Вирус не дает установить программы и спамят рекламы

[wexsila]

Вирус не дает установить программы и спамят рекламы выходит баннер не дает установит ни один антивир

CollectionLog-2017.08.04-14.31.zip

Изменено 4 августа, 2017 пользователем wexsila

[thyrex]

Выполните скрипт в AVZ

begin
ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
 then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
QuarantineFile('C:\WINDOWS\microsoft\svchost.exe.exe','');
 QuarantineFile('C:\WINDOWS\microsoft\svchost.exe','');
 QuarantineFile('C:\Users\1\AppData\Local\wupdate\wupdate.exe','');
 QuarantineFile('C:\Program Files (x86)\Secure Driver Updater\SDU.exe','');
 QuarantineFile('C:\Program Files\OcDecryptow\OcDecryptow.dll','');
 QuarantineFile('C:\Users\1\AppData\Roaming\Microsoft\msi.exe','');
 QuarantineFile('C:\Users\1\AppData\Local\indexer\indexer.exe','');
 QuarantineFile('C:\Program Files (x86)\YubeAlckU\khCII5K.dll','');
 DelBHO('{E3605470-291B-44EB-8648-745EE356599A}');
 QuarantineFile('C:\Program Files (x86)\YubeAlckIE\krzDx5uq.dll','');
 QuarantineFile('C:\Users\1\AppData\Roaming\gplyra\gplyra\start.cmd','');
 QuarantineFile('C:\Users\1\AppData\Local\yc\Application\yc.exe','');
 QuarantineFile('C:\Users\1\AppData\Roaming\setupsk\ml.py','');
 QuarantineFile('C:\Users\1\AppData\Roaming\setupsk\python\pythonw.exe','');
 QuarantineFile('C:\Users\1\AppData\Roaming\SETUPS~1\ml.py','');
 SetServiceStart('015b6612f929207040848e82404bce97', 4);
 DeleteService('015b6612f929207040848e82404bce97');
 SetServiceStart('UbarPolicyProvider', 4);
 DeleteService('UbarPolicyProvider');
 DeleteService('ab20b32356144c981855f97d5430649c');
 DeleteService('icacl');
 DeleteService('SvcHost Service Host');
 QuarantineFile('C:\Windows\Microsoft\svchost.exe','');
 QuarantineFile('C:\WINDOWS\system32\icacl.exe','');
 QuarantineFile('C:\WINDOWS\system32\drivers\015b6612f929207040848e82404bce97.sys','');
 QuarantineFile('C:\Users\1\AppData\Roaming\Event Monitor\isxdl.dll','');
 TerminateProcessByName('C:\Users\1\AppData\Roaming\8246f023f5b045e3a26715ff4cd194ee\U8uCCTIE7a.exe');
 TerminateProcessByName('C:\Program Files\UBar\ubar.exe');
 TerminateProcessByName('C:\Program Files\UBar\UbarService.exe');
 TerminateProcessByName('c:\users\1\appdata\local\temp\v5w61mtnptsi.exe');
 TerminateProcessByName('C:\Users\1\AppData\Roaming\13fd3ff19a04432fb3b8413f397181ad\Y2WhQlVxlb.exe');
 QuarantineFile('C:\Users\1\AppData\Roaming\13fd3ff19a04432fb3b8413f397181ad\Y2WhQlVxlb.exe','');
 QuarantineFile('c:\users\1\appdata\local\temp\v5w61mtnptsi.exe','');
 QuarantineFile('C:\Program Files\UBar\UbarService.exe','');
 QuarantineFile('C:\Program Files\UBar\ubar.exe','');
 QuarantineFile('C:\Users\1\AppData\Roaming\8246f023f5b045e3a26715ff4cd194ee\U8uCCTIE7a.exe','');
 TerminateProcessByName('c:\program files (x86)\smart application controller\smappscontroller.exe');
 TerminateProcessByName('c:\users\1\appdata\roaming\event monitor\em.exe');
 TerminateProcessByName('C:\ProgramData\5e8938e755f141539a64b662ab54bd35\f7rdASgcABa.exe');
 TerminateProcessByName('c:\users\1\appdata\roaming\mediaplayerapplication\mediaplayerapplication.exe');
 QuarantineFile('c:\users\1\appdata\roaming\mediaplayerapplication\mediaplayerapplication.exe','');
 QuarantineFile('C:\ProgramData\5e8938e755f141539a64b662ab54bd35\f7rdASgcABa.exe','');
 QuarantineFile('c:\users\1\appdata\roaming\event monitor\em.exe','');
 TerminateProcessByName('C:\ProgramData\4af34453659a469287e4d40b0dc49601\5Lkb7YqZD0Ua.exe');
 TerminateProcessByName('C:\Users\1\AppData\Local\Temp\543602f971a0484db6009610de642acf\9JEn8CFbSje.exe');
 TerminateProcessByName('C:\ProgramData\f81b323c3a44493ab324723adaca4a20\Ac028RpdipCUq.exe');
 QuarantineFile('C:\ProgramData\f81b323c3a44493ab324723adaca4a20\Ac028RpdipCUq.exe','');
 QuarantineFile('C:\Users\1\AppData\Local\Temp\543602f971a0484db6009610de642acf\9JEn8CFbSje.exe','');
 QuarantineFile('C:\ProgramData\4af34453659a469287e4d40b0dc49601\5Lkb7YqZD0Ua.exe','');
 DeleteFile('C:\ProgramData\4af34453659a469287e4d40b0dc49601\5Lkb7YqZD0Ua.exe','32');
 DeleteFile('C:\Users\1\AppData\Local\Temp\543602f971a0484db6009610de642acf\9JEn8CFbSje.exe','32');
 DeleteFile('C:\ProgramData\f81b323c3a44493ab324723adaca4a20\Ac028RpdipCUq.exe','32');
 DeleteFile('c:\users\1\appdata\roaming\event monitor\em.exe','32');
 DeleteFile('C:\ProgramData\5e8938e755f141539a64b662ab54bd35\f7rdASgcABa.exe','32');
