Самовосстанавливающийся вирус, не заходит в интерт.

[typhuscrafty]

Добрый день! 

Поймал вирус, который самовосстанавливается примерно раз месяц. Не пускает в интернет мессенджеры, магазины игр и другие приложения. В интернет могу зайти только с Гугл хром. UVS показывает странные записи в реестре. Не знаю, как это поправить без последствий. Прикладываю логи, образ автозапуска и скринщоты из UVS.

CollectionLog-2025.08.05-21.48.zip CALVIN_2025-08-05_21-36-23_v5.0.RC1.v x64.7z

[safety]

По очистке системы:

 

Выполните скрипт очистки в uVS

Выполните в uVS скрипт из буфера обмена.

ЗАпускаем start,exe от имени Администратора (если не запущен)

текущий пользователь,

Копируем скрипт ниже из браузера в буфер обмена. Закрываем браузер.

В главном меню uVS выбираем: "Скрипт - выполнить скрипт из буфера обмена"

Скрипт автоматически очистит систему и завершит работу с перезагрузкой системы.

;uVS v5.0v x64 [http://dsrt.dyndns.org:8888]
;Target OS: NTv11.0
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------

delref 127.0.0.1:10801
delall %SystemRoot%\SYSWOW64\MACROMED\FLASH\FLASH32_32_0_0_465.OCX
delall %Sys32%\MACROMED\FLASH\FLASH64_32_0_0_465.OCX
delall %SystemRoot%\SYSWOW64\MACROMED\FLASH\NPSWF32_32_0_0_465.DLL
delall %Sys32%\MACROMED\FLASH\NPSWF64_32_0_0_465.DLL
delref HTTPS://CLIENTS2.GOOGLE.COM/CR/REPORT
apply

