Follow along with the video below to see how to install our site as a web app on your home screen.
Примечание: This feature currently requires accessing the site using the built-in Safari browser.
после отключения антивируса по правилу сбора логов появилось много новых программ, видимо сами установились. так же антивирус теперь блокирует сайт superfish.comНужны логи по правилам: https://safezone.cc/pravila/
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
TerminateProcessByName('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\ansoc57b.exe');
TerminateProcessByName('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\vnsx8df9.tmp');
TerminateProcessByName('c:\users\нн\appdata\local\00116a9a-1429034801-8017-ffff-f46d04f8bc53\snsef3da.tmp');
TerminateProcessByName('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\nsna822.tmpfs');
TerminateProcessByName('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\jnsida4f.tmp');
TerminateProcessByName('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\cnszc8c7.tmp');
TerminateProcessByName('c:\users\нн\appdata\local\00116a9a-1429034647-8017-ffff-f46d04f8bc53\bnsn9b8e.exe');
SetServiceStart('vujofilo', 4);
SetServiceStart('ronevulo', 4);
SetServiceStart('moruxefo', 4);
StopService('vujofilo');
StopService('ronevulo');
StopService('moruxefo');
QuarantineFile('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\ansoc57b.exe', '');
QuarantineFile('C:\Users\нн\AppData\Roaming\ASPackage\ASPackage.exe', '');
QuarantineFile('C:\Users\AF19~1\AppData\Local\Temp\nsn94E9.tmp\IpConfig.dll', '');
QuarantineFile('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\vnsx8df9.tmp', '');
QuarantineFile('c:\users\нн\appdata\local\00116a9a-1429034801-8017-ffff-f46d04f8bc53\snsef3da.tmp', '');
QuarantineFile('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\nsna822.tmpfs', '');
QuarantineFile('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\jnsida4f.tmp', '');
QuarantineFile('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\cnszc8c7.tmp', '');
QuarantineFile('c:\users\нн\appdata\local\00116a9a-1429034647-8017-ffff-f46d04f8bc53\bnsn9b8e.exe', '');
DeleteFile('c:\users\нн\appdata\local\00116a9a-1429034801-8017-ffff-f46d04f8bc53\snsef3da.tmp', '32');
DeleteFile('c:\users\нн\appdata\roaming\00116a9a-1429005779-8017-ffff-f46d04f8bc53\vnsx8df9.tmp', '32');
DeleteFile('C:\Users\AF19~1\AppData\Local\Temp\nsn94E9.tmp\IpConfig.dll', '32');
DeleteFile('C:\Users\нн\AppData\Roaming\00116A9A-1429005779-8017-FFFF-F46D04F8BC53\jnsiDA4F.tmp', '32');
DeleteFile('C:\Users\нн\AppData\Roaming\00116A9A-1429005779-8017-FFFF-F46D04F8BC53\nsnA822.tmpfs', '32');
DeleteFile('C:\Users\нн\AppData\Local\00116A9A-1429034786-8017-FFFF-F46D04F8BC53\cnszC8C7.tmp', '32');
DeleteFile('C:\Users\нн\AppData\Local\00116A9A-1429034647-8017-FFFF-F46D04F8BC53\bnsn9B8E.exe', '32');
DeleteFile('C:\Users\нн\AppData\Roaming\ASPackage\ASPackage.exe', '32');
DeleteFile('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\ansoc57b.exe', '32');
DeleteService('vujofilo');
DeleteService('ronevulo');
DeleteService('moruxefo');
DeleteFileMask('C:\Users\нн\AppData\Roaming\ASPackage\', '*', true);
DeleteDirectory('C:\Users\нн\AppData\Roaming\ASPackage\');
DeleteFileMask('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\', '*', true);
DeleteDirectory('c:\users\нн\appdata\local\00116a9a-1429034786-8017-ffff-f46d04f8bc53\');
DelBHO('{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}');
DelBHO('{9B5FB65F-631E-4564-ABF2-AD71845B28E0}');
DelBHO('{2EECD738-5844-4a99-B4B6-146BF802613B}');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'WinCheck');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\RunOnce', 'Update');
BC_ImportAll;
ExecuteWizard('SCU', 2, 3, true);
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
TerminateProcessByName('c:\users\нн\appdata\local\smartweb\smartwebhelper.exe');
TerminateProcessByName('c:\users\нн\appdata\local\smartweb\smartwebapp.exe');
TerminateProcessByName('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe');
TerminateProcessByName('c:\program files (x86)\xtab\protectservice.exe');
TerminateProcessByName('c:\program files (x86)\xtab\hpnotify.exe');
TerminateProcessByName('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe');
TerminateProcessByName('c:\program files (x86)\xtab\cmdshell.exe');
TerminateProcessByName('c:\program files (x86)\igs\ccl.exe');
TerminateProcessByName('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-6.exe');
TerminateProcessByName('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.exe');
QuarantineFile('C:\Windows\system32\CCL.dll', '');
QuarantineFile('C:\Users\нн\AppData\Roaming\update\Explorer.exe', '');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-5.exe', '');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-4.exe', '');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-3.exe', '');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-11.exe', '');
QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-7.exe', '');
QuarantineFile('C:\Users\??\AppData\Roaming\FVQPBD.exe', '');
QuarantineFile('C:\Users\??\AppData\Roaming\BFKGWOB.exe', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '');
QuarantineFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '');
QuarantineFile('C:\Users\AF19~1\AppData\Local\Temp\7zS7590\hpslpsvc64.dll', '');
QuarantineFile('C:\Windows\system32\drivers\innfd_1_10_0_14.sys', '');
QuarantineFile('C:\Users\нн\AppData\Local\00116A9A-1429035462-8017-FFFF-F46D04F8BC53\insi1031.tmp', '');