 DeleteFile('c:\users\1\appdata\roaming\mediaplayerapplication\mediaplayerapplication.exe','32');
 DeleteFile('c:\program files (x86)\smart application controller\smappscontroller.exe','32');
 DeleteFile('C:\Users\1\AppData\Roaming\8246f023f5b045e3a26715ff4cd194ee\U8uCCTIE7a.exe','32');
 DeleteFile('C:\Program Files\UBar\ubar.exe','32');
 DeleteFile('C:\Program Files\UBar\UbarService.exe','32');
 DeleteFile('c:\users\1\appdata\local\temp\v5w61mtnptsi.exe','32');
 DeleteFile('C:\Users\1\AppData\Roaming\13fd3ff19a04432fb3b8413f397181ad\Y2WhQlVxlb.exe','32');
 DeleteFile('C:\WINDOWS\system32\drivers\015b6612f929207040848e82404bce97.sys','32');
 DeleteFile('C:\WINDOWS\system32\icacl.exe','32');
 DeleteFile('C:\Windows\Microsoft\svchost.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MediaPlayerApplication');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','f7rdASgcABa.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Y2WhQlVxlb.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Ac028RpdipCUq.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','U8uCCTIE7a.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','setupsk_upd');
 DeleteFile('C:\Users\1\AppData\Roaming\SETUPS~1\ml.py','32');
 DeleteFile('C:\Users\1\AppData\Roaming\setupsk\python\pythonw.exe','32');
 DeleteFile('C:\Users\1\AppData\Roaming\setupsk\ml.py','32');
 DeleteFile('C:\Users\1\AppData\Local\yc\Application\yc.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','uoqqewmaoa');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','ycAutoLaunch_1CC43526C9D533E0CD117B25D98AA3A6');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','setupsk');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','5Lkb7YqZD0Ua.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','9JEn8CFbSje.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\RunOnce','WqqSHk7.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\RunOnce','JNvrNblGALtfo.exe');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\RunOnce','vbqyerevlq');
 DeleteFile('C:\Users\1\AppData\Roaming\gplyra\gplyra\start.cmd','32');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','gplyra');
 DeleteFile('C:\Program Files (x86)\YubeAlckIE\krzDx5uq.dll','32');
 DeleteFile('C:\Program Files (x86)\YubeAlckU\khCII5K.dll','32');
 DeleteFile('C:\WINDOWS\Tasks\E3605470-291B-44EB-8648-745EE356599A.job','32');
 DeleteFile('C:\WINDOWS\Tasks\Online Application V2G1.job','32');
 DeleteFile('C:\WINDOWS\Tasks\Online Application V2G2.job','32');
 DeleteFile('C:\WINDOWS\Tasks\Online Application V2G3.job','32');
 DeleteFile('C:\WINDOWS\Tasks\Updater_Online_Application.job','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\ab20b32356144c981855f97d5430649c','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\CheckControllerUpdatesUA','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\E3605470-291B-44EB-8648-745EE356599A','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\E3605470-291B-44EB-8648-745EE356599A2','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\indexer','64');
 DeleteFile('C:\Users\1\AppData\Local\indexer\indexer.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\MSI','64');
 DeleteFile('C:\Users\1\AppData\Roaming\Microsoft\msi.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\Online Application V2G1','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\Online Application V2G2','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\Online Application V2G3','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\RunAtStartup','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\setupsk','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\setupsk_upd','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\Updater_Online_Application','64');
 DeleteFile('C:\WINDOWS\system32\Tasks\wupdate','64');
 DeleteFile('C:\Users\1\AppData\Local\wupdate\wupdate.exe','32');
 DeleteFile('C:\WINDOWS\microsoft\svchost.exe','32');
 DeleteFile('C:\WINDOWS\microsoft\svchost.exe.exe','32');
 DeleteFile('C:\Users\1\appdata\roaming\event monitor\isxdl.dll','32');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(false);
end.

Будет выполнена перезагрузка компьютера.

 

Выполните скрипт в AVZ

begin
CreateQurantineArchive('c:\quarantine.zip');
end.

c:\quarantine.zip отправьте по адресу newvirus@kaspersky.com

Полученный ответ сообщите здесь (с указанием номера KLAN)

 

Пожалуйста, выполните ЕЩЕ РАЗ правила, прикрепите к сообщению НОВЫЕ логи Autologger