deltmp
delref {E984D939-0E00-4DD9-AC3A-7ACA04745521}\[CLSID]
delref {8702A841-D5CA-47C3-812D-9CEDC304C200}\[CLSID]
delref %SystemDrive%\USERS\KDFX MODES\APPDATA\LOCAL\MICROSOFT\ONEDRIVE\ONEDRIVESTANDALONEUPDATER.EXE
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {8AD9C840-044E-11D1-B3E9-00805F499D93}\[CLSID]
delref {CA8A9780-280D-11CF-A24D-444553540000}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref %Sys32%\SHELLEXT\HASHCHECK.DLL
delref %SystemDrive%\PROGRAM FILES\7-ZIP\7-ZIP.DLL
delref %SystemDrive%\PROGRAM FILES\7-ZIP\7-ZIP32.DLL
delref {BBACC218-34EA-4666-9D7A-C78F2274A524}\[CLSID]
delref {5AB7172C-9C11-405C-8DD5-AF20F3606282}\[CLSID]
delref {A78ED123-AB77-406B-9962-2A5D9D2F7F30}\[CLSID]
delref {F241C880-6982-4CE5-8CF7-7085BA96DA5A}\[CLSID]
delref {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\[CLSID]
delref {9AA2F32D-362A-42D9-9328-24A483E2CCC3}\[CLSID]
delref {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\[CLSID]
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\VECTOR FORMATS\SKP THUMBNAIL PROVIDER\%PROCESSOR_ARCHITECTURE%\SKPTHUMBNAILPROVIDER.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\VECTOR FORMATS\XMP-BASED THUMBNAIL PROVIDER\%PROCESSOR_ARCHITECTURE%\XMPTHUMBNAILPROVIDERPDF.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\FUJI\%PROCESSOR_ARCHITECTURE%\FUJICODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\LIGHTROOM LRPREV\%PROCESSOR_ARCHITECTURE%\LRPREVCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\SAMSUNG\%PROCESSOR_ARCHITECTURE%\SAMSUNGCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\RADIANCE HDR\%PROCESSOR_ARCHITECTURE%\HDRCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\PORTABLE PIXMAP\%PROCESSOR_ARCHITECTURE%\PPMCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\ILM OPENEXR\%PROCESSOR_ARCHITECTURE%\EXRCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\HASSELBLAD\%PROCESSOR_ARCHITECTURE%\HASSELBLADCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\ADOBE\%PROCESSOR_ARCHITECTURE%\ADOBECODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\TRUEVISION TARGA\%PROCESSOR_ARCHITECTURE%\TGACODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\JPEG\%PROCESSOR_ARCHITECTURE%\JPGROTATOR.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\VECTOR FORMATS\PLD THUMBNAIL PROVIDER\%PROCESSOR_ARCHITECTURE%\PLDTHUMBNAILPROVIDER.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\CANON\%PROCESSOR_ARCHITECTURE%\CANONCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\EPSON\%PROCESSOR_ARCHITECTURE%\EPSONCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\PANASONIC\%PROCESSOR_ARCHITECTURE%\PANASONICCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\VECTOR FORMATS\XMP-BASED THUMBNAIL PROVIDER\%PROCESSOR_ARCHITECTURE%\XMPTHUMBNAILPROVIDER.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\NIKON\%PROCESSOR_ARCHITECTURE%\NIKONCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\LEICA\%PROCESSOR_ARCHITECTURE%\LEICACODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\SONY\%PROCESSOR_ARCHITECTURE%\SONYCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\JPEG\%PROCESSOR_ARCHITECTURE%\JPGDERIVATIVE.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\MAMIYA\%PROCESSOR_ARCHITECTURE%\MAMIYACODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\MAYA IFF\%PROCESSOR_ARCHITECTURE%\MAYACODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\MINOLTA\%PROCESSOR_ARCHITECTURE%\MINOLTACODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\SPECIAL CODECS\RAWZOR PREVIEWER\%PROCESSOR_ARCHITECTURE%\RAWZORCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\PENTAX\%PROCESSOR_ARCHITECTURE%\PENTAXCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\SINAR\%PROCESSOR_ARCHITECTURE%\SINARCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\KODAK\%PROCESSOR_ARCHITECTURE%\KODAKCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\DIRECTX DDS\%PROCESSOR_ARCHITECTURE%\DDSCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\SOFTIMAGE PIC\%PROCESSOR_ARCHITECTURE%\SOFTIMAGECODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\PHOTOSHOP PSD\%PROCESSOR_ARCHITECTURE%\PSDCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\JPEG 2000\%PROCESSOR_ARCHITECTURE%\J2KCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\OLYMPUS\%PROCESSOR_ARCHITECTURE%\OLYMPUSCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RAW FORMATS\SIGMA\%PROCESSOR_ARCHITECTURE%\SIGMACODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\VALVE TEXTURE FORMAT\%PROCESSOR_ARCHITECTURE%\VTFCODEC.DLL
delref %SystemRoot%\WICCODECS\{A6D092A4-081A-4F0E-9356-DA167E87D922}\RASTER FORMATS\SILICON GRAPHICS RGB\%PROCESSOR_ARCHITECTURE%\SILICONGRAPHICSCODEC.DLL
delref %Sys32%\DRIVERS\EAANTICHEAT.SYS
delref E:\INSTALL\FORTICLIENT VPN\SCHEDULER.EXE
delref %Sys32%\DRIVERS\VDI1MJK2.SYS
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\120.0.6099.217\RESOURCES\WEB_STORE\ИНТЕРНЕТ-МАГАЗИН CHROME
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\138.0.7204.49\RESOURCES\NETWORK_SPEECH_SYNTHESIS/MV3\GOOGLE NETWORK SPEECH
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\120.0.6099.217\RESOURCES\PDF\CHROME PDF VIEWER
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\120.0.6099.217\RESOURCES\NETWORK_SPEECH_SYNTHESIS\GOOGLE NETWORK SPEECH
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\136.0.7103.92\RESOURCES\HANGOUT_SERVICES\GOOGLE HANGOUTS
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.124\RESOURCES\WEB_STORE\ИНТЕРНЕТ-МАГАЗИН CHROME
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.124\RESOURCES\PDF\CHROME PDF VIEWER
delref %SystemDrive%\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\123.0.6312.124\RESOURCES\NETWORK_SPEECH_SYNTHESIS\GOOGLE NETWORK SPEECH
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\WEB_STORE\ИНТЕРНЕТ-МАГАЗИН
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\EDGE_CLIPBOARD\MICROSOFT CLIPBOARD EXTENSION
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\MEDIA_INTERNALS_SERVICES\MEDIA INTERNALS SERVICES EXTENSION
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\MICROSOFT_WEB_STORE\MICROSOFT STORE
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\EDGE_FEEDBACK\EDGE FEEDBACK
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\MICROSOFT_VOICES\MICROSOFT VOICES
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\EDGE_PDF\MICROSOFT EDGE PDF VIEWER
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\120.0.2210.91\RESOURCES\WEBRTC_INTERNALS\WEBRTC INTERNALS EXTENSION
delref %SystemDrive%\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\137.0.3296.52\RESOURCES\HANGOUT_SERVICES\WEBRTC EXTENSION
;-------------------------------------------------------------

restart

После перезагрузки системы:

Добавьте файл дата_времяlog.txt из папки откуда запускали uVS

+

добавьте новые логи FRST для контроля