bin\utilEduApp.exe','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe','32');
DeleteFile('C:\Program Files\Obnovi Soft\ObnoviSoft.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Обнови Софт','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved','{63332668-8CE1-445D-A5EE-25929176714E}');
DeleteFile('C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCTray.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved','{754DF2CE-51E8-4895-B53C-6381418B84AE}');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','QQPCTray');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved','{CBDECEF7-7A29-4cbf-A009-2673D82C7BF9}');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_258','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gmsd_ru_264','command');
DeleteFile('C:\Program Files\gmsd_ru_264\gmsd_ru_264.exe','32');
DeleteFile('C:\Program Files\gmsd_ru_258\gmsd_ru_258.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinCheck','command');
DeleteFile('C:\Users\Nina\AppData\Local\03000200-1433073088-0500-0006-000700080009\bnsyF943.exe','32');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','KometaAutoLaunch_1A8AA148BC0B2033D7085BA8326EE516');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KometaAutoLaunch_1A8AA148BC0B2033D7085BA8326EE516','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\KometaLaunchPanel','command');
DeleteFile('C:\Users\Nina\AppData\Local\Kometa\Panel\KometaLaunchPanel.exe','32');
DeleteFile('C:\Users\Nina\AppData\Local\Kometa\kometaup.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\kometaup','command');
DeleteFile('C:\Users\Nina\AppData\Roaming\Browsers\exe.erolpxei.bat','32');
DeleteFile('C:\Users\Nina\AppData\Roaming\Browsers\exe.resworb.bat','32');
DeleteFile('C:\Program Files\Common Files\Tencent\QQPhoneManager\2.0.201.3198\npQQPhoneManagerExt.dll','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\kavmenu.dll','32');
DeleteFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6.job','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7.job','32');
DeleteFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7.exe','32');
DeleteFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10_user.job','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11.job','32');
DeleteFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11.exe','32');
DeleteFile('C:\Program Files\CinemaPlus-4.5vV28.05\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5.exe','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5.job','32');
DeleteFile('C:\Windows\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5_user.job','32');
DeleteFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job','32');
DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job','32');
DeleteFile('C:\Windows\Tasks\Crossbrowse.job','32');
DeleteFile('C:\Program Files\Crossbrowse\Crossbrowse\Application\utility.exe','32');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job','32');
DeleteFile('C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job','32');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6','32');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-7','32');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-10_user','32');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-11','32');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5','32');
DeleteFile('C:\Windows\system32\Tasks\68ffd55b-b383-4e0c-aad7-8b00b56d5a49-5_user','32');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP1','32');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP2','32');
DeleteFile('C:\Windows\system32\Tasks\APSnotifierPP3','32');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineCore','32');
DeleteFile('C:\Windows\system32\Tasks\globalUpdateUpdateTaskMachineUA','32');
DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','32');
DeleteFile('d:\kingg_soft\kdubba\gssll\kwsui.dll','32');
DeleteFile('C:\Program Files\edu app\bin\36ed28a4ac0a465391ff10beb4246550.dll','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
Компьютер перезагрузится.

 

Выполните скрипт в AVZ

 

begin
CreateQurantineArchive('c:\quarantine.zip');
end.
c:\quarantine.zip отправьте по адресу newvirus@kaspersky.com

Полученный ответ сообщите здесь.

 

  • Скачайте ClearLNK и сохраните архив с утилитой на рабочем столе.
  • Распакуйте архив с утилитой в отдельную папку.
  • Перенесите Check_Browsers_LNK.log на ClearLNK как показано на рисунке
    move.gif
  • Отчет о работе ClearLNK-<Дата>.log будет сохранен в папке LOG.
  • Прикрепите этот отчет к своему следующему сообщению.

 

Сделайте новые логи

thyrex

thyrex

Опубликовано
Опубликовано

Не первая Ваша тема в разделе, а не усвоили, что нужны и новые логи после лечения

kirill_Andreich

kirill_Andreich

Опубликовано
  • Автор
Опубликовано

Так я не пойму никак логи нужно опять в AVZ делать,или как?

thyrex

thyrex

Опубликовано
Опубликовано

Сделать новые логи при помощи Autologger

thyrex

thyrex

Опубликовано
Опубликовано
Скачайте Farbar Recovery Scan Tool  NAAC5Ba.png и сохраните на Рабочем столе.

