Файлы зашифрованы в xtbl

[alexti 0]

Файла Readme.txt нету. Удалили антивирусом.

логи:

 

 

Прошу помочь (если есть шанс).

CollectionLog-2015.06.12-15.52.zip

[thyrex 1 473]

Выполните скрипт в AVZ

 

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\Users\Admin\appdata\roaming\searchindexer\moduleinno.exe','');
QuarantineFile('C:\Users\Admin\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.19.2\dsrsetup.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.19.2\dsrlte.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\SmartWeb\SmartWebHelper.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\SystemDir\nethost.exe','');
QuarantineFile('C:\Users\Admin\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe','');
QuarantineFile('C:\Program Files (x86)\Microsoft Data\install_addons.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\delta\delta\1.3.25.0\bdsetup.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\delta\delta\1.3.25.0\bdraw.exe','');
QuarantineFile('C:\Program Files (x86)\ver7BlockAndSurf\J4BlockAndSurfJ52.exe','');
DelBHO('{03AE1B7B-A9E7-4D5A-9D34-89999C31B659}');
QuarantineFile('C:\Program Files (x86)\Torrent Search\IEEF\_CeujFRG4X.dll','');
QuarantineFile('c:\progra~3\bitguard\271832~1.68\{c16c1~1\bitguard.dll','');
QuarantineFile('C:\Users\Admin\AppData\Roaming\Browsers\exe.resworb.bat','');
QuarantineFile('C:\Users\Admin\AppData\Roaming\Browsers\exe.erolpxei.bat','');
QuarantineFile('C:\Users\Admin\AppData\Roaming\Browsers\exe.emorhc.bat','');
QuarantineFile('C:\Users\Admin\AppData\Local\Temp\UsageTemp.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\ConvertAd\ConvertAd.exe','');
DeleteService('iSafeKrnlR3');
DeleteService('iSafeKrnlMon');
DeleteService('iSafeKrnlKit');
DeleteService('iSafeKrnlBoot');
DeleteService('iSafeKrnl');
SetServiceStart('{0ca29851-3273-497e-b859-b648c9a6fe3a}w64', 4);
DeleteService('{0ca29851-3273-497e-b859-b648c9a6fe3a}w64');
SetServiceStart('webTinstMKTN', 4);
DeleteService('webTinstMKTN');
SetServiceStart('qrnfd_1_10_0_9', 4);
DeleteService('qrnfd_1_10_0_9');
DeleteService('VCL');
DeleteService('VuuPCConnectivity');
DeleteService('WindowsMangerProtect');
QuarantineFile('C:\Program Files (x86)\IGS\VCL.exe','');
DeleteService('rebebicu');
DeleteService('RemoteEngineService');
DeleteService('todufesi');
QuarantineFile('C:\Users\Admin\AppData\Local\35453035-1427223620-4333-4439-4238FFFFFFFF\cnsr7E05.tmp','');
QuarantineFile('C:\Users\Admin\AppData\Local\35453035-1427223637-4333-4439-4238FFFFFFFF\snswAE94.tmp','');
QuarantineFile('C:\Program Files (x86)\QuickRef_1.10.0.9\Service\qrsvc.exe','');
DeleteService('qrsvc_1.10.0.9');
DeleteService('IHProtect Service');
DeleteService('iSafeService');
DeleteService('MaintainerSvc1.47.6049145');
QuarantineFile('C:\ProgramData\2ce8e63b-5e53-4efc-b4cf-6a6e52e017a4\maintainer.exe','');
QuarantineFile('C:\Program Files (x86)\XTab\ProtectService.exe','');
QuarantineFile('C:\Users\Admin\AppData\Local\35453035-1427296230-4333-4439-4238FFFFFFFF\insw4D57.tmp','');
DeleteService('hekizyzo');
DeleteService('BitGuard');
QuarantineFile('C:\Windows\system32\drivers\{cc30460f-753f-44d9-b58c-13dae1321968}w64.sys','');
QuarantineFile('C:\Windows\system32\drivers\{0ca29851-3273-497e-b859-b648c9a6fe3a}w64.sys','');
QuarantineFile('C:\Windows\system32\Drivers\webTinstMKTN.sys','');
QuarantineFile('C:\Windows\system32\drivers\qrnfd_1_10_0_9.sys','');
TerminateProcessByName('C:\Users\Admin\AppData\Roaming\svchost.exe');
QuarantineFile('C:\Users\Admin\AppData\Roaming\svchost.exe','');
DeleteFile('C:\Users\Admin\AppData\Roaming\svchost.exe','32');
DeleteFile('C:\Windows\system32\drivers\qrnfd_1_10_0_9.sys','32');
DeleteFile('C:\Windows\system32\Drivers\webTinstMKTN.sys','32');
DeleteFile('C:\Windows\system32\drivers\{0ca29851-3273-497e-b859-b648c9a6fe3a}w64.sys','32');
DeleteFile('C:\Windows\system32\drivers\{cc30460f-753f-44d9-b58c-13dae1321968}w64.sys','32');
DeleteFile('C:\Users\Admin\AppData\Local\35453035-1427296230-4333-4439-4238FFFFFFFF\insw4D57.tmp','32');
DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe','32');
DeleteFile('C:\ProgramData\2ce8e63b-5e53-4efc-b4cf-6a6e52e017a4\maintainer.exe','32');
DeleteFile('C:\Program Files (x86)\QuickRef_1.10.0.9\Service\qrsvc.exe','32');
DeleteFile('C:\Users\Admin\AppData\Local\35453035-1427223637-4333-4439-4238FFFFFFFF\snswAE94.tmp','32');
DeleteFile('C:\Program Files (x86)\VuuPC\remoteengine.exe','32');
