Здравствуйте!
Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО (http://safezone.cc/threads/18577/).
Выполните скрипт в АВЗ (http://safezone.cc/threads/10/) (Файл - Выполнить скрипт):
{Перед использованием скрипта убедиться, что в системе не установлены упомянутые в скрипте антивирусы. Автор скрипта: regist}
var
ProgramData, ProgramFiles, ProgramFiles86, fname, OSVer: string;
PD_folders, PF_folders, O_folders : TStringList;
procedure FillList;
begin
PD_folders := TStringList.Create;
PD_folders.Add('360TotalSecurity');
PD_folders.Add('360safe');
PD_folders.Add('AVAST Software');
PD_folders.Add('Avg');
PD_folders.Add('Avira');
PD_folders.Add('ESET');
PD_folders.Add('Indus');
PD_folders.Add('Kaspersky Lab Setup Files');
PD_folders.Add('Kaspersky Lab');
PD_folders.Add('MB3Install');
PD_folders.Add('Malwarebytes');
PD_folders.Add('McAfee');
PD_folders.Add('Norton');
PD_folders.Add('grizzly');
PD_folders.Add('RealtekHD');
PD_folders.Add('RunDLL');
PD_folders.Add('Setup');
PD_folders.Add('System32');
PD_folders.Add('Windows');
PD_folders.Add('WindowsTask');
PD_folders.Add('install');
PD_folders.Add('bebca3bc90');
PF_folders := TStringList.Create;
PF_folders.Add('360');
PF_folders.Add('AVAST Software');
PF_folders.Add('AVG');
PF_folders.Add('ByteFence');
PF_folders.Add('COMODO');
PF_folders.Add('Cezurity');
PF_folders.Add('Common Files\McAfee');
PF_folders.Add('ESET');
PF_folders.Add('Enigma Software Group');
PF_folders.Add('GRIZZLY Antivirus');
PF_folders.Add('Kaspersky Lab');
PF_folders.Add('Malwarebytes');
PF_folders.Add('Microsoft JDX');
PF_folders.Add('Panda Security');
PF_folders.Add('SpyHunter');
PF_folders.Add('RDP Wrapper');
O_folders := TStringList.Create;
O_folders.Add(NormalDir('%SYSTEMDRIVE%'+'\AdwCleaner'));
O_folders.Add(NormalDir('%SYSTEMDRIVE%'+'\KVRT_Data'));
O_folders.Add(NormalDir('%windir%'+'\NetworkDistribution'));
O_folders.Add(NormalDir('%windir%'+'\speechstracing'));
O_folders.Add(NormalDir('%windir%'+'\Fonts\Mysql'));
end;
procedure Del_folders(path:string; AFL : TStringList);
var
i : integer;
begin
for i := 0 to AFL.Count - 1 do
begin
fname := NormalDir(path + AFL[i]);
if DirectoryExists(fname) then
begin
QuarantineFileF(fname, '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0, 0);
DeleteFileMask(fname, '*', true);
DeleteDirectory(fname);
end;
end;
end;
procedure swprv;
begin
ExecuteFile('sc.exe', 'create "swprv" binpath= "%SystemRoot%\System32\svchost.exe -k swprv" type= own start= demand depend= RPCSS', 0, 15000, true);
RegKeyParamDel ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'wow64');
RegKeyStrParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'Description', '@%SystemRoot%\System32\swprv.dll,-102');
RegKeyStrParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'DisplayName', '@%SystemRoot%\System32\swprv.dll,-103');
RegKeyIntParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv', 'ServiceSidType', '1');
RegKeyParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%Systemroot%\System32\swprv.dll');
OSVer := RegKeyStrParamRead('HKLM','SOFTWARE\Microsoft\Windows NT\CurrentVersion','CurrentVersion');
if OSVer > '6.1' then RegKeyIntParamWrite ('HKLM', 'SYSTEM\CurrentControlSet\Services\swprv\Parameters', 'ServiceDllUnloadOnStop', '1');;
ExecuteFile('sc.exe', 'privs "swprv" SeBackupPrivilege/SeChangeNotifyPrivilege/SeCreateGlobalPrivilege/SeCreatePermanentPrivilege/SeImpersonatePrivilege/SeManageVolumePrivilege/SeRestorePrivilege/SeIncreaseBasePriorityPrivilege/SeManageVolumePrivilege/SeRestorePrivilege/SeTcbPrivilege', 0, 15000, true);
ExecuteFile('net.exe', 'start "swprv"', 0, 15000, true);
end;
procedure AV_block_remove;
begin
clearlog;
FillList;
ProgramData := GetEnvironmentVariable('ProgramData');
ProgramFiles := NormalDir('%PF%');
ProgramFiles86 := NormalDir('%PF% (x86)');
Del_folders(ProgramData +'\', PD_folders);
Del_folders(ProgramFiles, PF_folders);
Del_folders(ProgramFiles86, PF_folders);
Del_folders('', O_folders);
if FileExists (ProgramData + 'RDPWinst.exe') then DeleteFile(ProgramData + 'RDPWinst.exe');
ExpRegKey('HKCU','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun','Disallow Run_backup.reg');
RegKeyDel('HKCU','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun');
RegKeyParamDel('HKCU','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer','DisallowRun');