 

Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

  • Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.

Убедитесь, что в окне Optional Scan отмечены "List BCD" и "Driver MD5".

B92LqRQ.png

Нажмите кнопку Scan.

После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа. Пожалуйста, прикрепите отчет в следующем сообщении.

Если программа была запущена в первый раз, будет создан отчет (Addition.txt). Пожалуйста, прикрепите его в следующем сообщении.

kirill_Andreich

kirill_Andreich

Опубликовано
  • Автор
Опубликовано

Прощу прощения за 3 одинаковых сообщения,просто интернет глючил.

Mark D. Pearlstone

Mark D. Pearlstone

Опубликовано
Опубликовано

@kirill_Andreich, сообщения удалены. Выложите логи в изначальном виде, как вас просят, а не текстом.

kirill_Andreich

kirill_Andreich

Опубликовано
  • Автор
Опубликовано

Ну Addition выкладывается с первого раза а FRST при загрузке все время пишет ошибку:

  • FRST.txt

    Загрузка пропущена (Ошибка403)

 

Addition.txt

thyrex

thyrex

Опубликовано
Опубликовано

 

 


FRST при загрузке все время пишет ошибку:
заархивируйте
thyrex

thyrex

Опубликовано
Опубликовано

Скопируйте приведенный ниже текст в Блокнот и сохраните файл как fixlist.txt в ту же папку, откуда была запущена утилита Farbar Recovery Scan Tool:

 

