скептик-оптимист
Сообщения: 5720
Благодарности: 1117
|
Профиль
|
Отправить PM
| Цитировать
• Скрипт AVZ.
Выполните скрипт AVZ. Меню Файл - Выполнить скрипт, вставляем написаный скрипт - кнопка Запустить, после выполнения компьютер перезагрузится.
Код: 
begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
SetServiceStart('byjisogy', 4);
SetServiceStart('nethfdrv', 4);
SetServiceStart('IHProtect Service', 4);
SetServiceStart('BDSGRTP', 4);
SetServiceStart('vicoqudu', 4);
SetServiceStart('NetHttpService', 4);
SetServiceStart('gopibeko', 4);
StopService('byjisogy');
StopService('nethfdrv');
StopService('gopibeko');
StopService('NetHttpService');
StopService('IHProtect Service');
StopService('vicoqudu');
StopService('ServiceUpdater');
QuarantineFile('C:\Program Files\miuitab\protectservice.exe','');
QuarantineFile('C:\Program Files\miuitab\iewatchdog.dll','');
QuarantineFile('C:\Program Files\miuitab\hpnotify.exe','');
QuarantineFile('C:\Program Files\miuitab\cmdshell.exe','');
QuarantineFile('C:\Program Files\miuitab\browerwatchch.dll','');
QuarantineFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','');
QuarantineFile('C:\Documents and Settings\Я!\Local Settings\Application Data\SmartWeb\SmartWebHelper.exe','');
QuarantineFile('C:\Documents and Settings\Я!\Local Settings\Application Data\Mail.Ru\MailRuUpdater.exe','');
QuarantineFile('C:\Documents and Settings\All Users\Application','');
QuarantineFile('C:\DOCUME~1\!12F2~1\LOCALS~1\Temp\463656.exe','');
QuarantineFile('C:\Program Files\MiuiTab\ProtectService.exe','');
QuarantineFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BaiduProtect.exe','');
QuarantineFile('C:\Documents and Settings\Я!\Application Data\364EE69C-1436024293-9CB1-2111-705AB6FEF245\hnstEA.tmp','');
QuarantineFile('C:\WINDOWS\system32\nethtsrv.exe','');
QuarantineFile('C:\Documents and Settings\Я!\Local Settings\Application Data\364EE69C-1436046085-9CB1-2111-705AB6FEF245\snsv12C.tmp','');
QuarantineFile('C:\Documents and Settings\Я!\Application Data\364EE69C-1436024293-9CB1-2111-705AB6FEF245\knsb35D.tmp','');
QuarantineFile('C:\WINDOWS\system32\drivers\nethfdrv.sys','');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\BDSafeBrowser.sys','');
QuarantineFile('C:\WINDOWS\system32\Drivers\BDMWrench.sys','');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\BDArKit.sys','');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\bd0004.sys','');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\bd0001.sys','');
QuarantineFile('C:\WINDOWS\system32\hfpapi.dll','');
QuarantineFile('C:\WINDOWS\system32\hfnapi.dll','');
QuarantineFile('C:\Documents and Settings\Я!\Local Settings\Application Data\SmartWeb\swhk.dll','');
QuarantineFile('c:\documents and settings\Я!\local settings\application data\364ee69c-1436046085-9cb1-2111-705ab6fef245\snsv12c.tmp','');
QuarantineFile('c:\documents and settings\Я!\local settings\application data\smartweb\smartwebhelper.exe','');
QuarantineFile('c:\documents and settings\Я!\local settings\application data\smartweb\smartwebapp.exe','');
QuarantineFile('c:\windows\system32\netupdsrv.exe','');
QuarantineFile('c:\windows\system32\nethtsrv.exe','');
QuarantineFile('c:\documents and settings\Я!\application data\364ee69c-1436024293-9cb1-2111-705ab6fef245\knsb35d.tmp','');
QuarantineFile('c:\documents and settings\Я!\application data\364ee69c-1436024293-9cb1-2111-705ab6fef245\jnsude.tmp','');
