Файлы стали с расширением "[email protected]"
Код |
---|
[CODE];uVS v3.85.17 [http://dsrt.dyndns.org] ;Target OS: NTv5.1 v385c OFFSGNSAVE ;------------------------autoscript--------------------------- sreg chklst delvir delref %SystemDrive%\DOCUME~1\86C2~1\LOCALS~1\TEMP\3FE91.EXE del %SystemDrive%\DOCUME~1\86C2~1\LOCALS~1\TEMP\3FE91.EXE delref %SystemDrive%\DOCUMENTS AND SETTINGS\ПОЛЬЗОВАТЕЛЬ\APPLICATION DATA\MICROSOFT\INTERNET EXPLORER\QIPSEARCHBAR.DLL del %SystemDrive%\DOCUMENTS AND SETTINGS\ПОЛЬЗОВАТЕЛЬ\APPLICATION DATA\MICROSOFT\INTERNET EXPLORER\QIPSEARCHBAR.DLL delref %Sys32%\DRIVERS\BDSAFEBROWSER.SYS del %Sys32%\DRIVERS\BDSAFEBROWSER.SYS deldirex %SystemDrive%\PROGRAM FILES\BAIDU\BAIDUAN\2.3.0.2225 delall %SystemDrive%\PROGRAM FILES\COMMON FILES\BAIDU\BDDOWNLOAD\108\BDCOMPROXY.DLL delall %SystemDrive%\PROGRAM FILES\COMMON FILES\BAIDU\BDDOWNLOAD\108\BDDOWNLOADER.EXE delref HTTP://SEARCH.QIP.RU ; Java(TM) 6 Update 19 exec MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF} /quiet ; Java(TM) 6 Update 3 exec MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} /quiet delnfr areg ;------------------------------------------------------------- |
Код |
---|
;uVS v3.85.17 [http://dsrt.dyndns.org] ;Target OS: NTv5.1 v385c OFFSGNSAVE delall %Sys32%\SVCHOST.EXE:EXT.EXE ;------------------------autoscript--------------------------- chklst delvir delref HTTP://SEARCH-ALL.NET/ delref {83E915D4-DDDB-4450-B957-7A3240E9CE66}\[CLSID] deltmp delnfr ;------------------------------------------------------------- restart |
Код |
---|
;uVS v3.86.5 [http://dsrt.dyndns.org] ;Target OS: NTv5.1 v385c OFFSGNSAVE zoo %Sys32%\NETUPDSRV.EXE addsgn 1AA3E79A5583D98CF42B254E3143FE86C9AA77B381AC48128D9A7B84B49771C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 NetworkUpdate.mbam zoo %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\APPLICATION DATA\20577\A30813.EXE addsgn 1AADCB9A5583C58CF42B627DA804DEC9E946303A4536942CA1CF4EF074D2F49E577EF097B411B941AF40F189C7ECC9FA7DDF9A7CD6E738F06577A45BC2EFBDCF 8 Win32/Amonetize.BE [ESET-NOD32] zoo %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\APPLICATION DATA\BABSOLUTION\SHARED\BABMAINT.EXE addsgn A7679B1BB95244720BE76ED7ED4DEAF8DA75CF3FEF7392887E3C3A8F82B0F8D9CBEE3CA8B3D065B4D47FD4F5467C499067B5E88D409E906C2DFA29D73AF9DD22 8 Adware.Babylon.12 [DrWeb] zoo %Sys32%\NETHTSRV.EXE addsgn 1ABC099A5583D98CF42B254E3143FE86C9AA77B381AC48128D9A7B04549471C15EF730F2B71065C26E8CDB1603EA177FBDABE48455D2C42BEA32502F879F23FE 8 NetUpdate.mbam zoo %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\APPLICATION DATA\SWVUPDATER\UPDATER.EXE addsgn 925277FA136AC1CC0B64574E334BDFFACE9A6C66196A8FE80FC583345791709756104849BDBB6158F0F26927471649FA7C049D75DEC433C2D1667F3E0707F900 8 a variant of Win32/Amonetize.I zoo %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\РАБОЧИЙ СТОЛ\OFFICE ACTIVATION 2010.EXE addsgn A7679B2355684C728A38AEB264C8AA51258AFCA7DE79F37C0CF7E1EB0685F2A0279EEF73079592CD2A81849FFCE996B97D9DBA439C5B790C98875BAE1606697C 8 BackDoor.Ddoser.131 [DrWeb] hide %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\РАБОЧИЙ СТОЛ\CCLEANER.EXE czoo restart ;------------------------autoscript--------------------------- chklst delvir ; Better Surf Plus exec C:\Program Files\BetterSurf\BetterSurfPlus\uninstall.exe ; Delta Chrome Toolbar exec C:\Documents and Settings\Кирилл\Application Data\BabSolution\Shared\GUninstaller.exe" -key "Delta Chrome Toolbar" -rmkey -ask -rmbus "Delta Chrome Toolbar ; OffersWizard Network System Driver exec C:\Program Files\Common Files\Config\uninstinethnfd.exe delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\VKSAVER\VKSAVER3.DLL delref %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI\0.5_0\GOOGLE ДОКУМЕНТЫ ОФЛАЙН delref %SystemDrive%\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\VKSAVER\VKSAVER.EXE deldirex %SystemDrive%\PROGRAM FILES\BETTERSURF\FF deldirex %SystemDrive%\PROGRAM FILES\BETTERSURF\BETTERSURFPLUS\FF delref %SystemDrive%\DOCUMENTS AND SETTINGS\КИРИЛЛ\LOCAL SETTINGS\APPLICATION DATA\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\EOONCJEJNPPFJJKLAPAAMHCDMJBILMDE\1.5.1_0\DELTA TOOLBAR deltmp delnfr ;------------------------------------------------------------- |