QuarantineFile('C:\Program Files (x86)\Infonaut_1.10.0.14\Service\insvc.exe', '');
QuarantineFile('C:\Users\нн\AppData\Local\SmartWeb\swhk.dll', '');
QuarantineFile('C:\Program Files (x86)\XTab\SupTab.dll', '');
QuarantineFile('C:\Program Files (x86)\IGS\CCCert.dll', '');
QuarantineFile('C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\pdf.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libglesv2.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libegl.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\ffmpegsumo.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_elf.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_child.dll', '');
QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome.dll', '');
QuarantineFile('c:\users\нн\appdata\local\smartweb\smartwebhelper.exe', '');
QuarantineFile('c:\users\нн\appdata\local\smartweb\smartwebapp.exe', '');
QuarantineFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe', '');
QuarantineFile('c:\program files (x86)\xtab\protectservice.exe', '');
QuarantineFile('c:\program files (x86)\xtab\hpnotify.exe', '');
QuarantineFile('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe', '');
QuarantineFile('c:\program files (x86)\xtab\cmdshell.exe', '');
QuarantineFile('c:\program files (x86)\igs\ccl.exe', '');
QuarantineFile('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-6.exe', '');
QuarantineFile('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.exe', '');
DeleteFile('c:\program files (x86)\xtab\cmdshell.exe', '32');
DeleteFile('c:\program files (x86)\xtab\hpnotify.exe', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_child.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_elf.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\ffmpegsumo.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libegl.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libglesv2.dll', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\pdf.dll', '32');
DeleteFile('C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll', '32');
DeleteFile('C:\Program Files (x86)\IGS\CCCert.dll', '32');
DeleteFile('C:\Program Files (x86)\XTab\SupTab.dll', '32');
DeleteFile('C:\Program Files (x86)\IGS\CCL.exe', '32');
DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe', '32');
DeleteFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe', '32');
DeleteFile('C:\Program Files (x86)\Infonaut_1.10.0.14\Service\insvc.exe', '32');
DeleteFile('C:\Users\нн\AppData\Local\00116A9A-1429035462-8017-FFFF-F46D04F8BC53\insi1031.tmp', '32');
DeleteFile('C:\Windows\system32\drivers\innfd_1_10_0_14.sys', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe', '32');
DeleteFile('C:\Users\AF19~1\AppData\Local\Temp\7zS7590\hpslpsvc64.dll', '32');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-1-7.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-10_user.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-11.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-3.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-4.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-5.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-5_user.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-6.job', '64');
DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-7.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '64');
DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job', '64');
DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '32');
DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '32');
DeleteFile('C:\Users\??\AppData\Roaming\BFKGWOB.exe', '32');
DeleteFile('C:\Users\??\AppData\Roaming\FVQPBD.exe', '32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.exe', '32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-7.exe', '32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-11.exe', '32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-4.exe', '32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-5.exe', '32');
DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-6.exe', '32');
DeleteFile('C:\Users\нн\AppData\Roaming\update\Explorer.exe', '32');
DeleteFile('C:\Windows\system32\CCL.dll', '32');
DeleteFile('C:\Users\нн\appdata\local\smartweb\swhk.dll', '32');
DeleteFile('C:\Users\нн\appdata\local\smartweb\smartwebhelper.exe', '32');
DeleteFile('C:\Users\нн\appdata\local\smartweb\smartwebapp.exe', '32');
DeleteService('innfd_1_10_0_14');
DeleteService('kitecudi');
DeleteService('insvc_1.10.0.14');
DeleteService('WindowsMangerProtect');
DeleteService('IHProtect Service');
DeleteService('CCL');
DeleteFileMask('C:\Users\нн\AppData\Roaming\update\', '*', true);
DeleteDirectory('C:\Users\нн\AppData\Roaming\update\');
DeleteFileMask('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\', '*', true);
DeleteDirectory('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\');
DeleteFileMask('C:\Users\нн\appdata\local\smartweb\', '*', true);
DeleteDirectory('C:\Users\нн\appdata\local\smartweb\');
DeleteFileMask('C:\Program Files (x86)\Crossbrowse\', '*', true);
DeleteDirectory('C:\Program Files (x86)\Crossbrowse\');
DelBHO('{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}');
RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'GoogleChromeAutoLaunch_0E29914B37577ADCF4FB2DC765E5D8F3');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\HPSLPSVC\Parameters', 'ServiceDll');
RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SmartWeb');
BC_ImportAll;
ExecuteRepair(14);
ExecuteWizard('SCU', 2, 3, true);
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
Адв клинер тоже выключить?О, какая пьянка пошла.
