Закройте все программы,
временно выгрузите антивирус, файрволл и прочее защитное ПО.
- Перетащите лог Check_Browsers_LNK.log на
утилиту ClearLNK. Отчёт о работе прикрепите.
Выполните скрипт в АВЗ из папки Autologger (Файл - Выполнить скрипт):
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Programdata\Setup\sch2.bat','');
DeleteFile('C:\Programdata\Setup\sch2.bat','64');
DeleteSchedulerTask('Microsoft\Windows\WindowsBackup\RecoveryHosts');
BC_Activate;
ExecuteSysClean;
ExecuteRepair(9);
ExecuteWizard('SCU', 2, 3, true);
BC_ImportALL;
RebootWindows(true);
end.
Компьютер
перезагрузится.
После перезагрузки, выполните такой скрипт:
begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.
Файл
quarantine.7z из папки с распакованной утилитой AVZ отправьте с помощью
этой формы или (если размер архива превышает 10 MB) на этот почтовый ящик:
quarantine <at> safezone.cc (замените
<at> на
@) с указанием ссылки на тему в теме (заголовке) сообщения и с указанием пароля:
malware в теле письма.
"Пофиксите" в HijackThis (некоторые строки могут отсутствовать):
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Закачать ВСЕ при помощи Download Master: (default) = C:\Program Files (x86)\Download Master\dmieall.htm (file missing)
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Закачать при помощи Download Master: (default) = C:\Program Files (x86)\Download Master\dmie.htm (file missing)
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Передать на удаленную закачку DM: (default) = C:\Program Files (x86)\Download Master\remdown.htm (file missing)
22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{00446CF1-8668-472D-BEDD-D0BB88DBA009} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{00446CF1-8668-472D-BEDD-D0BB88DBA009} - \Microsoft\Windows\Registry\RegIdleBackup (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{043AFD77-F779-48D9-A216-5BFDF4F1F9D1} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{043AFD77-F779-48D9-A216-5BFDF4F1F9D1} - \Microsoft\Windows\Flighting\FeatureConfig\UsageDataReporting (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{117E2D01-1275-4560-90E9-A34BB4EE69A3} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{117E2D01-1275-4560-90E9-A34BB4EE69A3} - \Microsoft\Windows\DiskFootprint\StorageSense (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{31B9B01A-4336-4D20-AFAD-F772D1F825BB} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{31B9B01A-4336-4D20-AFAD-F772D1F825BB} - \Microsoft\Windows\Flighting\FeatureConfig\ReconcileFeatures (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{36A78C3E-A142-4F86-903E-AE26291F646C} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{36A78C3E-A142-4F86-903E-AE26291F646C} - \Microsoft\Windows\Autochk\Proxy (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A4032F6-6063-4D54-BAE3-F8A4A5110CDA} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A4032F6-6063-4D54-BAE3-F8A4A5110CDA} - \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A6DB6F9-A355-420A-B6E0-7C54D12F4033} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3A6DB6F9-A355-420A-B6E0-7C54D12F4033} - \Microsoft\Windows\NetTrace\GatherNetworkInfo (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D363385-64B8-4207-AC46-3EE180DD87F2} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D363385-64B8-4207-AC46-3EE180DD87F2} - \Microsoft\Windows\Application Experience\StartupAppTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{41F5FC9D-EE65-4CA4-A908-91B3587198E0} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{41F5FC9D-EE65-4CA4-A908-91B3587198E0} - \Microsoft\XblGameSave\XblGameSaveTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4680A8DF-7B63-403E-ABB1-3FA7B77DE631} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4680A8DF-7B63-403E-ABB1-3FA7B77DE631} - \Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F2030CE-BA8E-4122-B9A8-29AA5858973E} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4F2030CE-BA8E-4122-B9A8-29AA5858973E} - \Microsoft\Windows\Flighting\OneSettings\RefreshCache (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{53FE559C-30AB-4515-B492-C8B30F409C83} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{53FE559C-30AB-4515-B492-C8B30F409C83} - \Microsoft\Windows\Application Experience\AitAgent (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{54D4D29C-744B-42E7-AD2C-11F44FB5A509} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{54D4D29C-744B-42E7-AD2C-11F44FB5A509} - \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{559B0F92-63C4-4001-AE5E-A650091C71B8} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{559B0F92-63C4-4001-AE5E-A650091C71B8} - \Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73469C3A-0B60-4A11-AD8A-FC67A901B741} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{73469C3A-0B60-4A11-AD8A-FC67A901B741} - \Microsoft\Windows\Application Experience\ProgramDataUpdater (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7572B7F9-BE9D-43BF-9A4E-F82023EDBD33} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7572B7F9-BE9D-43BF-9A4E-F82023EDBD33} - \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7617E03F-109E-435B-9B4C-0282CD5BE4A9} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7617E03F-109E-435B-9B4C-0282CD5BE4A9} - \Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7A5AFDB2-56EC-4352-AB44-069E7BF253A8} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7A5AFDB2-56EC-4352-AB44-069E7BF253A8} - \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92FFE795-C628-4324-AB97-06F804352DB6} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92FFE795-C628-4324-AB97-06F804352DB6} - \Microsoft\Windows\Feedback\Siuf\DmClient (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99E87B56-42DC-4BAA-86CF-61E5A9192F61} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{99E87B56-42DC-4BAA-86CF-61E5A9192F61} - \Microsoft\Windows\Diagnosis\RecommendedTroubleshootingScanner (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B97C7632-DD50-4F07-8E4E-F1450795BF78} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B97C7632-DD50-4F07-8E4E-F1450795BF78} - \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0E197F6-2E40-46FD-83DA-BE8704EF2CE5} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C0E197F6-2E40-46FD-83DA-BE8704EF2CE5} - \Microsoft\Windows\Ras\MobilityManager (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3944556-15CF-467E-89E2-29D4BFD3EC5A} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C3944556-15CF-467E-89E2-29D4BFD3EC5A} - \Microsoft\Windows\Diagnosis\Scheduled (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9EC268B-1D36-4AF0-A1EB-2C1BC3B455D9} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C9EC268B-1D36-4AF0-A1EB-2C1BC3B455D9} - \Microsoft\Windows\DiskFootprint\Diagnostics (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D791531F-1514-4941-974A-FC3035C712A7} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D791531F-1514-4941-974A-FC3035C712A7} - \Microsoft\Windows\Flighting\FeatureConfig\UsageDataFlushing (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB1218E6-F693-4F20-BC36-E62D6CB63AB4} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB1218E6-F693-4F20-BC36-E62D6CB63AB4} - \Microsoft\Windows\Windows Defender\Windows Defender Cleanup (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E559FBB0-7370-4985-90DD-5D6B10DFC5F1} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E559FBB0-7370-4985-90DD-5D6B10DFC5F1} - \Microsoft\Windows\Windows Defender\Windows Defender Verification (no xml)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED77AEE0-EAFB-4133-B544-9E7C5632D902} - (no key)
O22 - Task: (damaged) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ED77AEE0-EAFB-4133-B544-9E7C5632D902} - \Microsoft\Windows\Customer Experience Improvement Program\Consolidator (no xml)
O22 - Tasks: (damaged) Overwolf Updater Task - C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe /RunningFrom Schedule (user missing)
Для
повторной диагностики запустите снова AutoLogger. В первом диалоговом окне нажмите "ОК", удерживая нажатой клавишу "Shift".