Лёся Posted January 3, 2009 Report Share Posted January 3, 2009 прошу посмотреть логи. пс сильно не ругать за наличие только двух логов из требуемого.... virusinfo_syscheck.zip virusinfo_syscure.zip virusinfo_syscheck.zip virusinfo_syscure.zip Link to comment Share on other sites More sharing options...
akoK Posted January 3, 2009 Report Share Posted January 3, 2009 (edited) AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить". beginSearchRootkit(true, true);SetAVZGuardStatus(true);QuarantineFile('C:\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ARPPRODUCTICON.exe','');QuarantineFile('C:\Windows\Installer\cb35a.msi','');QuarantineFile('C:\Users\Рамиль\Application Data\ezpinst.exe','');QuarantineFile('C:\Users\Рамиль\AppData\Roaming\ezpinst.exe','');QuarantineFile('C:\Documents and Settings\Рамиль\Application Data\ezpinst.exe','');QuarantineFile('C:\Documents and Settings\Рамиль\AppData\Roaming\ezpinst.exe','');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Users\Рамиль\AppData\Roaming\ezpinst.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\cb35a.msi');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ARPPRODUCTICON.exe');BC_ImportALL;ExecuteRepair(6);BC_Activate;ExecuteSysClean;RebootWindows(true);end. После выполнения скрипта компьютер перезагрузится. beginCreateQurantineArchive(GetAVZDirectory+'quarantine.zip');end. Полученный архив отправьте на newvirus<at>kaspersky.com (at=@) с указанием пароля: virus в теле письма Обновите базы AVZ. Удалите Bonjour Service Edited January 3, 2009 by akoK Link to comment Share on other sites More sharing options...
Лёся Posted January 4, 2009 Author Report Share Posted January 4, 2009 вот повторные логи отключить восстановление системы не удаётся virusinfo_syscheck.zip virusinfo_syscure.zip hijackthis.log virusinfo_syscheck.zip virusinfo_syscure.zip hijackthis.log Link to comment Share on other sites More sharing options...
akoK Posted January 4, 2009 Report Share Posted January 4, 2009 AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить". beginClearQuarantine;SearchRootkit(true, true);SetAVZGuardStatus(true);SetServiceStart('blbdrive', 4);QuarantineFile('C:\Windows\system32\drivers\blbdrive.sys','');QuarantineFile('C:\Documents and Settings\Рамиль\AppData\Roaming\ezpinst.exe','');QuarantineFile('C:\Windows\system32\IoctlSvc.exe','');DeleteFile('C:\Windows\System32\Drivers\afqf3z6p.SYS');DeleteFile('C:\Documents and Settings\Рамиль\AppData\Roaming\ezpinst.exe');DeleteFile('C:\Documents and Settings\Рамиль\Application Data\ezpinst.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Users\Рамиль\AppData\Roaming\ezpinst.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\cb35a.msi');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe');DeleteFile('C:\System Volume Information\SystemRestore\FRStaging\Windows\Installer\{F99F74B4-972B-4B06-B893-6B3B0DB0128B}\ARPPRODUCTICON.exe');DeleteFile('C:\Users\Рамиль\AppData\Roaming\ezpinst.exe');DeleteFile('C:\Users\Рамиль\Application Data\ezpinst.exe');DeleteFile('C:\Windows\system32\drivers\blbdrive.sys');DeleteFile('C:\Windows\system32\DRIVERS\UIUSYS.SYS');DeleteService('UIUSys');DeleteService('blbdrive');BC_ImportALL;BC_Activate;ExecuteSysClean;RebootWindows(true);end. После выполнения скрипта компьютер перезагрузится. beginCreateQurantineArchive(GetAVZDirectory+'quarantine.zip');end. Полученный архив отправьте на akok<at>pisem.net с указанной ссылкой на тему. (at=@) Link to comment Share on other sites More sharing options...
Лёся Posted January 4, 2009 Author Report Share Posted January 4, 2009 скрипт выполнила вот логи rsit info.txt log.txt info.txt log.txt Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now