CreateRestorePoint:
HKLM\...\Run: [ QQPCTray] => "C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCTray.exe"  /regrun
HKLM\...\Run: [kxesc] => "d:\kingg_soft\kdubba\gssll\kxetray.exe" -autorun
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMGCShellExt.dll [2015-06-02] (Tencent)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=98537121_hao_pg
HKU\S-1-5-21-4189200625-2007257490-2007736476-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=98537121_hao_pg
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1433053998&z=6b960bcc5ca1c04708ef814gez3cac5eaw1cetat3w&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX&q={searchTerms}
SearchScopes: HKLM -> {F4137D40-259A-4FB3-B780-F8C39B303C41} URL = http://yandex.ru/yandsearch?clid=2101082&text={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = http://spacesearch.ru/?ri=1&rsid=cd79465d41cf9aec68a9cffb2c401f5c&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=ima&utm_campaign=install_ie&utm_content=ds&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX&ts=1433054034&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3C} URL = http://spacesearch.ru/?ri=1&rsid=cd79465d41cf9aec68a9cffb2c401f5c&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3D} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=ima&utm_campaign=install_ie&utm_content=ds&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX&ts=1433054034&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=ima&utm_campaign=install_ie&utm_content=ds&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX&ts=1433054034&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=ima&utm_campaign=install_ie&utm_content=ds&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX&ts=1433054034&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4189200625-2007257490-2007736476-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=ima&utm_campaign=install_ie&utm_content=ds&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX&ts=1433054034&type=default&q={searchTerms}
BHO: No Name -> {10921475-03CE-4E04-90CE-E2E7EF20C814} ->  No File
BHO: No Name -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} ->  No File
DefaultPrefix: => http://spacesearch.ru/?ri=1&rsid=cd79465d41cf9aec68a9cffb2c401f5c&q= <==== ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1433053998&z=6b960bcc5ca1c04708ef814gez3cac5eaw1cetat3w&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX
FF Plugin: @kingsfot.com/npkws -> d:\kingg_soft\kdubba\gssll\npkws.dll [2015-06-03] (Kingsoft Corporation)
FF Plugin: @qq.com/QQPCMgr -> C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\npQMExtensionsMozilla.dll [2015-06-02] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [2015-05-31] (globalUpdate)
FF Plugin: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [2015-05-31] (globalUpdate)
OPR Extension: (Edu App) - C:\Users\Nina\AppData\Roaming\Opera Software\Opera Stable\Extensions\aflbfhfpnnffgamnmnajappkdmmhmlpl [2015-05-31]
OPR Extension: (CinemaPlus-4.5vV28.05) - C:\Users\Nina\AppData\Roaming\Opera Software\Opera Stable\Extensions\bfaohpmjmhdgnjblojekjlnadhehiadj [2015-05-31]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files\Opera\Launcher.exe http://www.mystartsearch.com/?type=sc&ts=1433053998&z=6b960bcc5ca1c04708ef814gez3cac5eaw1cetat3w&from=ima&uid=HitachiXHDS721032CLA362_JP1421HN14SPMA14SPMAX
S2 kxescore; "d:\kingg_soft\kdubba\gssll\kxescore.exe" /service kxescore [X]
S2 QQPCRTP; "C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCRTP.exe" -r [X]
S2 zilujejo; C:\Users\Nina\AppData\Roaming\03000200-1433051418-0500-0006-000700080009\nsjC030.tmp [X]
R2 ksapi; C:\Windows\system32\drivers\ksapi.sys [80744 2015-06-02] (Kingsoft Corporation)
S0 KAVBootC; system32\Drivers\KAVBootC.sys [X]
S1 KDHacker; \??\d:\kingg_soft\kdubba\gssll\security\kxescan\kdhacker.sys [X]