RegKeyParamWrite('HKLM', 'SYSTEM\CurrentControlSet\services\TermService\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%SystemRoot%\System32\termsrv.dll');
swprv;
if MessageDLG('Удалить пользователя "John" ?'+ #13#10 + 'Если пользователь с таким именем вам не знаком, то нажмите "Да".', mtConfirmation, mbYes+mbNo, 0) = 6 then
ExecuteFile('net.exe', 'user john /delete', 0, 15000, true);
SaveLog(GetAVZDirectory +'AV_block_remove.log');
PD_folders.Free;
PF_folders.Free;
O_folders.Free;
ExecuteWizard('SCU', 2, 3, true);
ExecuteSysClean;
end;
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
ClearQuarantineEx(true);
TerminateProcessByName('c:\programdata\bebca3bc90\tdun.exe');
TerminateProcessByName('C:\ProgramData\RealtekHD\taskhostw.exe');
TerminateProcessByName('c:\programdata\rundll\rundll.exe');
TerminateProcessByName('c:\programdata\rundll\system.exe');
TerminateProcessByName('c:\programdata\windows\rutserv.exe');
TerminateProcessByName('c:\programdata\windowstask\audiodg.exe');
StopService('mhyprot2');
StopService('RManService');
AV_block_remove;
QuarantineFile('C:\Program Files\rdp wrapper\rdpwrap.dll', '');
QuarantineFile('c:\programdata\bebca3bc90\tdun.exe', '');
QuarantineFile('C:\ProgramData\RealtekHD\taskhostw.exe', '');
QuarantineFile('c:\programdata\rundll\rundll.exe', '');
QuarantineFile('c:\programdata\rundll\system.exe', '');
QuarantineFile('c:\programdata\windows\rutserv.exe', '');
QuarantineFile('c:\programdata\windowstask\audiodg.exe', '');
QuarantineFile('C:\ProgramData\WindowsTask\MicrosoftHost.exe', '');
QuarantineFile('C:\Programdata\WindowsTask\winlogon.exe', '');
QuarantineFile('C:\Users\Old\AppData\Local\Temp\mhyprot2.sys', '');
QuarantineFile('C:\Users\Old\AppData\Local\Temp\svchost.exe', '');
QuarantineFileF('c:\programdata\rundll', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\programdata\windows', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0 , 0);
QuarantineFileF('c:\programdata\windowstask', '*.exe, *.dll, *.sys, *.bat, *.vbs, *.ps1, *.js*, *.tmp*', true, '', 0 , 0);
DeleteFile('C:\Program Files\rdp wrapper\rdpwrap.dll');
DeleteFile('c:\programdata\bebca3bc90\tdun.exe');
DeleteFile('C:\ProgramData\RealtekHD\taskhostw.exe', '');
DeleteFile('C:\ProgramData\RealtekHD\taskhostw.exe', '64');
DeleteFile('c:\programdata\rundll\rundll.exe', '');
DeleteFile('c:\programdata\rundll\system.exe', '');
DeleteFile('c:\programdata\rundll\system.exe', '64');
DeleteFile('c:\programdata\windows\rutserv.exe', '');
DeleteFile('C:\ProgramData\Windows\rutserv.exe', '64');
DeleteFile('c:\programdata\windowstask\audiodg.exe', '');
DeleteFile('c:\programdata\windowstask\audiodg.exe', '64');
DeleteFile('C:\ProgramData\WindowsTask\MicrosoftHost.exe', '64');
DeleteFile('C:\Programdata\WindowsTask\winlogon.exe', '64');
DeleteFile('C:\Users\Old\AppData\Local\Temp\mhyprot2.sys', '64');
DeleteFile('C:\Users\Old\AppData\Local\Temp\svchost.exe', '');
DeleteService('mhyprot2');
DeleteService('RManService');
DeleteFileMask('c:\programdata\rundll', '*', true);
DeleteFileMask('c:\programdata\windows', '*', true);
DeleteFileMask('c:\programdata\windowstask', '*', true);
DeleteDirectory('c:\programdata\rundll');
DeleteDirectory('c:\programdata\windows');
DeleteDirectory('c:\programdata\windowstask');
DeleteSchedulerTask('Microsoft\Windows\Wininet\Cleaner');
DeleteSchedulerTask('Microsoft\Windows\Wininet\Taskhost');
DeleteSchedulerTask('Microsoft\Windows\Wininet\Taskhostw');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Old', '32');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Old', '64');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'Realtek HD Audio', '64');
RegKeyParamWrite('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\services\TermService\Parameters', 'ServiceDll', 'REG_EXPAND_SZ', '%SystemRoot%\System32\termsrv.dll');
ExecuteSysClean;
ExecuteRepair(13);
ExecuteWizard('SCU', 2, 3, true);
RebootWindows(true);
end.
после выполнения скрипта компьютер перезагрузится.
после перезагрузки выполнить второй скрипт:
begin
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
CreateQurantineArchive(GetAVZDirectory + 'quarantine.zip');
end.
Файл quarantine.zip из папки AVZ отправьте с помощью этой формы (https://dragokas.com/virusnet/) или (если размер архива превышает 10 MB) на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения.
Повторите логи по правилам. Для повторной диагностики запустите снова Autologger.