QuarantineFile('c:\documents and settings\Я!\application data\364ee69c-1436024293-9cb1-2111-705ab6fef245\hnstea.tmp','');
DeleteFile('c:\documents and settings\Я!\application data\364ee69c-1436024293-9cb1-2111-705ab6fef245\hnstea.tmp','32');
DeleteFile('c:\documents and settings\Я!\application data\364ee69c-1436024293-9cb1-2111-705ab6fef245\jnsude.tmp','32');
DeleteFile('c:\documents and settings\Я!\application data\364ee69c-1436024293-9cb1-2111-705ab6fef245\knsb35d.tmp','32');
DeleteFile('c:\windows\system32\nethtsrv.exe','32');
DeleteFile('c:\windows\system32\netupdsrv.exe','32');
DeleteFile('c:\documents and settings\Я!\local settings\application data\smartweb\smartwebapp.exe','32');
DeleteFile('c:\documents and settings\Я!\local settings\application data\smartweb\smartwebhelper.exe','32');
DeleteFile('c:\documents and settings\Я!\local settings\application data\364ee69c-1436046085-9cb1-2111-705ab6fef245\snsv12c.tmp','32');
DeleteFile('C:\Documents and Settings\Я!\Local Settings\Application Data\SmartWeb\swhk.dll','32');
DeleteFile('C:\WINDOWS\system32\hfnapi.dll','32');
DeleteFile('C:\WINDOWS\system32\hfpapi.dll','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\bd0001.sys','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\bd0004.sys','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\BDArKit.sys','32');
DeleteFile('C:\WINDOWS\system32\Drivers\BDMWrench.sys','32');
DeleteFile('C:\WINDOWS\system32\DRIVERS\BDSafeBrowser.sys','32');
DeleteFile('C:\WINDOWS\system32\drivers\nethfdrv.sys','32');
DeleteFile('C:\Documents and Settings\Я!\Application Data\364EE69C-1436024293-9CB1-2111-705AB6FEF245\knsb35D.tmp','32');
DeleteFile('C:\Documents and Settings\Я!\Local Settings\Application Data\364EE69C-1436046085-9CB1-2111-705AB6FEF245\snsv12C.tmp','32');
DeleteFile('C:\WINDOWS\system32\nethtsrv.exe','32');
DeleteFile('C:\WINDOWS\system32\netupdsrv.exe','32');
DeleteFile('C:\Documents and Settings\Я!\Application Data\364EE69C-1436024293-9CB1-2111-705AB6FEF245\hnstEA.tmp','32');
DeleteFile('C:\Program Files\Common Files\Baidu\BaiduProtect1.3\1.3.0.645\BaiduProtect.exe','32');
DeleteFile('C:\Program Files\MiuiTab\ProtectService.exe','32');
DeleteFile('C:\DOCUME~1\!12F2~1\LOCALS~1\Temp\463656.exe','32');
DeleteFile('C:\Documents and Settings\Я!\Local Settings\Application Data\SmartWeb\SmartWebHelper.exe','32');
DeleteFile('C:\Program Files\AnyProtectEx\AnyProtect.exe','32');
DeleteFile('C:\WINDOWS\Tasks\APSnotifierPP1.job','32');
DeleteFile('C:\WINDOWS\Tasks\APSnotifierPP2.job','32');
DeleteFile('C:\WINDOWS\Tasks\APSnotifierPP3.job','32');
DeleteFile('C:\WINDOWS\Tasks\SmartWeb Upgrade Trigger Task.job','32');
DeleteFile('C:\Program Files\miuitab\browerwatchch.dll','32');
DeleteFile('C:\Program Files\miuitab\cmdshell.exe','32');
DeleteFile('C:\Program Files\miuitab\hpnotify.exe','32');
DeleteFile('C:\Program Files\miuitab\iewatchdog.dll','32');
DeleteFile('C:\Program Files\miuitab\protectservice.exe','32');
DeleteService('nethfdrv');
DeleteService('IHProtect Service');
DeleteService('BDSGRTP');
DeleteService('vicoqudu');
DeleteService('ServiceUpdater');
DeleteService('NetHttpService');
DeleteService('gopibeko');
DeleteService('byjisogy');
BC_ImportAll;
ExecuteSysClean;
ExecuteWizard('TSW',2,3,true);
BC_Activate;
RebootWindows(true);
end.
После всех процедур выполните скрипт
Код: begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
- Перетащите лог Check_Browsers_LNK.log на утилиту ClearLNK. Отчёт о работе прикрепите.
|