S2 kisknl; \??\C:\Windows\system32\drivers\kisknl.sys [X]
S2 QQSysMon; \??\C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQSysMon.sys [X]
S3 TFsFlt; system32\Drivers\TFsFlt.sys [X]
S1 TSDefenseBt; system32\DRIVERS\TSDefenseBt.sys [X]
S0 TsFltMgr; system32\drivers\TsFltMgr.sys [X]
S1 TSKSP; \??\C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\TSKsp.sys [X]
S1 TSSysKit; \??\C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\TSSysKit.sys [X]
2015-06-04 22:57 - 2015-06-04 22:57 - 00000000 ____D C:\Users\Nina\AppData\Roaming\kcleaner
2015-06-04 11:32 - 2015-06-03 22:43 - 00031848 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\kavbootc64.sys
2015-06-04 11:32 - 2015-06-03 22:40 - 00033128 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\bootsafe64.sys
2015-06-04 11:32 - 2015-06-03 22:40 - 00024936 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\bootsafe.sys
2015-06-03 22:34 - 2015-06-03 22:34 - 00000000 ____D C:\Users\Nina\AppData\Roaming\shoujizhushou
2015-06-03 06:24 - 2015-06-06 13:58 - 00030392 _____ (Tencent) C:\Windows\system32\Drivers\TS888.sys
2015-06-02 21:32 - 2015-06-05 15:26 - 00000000 __SHD C:\KRECYCLE
2015-06-02 21:27 - 2015-06-02 21:27 - 00000000 ____D C:\Program Files\kingsoft
2015-06-02 21:22 - 2015-06-02 21:22 - 00000000 ____D C:\Users\Nina\AppData\Local\Kingsoft
2015-06-02 21:21 - 2015-06-05 15:26 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Kingsoft
2015-06-02 21:21 - 2015-06-02 21:20 - 00080744 _____ (Kingsoft Corporation) C:\Windows\system32\Drivers\ksapi.sys
2015-06-02 21:20 - 2015-06-04 23:13 - 00000000 ____D C:\Users\Все пользователи\Kingsoft
2015-06-02 21:20 - 2015-06-04 23:13 - 00000000 ____D C:\ProgramData\Kingsoft
2015-06-02 21:19 - 2015-06-02 21:20 - 00000000 ____D C:\Users\Nina\AppData\Roaming\yspkg5eua0il
2015-06-02 19:53 - 2015-06-02 19:53 - 00000000 ____D C:\Users\Все пользователи\TXQMPC
2015-06-02 19:53 - 2015-06-02 19:53 - 00000000 ____D C:\ProgramData\TXQMPC
2015-06-02 19:38 - 2015-06-02 20:39 - 00000000 ____D C:\Program Files\Common Files\Tencent
2015-06-02 19:38 - 2015-06-02 19:37 - 00067896 _____ (????) C:\Windows\system32\TSSK.sys
2015-06-02 19:37 - 2015-06-03 22:27 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Tencent
2015-06-02 19:37 - 2015-06-02 19:53 - 00000000 ____D C:\Users\Все пользователи\Tencent
2015-06-02 19:37 - 2015-06-02 19:53 - 00000000 ____D C:\ProgramData\Tencent
2015-06-02 19:37 - 2015-06-02 19:37 - 00000000 ____D C:\Program Files\Tencent
2015-06-02 19:34 - 2015-06-02 19:34 - 00002223 _____ C:\Users\Nina\Desktop\Kometa.lnk
2015-06-02 19:34 - 2015-06-02 19:34 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Microsoft\Windows\Start Menu\Панель запуска браузера Комета
2015-06-02 19:33 - 2015-06-04 11:08 - 00000000 ____D C:\Users\Nina\AppData\Local\Kometa
2015-06-02 19:29 - 2015-06-06 14:38 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Browsers
2015-06-02 15:54 - 2015-06-02 15:54 - 00613255 _____ (CMI Limited) C:\Users\Nina\AppData\Local\nsc1302.tmp
2015-06-02 15:39 - 2015-06-02 15:43 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Obnovi Soft
2015-06-02 15:39 - 2015-06-02 15:39 - 00001032 _____ C:\Users\Nina\Desktop\Обнови Софт.lnk
2015-06-02 15:39 - 2015-06-02 15:39 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Обнови Софт
2015-06-02 15:39 - 2015-06-02 15:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Обнови Софт
2015-06-02 15:38 - 2015-06-02 15:39 - 00000000 ____D C:\Program Files\Obnovi Soft
2015-06-02 15:35 - 2015-06-02 19:29 - 00000175 _____ C:\Users\Nina\Desktop\Искать в Интернете.url
2015-06-01 20:21 - 2015-06-01 20:21 - 00768512 _____ (Reimage®) C:\Users\Nina\Downloads\ReimageRepair (5).exe
2015-06-01 20:20 - 2015-06-01 20:20 - 00768512 _____ (Reimage®) C:\Users\Nina\Downloads\ReimageRepair (4).exe
2015-06-01 20:20 - 2015-06-01 20:20 - 00768512 _____ (Reimage®) C:\Users\Nina\Downloads\ReimageRepair (3).exe