+
к предыдущему
Закройте все программы, временно выгрузите антивирус, файрволл и прочее защитное ПО.
Выполните скрипт в АВЗ (Файл - Выполнить скрипт):
Код:begin ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true); if not IsWOW64 then begin SearchRootkit(true, true); SetAVZGuardStatus(True); end; TerminateProcessByName('c:\users\нн\appdata\local\smartweb\smartwebhelper.exe'); TerminateProcessByName('c:\users\нн\appdata\local\smartweb\smartwebapp.exe'); TerminateProcessByName('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe'); TerminateProcessByName('c:\program files (x86)\xtab\protectservice.exe'); TerminateProcessByName('c:\program files (x86)\xtab\hpnotify.exe'); TerminateProcessByName('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe'); TerminateProcessByName('c:\program files (x86)\xtab\cmdshell.exe'); TerminateProcessByName('c:\program files (x86)\igs\ccl.exe'); TerminateProcessByName('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-6.exe'); TerminateProcessByName('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.exe'); QuarantineFile('C:\Windows\system32\CCL.dll', ''); QuarantineFile('C:\Users\нн\AppData\Roaming\update\Explorer.exe', ''); QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-5.exe', ''); QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-4.exe', ''); QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-3.exe', ''); QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-11.exe', ''); QuarantineFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-7.exe', ''); QuarantineFile('C:\Users\??\AppData\Roaming\FVQPBD.exe', ''); QuarantineFile('C:\Users\??\AppData\Roaming\BFKGWOB.exe', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', ''); QuarantineFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', ''); QuarantineFile('C:\Users\AF19~1\AppData\Local\Temp\7zS7590\hpslpsvc64.dll', ''); QuarantineFile('C:\Windows\system32\drivers\innfd_1_10_0_14.sys', ''); QuarantineFile('C:\Users\нн\AppData\Local\00116A9A-1429035462-8017-FFFF-F46D04F8BC53\insi1031.tmp', ''); QuarantineFile('C:\Program Files (x86)\Infonaut_1.10.0.14\Service\insvc.exe', ''); QuarantineFile('C:\Users\нн\AppData\Local\SmartWeb\swhk.dll', ''); QuarantineFile('C:\Program Files (x86)\XTab\SupTab.dll', ''); QuarantineFile('C:\Program Files (x86)\IGS\CCCert.dll', ''); QuarantineFile('C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\pdf.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libglesv2.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libegl.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\ffmpegsumo.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_elf.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_child.dll', ''); QuarantineFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome.dll', ''); QuarantineFile('c:\users\нн\appdata\local\smartweb\smartwebhelper.exe', ''); QuarantineFile('c:\users\нн\appdata\local\smartweb\smartwebapp.exe', ''); QuarantineFile('c:\programdata\windowsmangerprotect\protectwindowsmanager.exe', ''); QuarantineFile('c:\program files (x86)\xtab\protectservice.exe', ''); QuarantineFile('c:\program files (x86)\xtab\hpnotify.exe', ''); QuarantineFile('c:\program files (x86)\crossbrowse\crossbrowse\application\crossbrowse.exe', ''); QuarantineFile('c:\program files (x86)\xtab\cmdshell.exe', ''); QuarantineFile('c:\program files (x86)\igs\ccl.exe', ''); QuarantineFile('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-6.exe', ''); QuarantineFile('c:\program files (x86)\cinemaplus-3.2cv13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.exe', ''); DeleteFile('c:\program files (x86)\xtab\cmdshell.exe', '32'); DeleteFile('c:\program files (x86)\xtab\hpnotify.exe', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome.dll', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_child.dll', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\chrome_elf.dll', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\ffmpegsumo.dll', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libegl.dll', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\libglesv2.dll', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.4.2171.95\pdf.dll', '32'); DeleteFile('C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.118\chrome.dll', '32'); DeleteFile('C:\Program Files (x86)\IGS\CCCert.dll', '32'); DeleteFile('C:\Program Files (x86)\XTab\SupTab.dll', '32'); DeleteFile('C:\Program Files (x86)\IGS\CCL.exe', '32'); DeleteFile('C:\Program Files (x86)\XTab\ProtectService.exe', '32'); DeleteFile('C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe', '32'); DeleteFile('C:\Program Files (x86)\Infonaut_1.10.0.14\Service\insvc.exe', '32'); DeleteFile('C:\Users\нн\AppData\Local\00116A9A-1429035462-8017-FFFF-F46D04F8BC53\insi1031.tmp', '32'); DeleteFile('C:\Windows\system32\drivers\innfd_1_10_0_14.sys', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe', '32'); DeleteFile('C:\Users\AF19~1\AppData\Local\Temp\7zS7590\hpslpsvc64.dll', '32'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-1-7.