DeleteFile('C:\Users\Admin\AppData\Local\35453035-1427223620-4333-4439-4238FFFFFFFF\cnsr7E05.tmp','32');
DeleteFile('C:\Program Files (x86)\IGS\VCL.exe','32');
DeleteFile('C:\Program Files (x86)\VuuPC\Connectivity.exe','32');
DeleteFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys','32');
DeleteFile('C:\Windows\system32\DRIVERS\iSafeKrnlBoot.sys','32');
DeleteFile('C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys','32');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe','32');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtectTray.exe','32');
DeleteFile('C:\Program Files (x86)\Ask.com\Updater\Updater.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AnyProtect Tray','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AnyProtect','command');
DeleteFile('C:\Program Files (x86)\Mobogenie\DaemonProcess.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TorrentExpress','command');
DeleteFile('C:\Users\Admin\AppData\Local\ConvertAd\ConvertAd.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ConvertAd','command');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MediaGet2','command');
DeleteFile('C:\Users\Admin\AppData\Local\Temp\UsageTemp.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\UsageTemp','command');
DeleteFile('C:\Users\Admin\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.19.2\dsrlte.exe','32');
RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Yahoo! Search','command');
DeleteFile('C:\Users\Admin\AppData\Roaming\Browsers\exe.emorhc.bat','32');
DeleteFile('C:\Users\Admin\AppData\Roaming\Browsers\exe.erolpxei.bat','32');
DeleteFile('C:\Users\Admin\AppData\Roaming\Browsers\exe.resworb.bat','32');
DeleteFile('c:\progra~3\bitguard\271832~1.68\{c16c1~1\bitguard.dll','32');
DeleteFile('C:\Program Files (x86)\Torrent Search\IEEF\_CeujFRG4X.dll','32');
DeleteFile('C:\Program Files (x86)\ver7BlockAndSurf\J4BlockAndSurfJ52.exe','32');
DeleteFile('C:\Users\Admin\AppData\Local\delta\delta\1.3.25.0\bdraw.exe','32');
DeleteFile('C:\Users\Admin\AppData\Local\delta\delta\1.3.25.0\bdsetup.exe','32');
DeleteFile('C:\Windows\system32\Tasks\BlockAndSurf Update','64');
DeleteFile('C:\Windows\system32\Tasks\bdraw Updater','64');
DeleteFile('C:\Windows\system32\Tasks\bdraw','64');
DeleteFile('C:\Windows\Tasks\BlockAndSurf Update.job','64');
DeleteFile('C:\Program Files (x86)\Microsoft Data\install_addons.exe','32');
DeleteFile('C:\Windows\system32\Tasks\chrome5','64');
DeleteFile('C:\Windows\system32\Tasks\chrome5_logon','64');
DeleteFile('C:\Windows\system32\Tasks\dlclient','64');
DeleteFile('C:\Windows\system32\Tasks\dlclient Updater','64');
DeleteFile('C:\Windows\system32\Tasks\EPUpdater','64');
DeleteFile('C:\Users\Admin\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe','32');
DeleteFile('C:\Windows\system32\Tasks\nethost task','64');
DeleteFile('C:\Users\Admin\AppData\Local\SystemDir\nethost.exe','32');
DeleteFile('C:\Windows\system32\Tasks\SmartWeb Upgrade Trigger Task','64');
DeleteFile('C:\Windows\system32\Tasks\Scheduled Update for Ask Toolbar','64');
DeleteFile('C:\Users\Admin\AppData\Local\SmartWeb\SmartWebHelper.exe','32');
DeleteFile('C:\Program Files (x86)\VuuPC\VuuPCUpdater.exe','32');
DeleteFile('C:\Windows\system32\Tasks\VuuPCUpdate','64');
DeleteFile('C:\Windows\system32\Tasks\VuuPCUpdateLogin','64');
DeleteFile('C:\Users\Admin\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.19.2\dsrsetup.exe','32');
DeleteFile('C:\Windows\system32\Tasks\Yahoo! Search Updater','64');
DeleteFile('C:\Windows\system32\Tasks\Yahoo! Search','64');
DeleteFile('C:\Users\Admin\appdata\local\microsoft\start menu\вoйти в интeрнeт.exe','32');
DeleteFile('C:\Users\Admin\appdata\roaming\searchindexer\moduleinno.exe','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Компьютер перезагрузится.

 

Выполните скрипт в AVZ

 

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

c:\quarantine.zip отправьте по адресу newvirus@kaspersky.com

Полученный ответ сообщите здесь (с указанием номера KLAN)

 

Скачайте ClearLNK и сохраните архив с утилитой на Рабочем столе.

• Распакуйте архив с утилитой в отдельную папку.
  
• Перенесите Check_Browsers_LNK.log на ClearLNK как показано на рисунке
   
  
   
  
• Отчет о работе ClearLNK-<Дата>.log будет сохранен в папке LOG.
  
• Прикрепите этот отчет к своему следующему сообщению.
  

 

 

Сделайте новые логи по правилам