F
ftor
У друга завелась на компе эта зараза. Помогите изгнать демона.
Follow along with the video below to see how to install our site as a web app on your home screen.
Примечание: This feature currently requires accessing the site using the built-in Safari browser.
e:\windows\system32\brastk.exe
E:\WINDOWS\system32\WinCtrl32.dll
E:\WINDOWS\system32\winrkp32.dll
E:\WINDOWS\system32\Drivers\Winpx03.sys
E:\WINDOWS\System32\Drivers\Winwf58.sys
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('E:\WINDOWS\system32\wini10543.exe','');
QuarantineFile('E:\Documents and Settings\Администратор\Local Settings\Temporary Internet Files\Content.IE5\SHUJO523\Install[2].exe','');
QuarantineFile('E:\WINDOWS\system32\karna.dat','');
QuarantineFile('E:\WINDOWS\system32\twext.exe','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Winwf58.sys','');
QuarantineFile('E:\WINDOWS\system32\Drivers\Winpx03.sys','');
QuarantineFile('e:\WINDOWS\System32\Drivers\Beep.SYS','');
QuarantineFile('E:\WINDOWS\system32\winrkp32.dll','');
QuarantineFile('E:\WINDOWS\system32\WinCtrl32.dll','');
QuarantineFile('e:\windows\system32\brastk.exe','');
TerminateProcessByName('e:\windows\system32\brastk.exe');
DeleteFile('e:\windows\system32\brastk.exe');
DeleteFile('e:\WINDOWS\system32\dllcache\beep.sys');
DeleteFile('E:\WINDOWS\system32\WinCtrl32.dll');
DeleteFile('E:\WINDOWS\system32\winrkp32.dll');
DeleteFile('E:\WINDOWS\system32\Drivers\Winpx03.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Winwf58.sys');
DeleteFile('E:\WINDOWS\system32\twext.exe');
DeleteFile('E:\WINDOWS\system32\karna.dat');
DeleteFile('WinCtrl32.dll');
DeleteFile('E:\Documents and Settings\Администратор\Local Settings\Temporary Internet Files\Content.IE5\SHUJO523\Install[2].exe');
DeleteFile('E:\WINDOWS\system32\wini10543.exe');
BC_ImportAll;
BC_DeleteSvc('Winpx03');
BC_DeleteSvc('Beep');
BC_DeleteSvc('Winwf58');
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('E:\WINDOWS\karna.dat');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: WinCtrl32 - E:\WINDOWS\
O20 - Winlogon Notify: winrkp32 - winrkp32.dll (file missing)