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-10_user.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-11.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-3.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-4.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-5.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-5_user.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-6.job', '64'); DeleteFile('C:\Windows\Tasks\4d33180d-2933-4156-9ae3-1bc499258dc6-7.job', '64'); DeleteFile('C:\Windows\Tasks\APSnotifierPP1.job', '64'); DeleteFile('C:\Windows\Tasks\APSnotifierPP2.job', '64'); DeleteFile('C:\Windows\Tasks\APSnotifierPP3.job', '64'); DeleteFile('C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe', '32'); DeleteFile('C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe', '32'); DeleteFile('C:\Users\??\AppData\Roaming\BFKGWOB.exe', '32'); DeleteFile('C:\Users\??\AppData\Roaming\FVQPBD.exe', '32'); DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-6.exe', '32'); DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-1-7.exe', '32'); DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-11.exe', '32'); DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-4.exe', '32'); DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-5.exe', '32'); DeleteFile('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\4d33180d-2933-4156-9ae3-1bc499258dc6-6.exe', '32'); DeleteFile('C:\Users\нн\AppData\Roaming\update\Explorer.exe', '32'); DeleteFile('C:\Windows\system32\CCL.dll', '32'); DeleteFile('C:\Users\нн\appdata\local\smartweb\swhk.dll', '32'); DeleteFile('C:\Users\нн\appdata\local\smartweb\smartwebhelper.exe', '32'); DeleteFile('C:\Users\нн\appdata\local\smartweb\smartwebapp.exe', '32'); DeleteService('innfd_1_10_0_14'); DeleteService('kitecudi'); DeleteService('insvc_1.10.0.14'); DeleteService('WindowsMangerProtect'); DeleteService('IHProtect Service'); DeleteService('CCL'); DeleteFileMask('C:\Users\нн\AppData\Roaming\update\', '*', true); DeleteDirectory('C:\Users\нн\AppData\Roaming\update\'); DeleteFileMask('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\', '*', true); DeleteDirectory('C:\Program Files (x86)\CinemaPlus-3.2cV13.04\'); DeleteFileMask('C:\Users\нн\appdata\local\smartweb\', '*', true); DeleteDirectory('C:\Users\нн\appdata\local\smartweb\'); DeleteFileMask('C:\Program Files (x86)\Crossbrowse\', '*', true); DeleteDirectory('C:\Program Files (x86)\Crossbrowse\'); DelBHO('{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}'); RegKeyParamDel('HKEY_CURRENT_USER', 'Software\Microsoft\Windows\CurrentVersion\Run', 'GoogleChromeAutoLaunch_0E29914B37577ADCF4FB2DC765E5D8F3'); RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\HPSLPSVC\Parameters', 'ServiceDll'); RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Run', 'SmartWeb'); BC_ImportAll; ExecuteRepair(3); ExecuteWizard('SCU', 2, 3, true); ExecuteSysClean; BC_Activate; RebootWindows(true); end.
Компьютер перезагрузится. После перезагрузки, выполните такой скрипт:
Код:begin CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); end.
Полученный архив quarantine.zip из папки с распакованной утилитой AVZ отправьте с помощью этой формы или (если размер архива превышает 8 MB) на этот почтовый ящик: quarantine <at> safezone.cc (замените <at> на @) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля: virus в теле письма.
спасибо, конечно, но я уж по старинке ))))Да ладно вам, у нас быстрее и без переустановки. Архив залейте на файлообменник ссылку пришлите по почте
ну вроде планы изменились, можно снова попробовать, если вас не затруднит конечно)))Зря, тем более, что не узнаете ничего нового
Большое спасибо, проблема ушла))))Продолжайте по теме рекомендаций
вот, пожалуйста)))логи где?