2015-06-01 20:20 - 2015-06-01 20:20 - 00768512 _____ (Reimage®) C:\Users\Nina\Downloads\ReimageRepair (2).exe
2015-06-01 20:19 - 2015-06-01 20:19 - 00768512 _____ (Reimage®) C:\Users\Nina\Downloads\ReimageRepair.exe
2015-06-01 20:19 - 2015-06-01 20:19 - 00768512 _____ (Reimage®) C:\Users\Nina\Downloads\ReimageRepair (1).exe
2015-06-01 09:47 - 2015-06-01 09:47 - 00613255 _____ (CMI Limited) C:\Users\Nina\AppData\Local\nsd34E7.tmp
2015-06-01 07:16 - 2015-06-02 20:26 - 00000000 ____D C:\Users\Nina\AppData\Local\gmsd_ru_264
2015-06-01 07:16 - 2015-06-02 20:26 - 00000000 ____D C:\Program Files\gmsd_ru_264
2015-05-31 18:38 - 2015-05-31 18:38 - 00613255 _____ (CMI Limited) C:\Users\Nina\AppData\Local\nsx4C3B.tmp
2015-05-31 15:29 - 2015-06-01 09:49 - 00001011 _____ C:\Users\Nina\Desktop\AnyProtect.lnk
2015-05-31 15:25 - 2015-05-31 15:25 - 00613255 _____ (CMI Limited) C:\Users\Nina\AppData\Local\nsdAB51.tmp
2015-05-31 15:24 - 2015-05-31 15:24 - 00002344 _____ C:\Users\Public\Desktop\Crossbrowse.lnk
2015-05-31 15:22 - 2015-05-31 15:22 - 00000000 _____ C:\Windows\system32\Number of results
2015-05-31 13:19 - 2015-05-31 13:19 - 00000000 ____D C:\Users\Nina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-05-31 13:16 - 2015-05-31 13:16 - 00613255 _____ (CMI Limited) C:\Users\Nina\AppData\Local\nsd13E0.tmp
2015-05-31 13:16 - 2015-05-31 13:16 - 00000000 ____D C:\Program Files\globalUpdate
2015-05-31 12:34 - 2015-05-31 13:19 - 00000000 ____D C:\Program Files\AnyProtectEx
2015-05-31 12:34 - 2015-05-31 12:34 - 00613255 _____ (CMI Limited) C:\Users\Nina\AppData\Local\nsu443D.tmp
2015-05-31 12:34 - 2015-05-31 12:34 - 00000000 __SHD C:\Users\Nina\AppData\Roaming\AnyProtectEx
2015-05-31 12:34 - 2015-05-31 12:34 - 00000000 ____D C:\Users\Все пользователи\IHProtectUpDate
2015-05-31 12:34 - 2015-05-31 12:34 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-05-31 12:32 - 2015-06-02 20:30 - 00000000 ____D C:\Program Files\Edu App
2015-05-31 12:31 - 2015-06-02 20:25 - 00000000 ____D C:\Program Files\gmsd_ru_258
2015-05-31 12:31 - 2015-06-02 19:24 - 00000000 ____D C:\Users\Nina\AppData\Local\gmsd_ru_258
2015-05-31 12:28 - 2015-06-06 14:38 - 00000000 ____D C:\Program Files\CinemaPlus-4.5vV28.05
2015-05-31 12:28 - 2015-05-31 12:28 - 00000000 ____D C:\Users\Nina\AppData\Local\globalUpdate
2015-05-31 12:26 - 2015-05-31 12:26 - 00000000 ____D C:\Users\Nina\AppData\Local\Crossbrowse
2015-05-31 12:26 - 2015-05-31 12:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
2015-05-31 12:25 - 2015-05-31 12:25 - 00000000 ____D C:\Program Files\Crossbrowse
2015-05-31 12:24 - 2015-05-31 18:36 - 00000000 ____D C:\Users\Nina\AppData\Local\SmartWeb
2015-05-31 12:23 - 2015-05-31 12:23 - 00000000 ____D C:\Program Files\Infonaut_1.10.0.14
2015-05-31 11:52 - 2015-05-31 11:52 - 00000131 ____H C:\iexplore.bat
2015-05-31 11:52 - 2015-05-23 19:50 - 00815304 ____H (Microsoft Corporation) C:\iехplоrе.bаt.exe
2015-05-31 11:51 - 2015-06-06 14:38 - 00000000 ____D C:\Users\Nina\AppData\Local\03000200-1433073088-0500-0006-000700080009
C:\Users\Nina\AppData\Local\Temp\mailruhomesearchvbm.exe
C:\Users\Nina\AppData\Local\Temp\pps-qq-19.exe
FirewallRules: [{3775D802-22D6-4F94-8F21-08256C160FC0}] => (Allow) C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
FirewallRules: [{956FF75C-354C-41D9-B844-84BA59159B37}] => (Allow) C:\program files\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{1FD17ABD-2D31-4CB4-85DE-85CFD50CB3B4}] => (Allow) C:\program files\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{352916C7-5F95-402D-A6E7-801022433FF2}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCmgrInstallGuide.exe
FirewallRules: [{FD658D69-EA81-4681-BF0B-9D34808C9213}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCTray.exe
FirewallRules: [{282E2520-D4B0-45B5-AD52-70BBB02FF47B}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCMgr.exe
