Вирусы съели меня [LOG+]

[pivo2005]

Невозможно удалить Malware doctor? а даже после удаления появилсчя снова

Касперский не запускаеться вообще

хелп

virusinfo_syscheck.zip

virusinfo_syscure.zip

hijackthis.log

[thyrex]

Нужно выбрать один из 2-[ антивирусов (Avast или DrWeb)

 

Выполните скрипт в AVZ

 begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\SSVICHOSST.exe','');
DelBHO('{07B18EA9-A523-4961-B6BB-170DE4475CCA}');
DelBHO('{00a6faf1-072e-44cf-8957-5838f569a31d}');
DelBHO('{07b18ea1-a523-4961-b6bb-170de4475cca}');
QuarantineFile('C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL','');
QuarantineFile('C:\Program Files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL','');
QuarantineFile('digiwet.dll','');
QuarantineFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\M3PLUGIN.DLL','');
QuarantineFile('0.exe','');
QuarantineFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\mwssvc.exe','');
DeleteService('mywebsearchservice');
QuarantineFile('C:\WINDOWS\System32\Drivers\ar3pi6u9.SYS','');
QuarantineFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\m3SrchMn.exe','');
QuarantineFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\f3reghk.dll','');
QuarantineFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\f3hkstub.dll','');
TerminateProcessByName('c:\windows\system32\servises.exe');
QuarantineFile('c:\windows\system32\servises.exe','');
QuarantineFile('c:\progra~1\mywebsearch\bar\3.bin\m3srchmn.exe','');
TerminateProcessByName('c:\progra~1\mywebsearch\bar\3.bin\m3srchmn.exe');
DeleteFile('c:\progra~1\mywebsearch\bar\3.bin\m3srchmn.exe');
QuarantineFile('C:\WINDOWS\system32\accwizm.exe','');
DeleteFile('C:\WINDOWS\system32\accwizm.exe'); 
DeleteFile('c:\windows\system32\servises.exe');
DeleteFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\f3hkstub.dll');
DeleteFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\f3reghk.dll');
DeleteFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\m3SrchMn.exe');
DeleteFile('C:\WINDOWS\System32\Drivers\ar3pi6u9.SYS');
DeleteFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\mwssvc.exe');
DeleteFile('0.exe');
DeleteFile('C:\PROGRA~1\MyWebSearch\bar\3.bin\M3PLUGIN.DLL');
DeleteFile('digiwet.dll');
DeleteFile('C:\Program Files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL');
DeleteFile('C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL');
DeleteFile('C:\WINDOWS\system32\SSVICHOSST.exe');
DeleteFile('C:\Windows\Tasks\At1.job');
DeleteFileMask('C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\', '*.*', true);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(6);
ExecuteRepair(8);
ExecuteRepair(9);
ExecuteRepair(11);
ExecuteRepair(17);
RebootWindows(true);
end.

Компьютер перезагрузится.

 

Выполнить скрипт в AVZ.

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

quarantine.zip из папки AVZ отправьте на newvirus@kaspersky.com. В письме укажите пароль на архив virus. Полученный ответ сообщите здесь.

 

Пофиксить в HiJack (возможно, некоторых строк после выполнения скрипта AVZ не найдете)

 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O2 - BHO: MyWebSearch Search Assistant BHO - {00a6faf1-072e-44cf-8957-5838f569a31d} - C:\Program Files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07b18ea1-a523-4961-b6bb-170de4475cca} - C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O2 - BHO: (no name) - {9018F6A8-2495-45DF-9F16-C738F8F3C8FF} - (no file)
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MyWebSearch\bar\3.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [servises] C:\WINDOWS\system32\servises.exe
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MyWebSearch\bar\3.bin\m3SrchMn.exe" /m=2 /w /h
O4 - HKLM\..\Run: [Malware Doctor] C:\Documents and Settings\NetworkService\Application Data\916653139.exe
O4 - HKCU\..\Run: [servises] C:\WINDOWS\system32\servises.exe
O4 - HKCU\..\Run: [Malware Doctor] C:\Documents and Settings\NetworkService\Application Data\916653139.exe
O4 - HKLM\..\Policies\Explorer\Run: [servises] C:\WINDOWS\system32\servises.exe
O4 - HKCU\..\Policies\Explorer\Run: [servises] C:\WINDOWS\system32\servises.exe
O4 - HKUS\S-1-5-21-776561741-1682526488-839522115-1005\..\Run: [servises] C:\WINDOWS\system32\servises.exe (User 'Alex')
O4 - HKUS\S-1-5-21-776561741-1682526488-839522115-1005\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\SSVICHOSST.exe (User 'Alex')
O4 - HKUS\S-1-5-21-776561741-1682526488-839522115-1005\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWebSearch\bar\3.bin\mwsoemon.exe (User 'Alex')
O4 - HKUS\S-1-5-21-776561741-1682526488-839522115-1005\..\Run: [Malware Doctor] C:\Documents and Settings\NetworkService\Application Data\916653139.exe (User 'Alex')
O4 - HKUS\S-1-5-21-776561741-1682526488-839522115-1005\..\Policies\Explorer\Run: [servises] C:\WINDOWS\system32\servises.exe (User 'Alex')

Сделайте новые логи