FirewallRules: [{831C6BF6-0984-4426-AF42-0C760DD39360}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCRTP.exe
FirewallRules: [{B3EA982A-F845-41D7-A578-DF1FB2834B9B}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMDL.exe
FirewallRules: [{F1DCDEAD-06F3-4441-B12E-2C3BD27A54A0}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\bugreport.exe
FirewallRules: [{897AB02E-F1BA-4654-88C1-C9F75A855ABA}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCFileOpen.exe
FirewallRules: [{DFAD0929-F4E2-4F44-8414-305D27A12CAC}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCLeakScan.exe
FirewallRules: [{2201EAE5-8016-4880-B6FB-D2BAA47A41A4}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPConfig.exe
FirewallRules: [{C90414C5-4E41-402C-9DAF-D61A573C72F9}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCSoftMgr.exe
FirewallRules: [{6346CA34-FE57-46D6-BF83-7F1CA2A915F8}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\plugins\QMNetMon\QQPCNetFlow.exe
FirewallRules: [{43EB26CB-7658-4D67-86A1-B15D14C1C1A4}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCBTU.exe
FirewallRules: [{96A068BA-E894-4DEA-B567-0430A00AF3E3}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCClinic.exe
FirewallRules: [{DDC7AD23-CB70-453B-8224-96DFF5BBD5F4}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCLaunch.exe
FirewallRules: [{72A30D2E-55A8-430A-AF80-93BD3864AD5F}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMUpdate\QQPCMgrUpdate.exe
FirewallRules: [{B614B470-DC0C-451F-8DF0-941700A3BDEA}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCSoftGame.exe
FirewallRules: [{44036D3B-CA59-4C95-84ED-C7D3493B1D5E}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCSysOptimize.exe
FirewallRules: [{6597EB39-2B28-4903-BEAA-73B90E94B837}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCUpdateAVLib.exe
FirewallRules: [{71BC1199-7DAC-4339-9F61-B6BB28A75D5C}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQRepair.exe
FirewallRules: [{CE98251B-0DC7-4576-AC1A-3F5531390AB5}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\Uninst.exe
FirewallRules: [{8F9CCD86-F316-402D-95C9-2579A873C12E}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QQPCPatch.exe
FirewallRules: [{AC6FC63D-586B-4FC6-AE83-83323074A383}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\TpkUpdate.exe
FirewallRules: [{067F8FDE-0A39-4835-BBDA-00F60D2E93B3}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMRouterMgr.exe
FirewallRules: [{EC42753B-DB7C-4462-957F-469E5FFEB564}] => (Allow) C:\Program Files\Tencent\QQPCMgr\10.9.16349.225\QMAccountProtection.exe
FirewallRules: [{6B630A66-0937-4FB0-949F-3A97E08E6ED0}] => (Allow) C:\Users\Nina\AppData\Local\Temp\TENCENTDOWNLOAD.EXE
FirewallRules: [{9DBF75D6-68E5-40E5-89CA-131E9B879CC6}] => (Allow) C:\Users\Public\Documents\Tencent\QQGameZone\IEProc.exe
FirewallRules: [{D9FF4591-37B0-41D2-907B-5AB70A2C19EE}] => (Allow) C:\Users\Public\Documents\Tencent\QQGameZone\QQGameBoxSvc.exe
FirewallRules: [{C59A5D73-FD40-4362-8CF9-7AA6D65537E3}] => (Allow) C:\Users\Public\Documents\Tencent\QQGameZone\QQGameZone.exe
FirewallRules: [{205F55BA-31C8-4EB1-B59A-C643F04C4F87}] => (Allow) C:\Program Files\kingsoft\shoujizhushou\kphonetray.exe
FirewallRules: [{C8A84F40-E3A7-4980-B50B-1D08BFE9CF17}] => (Allow) C:\Program Files\kingsoft\shoujizhushou\kphonetray.exe
Task: {CE623239-EE57-474C-BC06-355C62674F45} - \SmartWeb Upgrade Trigger Task No Task File <==== ATTENTION
Task: {CD6B8987-ADDF-4999-96CE-10EEA9A49124} - \68ffd55b-b383-4e0c-aad7-8b00b56d5a49-1-6 No Task File <==== ATTENTION
Reboot:

  • Запустите FRST, нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении!
  • Обратите внимание, что компьютер будет перезагружен.

Пожалуйста, войдите, чтобы комментировать

Вы сможете оставить комментарий после входа в



Войти
 Поделиться
Перейти к списку тем
×
×
  • Создать...