Timur Vassilyev
1) Скопируйте текст КОДа - в буфер обмена.
uVS: start.exe, текущий пользователь, меню, скрипты - выполнить скрипт из буфера обмена.
ПЕРЕД ВЫПОЛНЕНИЕМ СКРИПТА, ЗАКРЫТЬ БРАУЗЕРЫ!
ВНИМАНИЕ : По окончанию выполнения скрипта компьютер выполнит перезагрузку !
На вопросы программы отвечаем: Да !
Код
;uVS v4.1.6 [http://dsrt.dyndns.org:8888]
;Target OS: NTv6.1
v400c
OFFSGNSAVE
;------------------------autoscript---------------------------
delref HTTP://139.5.177.19/3.TXT
delref HTTP://173.208.139.170/2.TXT
delref HTTP://WMI.1217BYE.HOST/1.TXT
delref SYSTEM.NET.WEBCLIENT).DOWNLOADSTRING('HTTP://139.5.177.19/S.JPG')||REGSVR32
delref SYSTEM.NET.WEBCLIENT).DOWNLOADSTRING('HTTP://173.208.139.170/S.TXT')&POWERSHELL.EXE
delref SYSTEM.NET.WEBCLIENT).DOWNLOADSTRING('HTTP://WMI.1217BYE.HOST/S.PS1')&POWERSHELL.EXE
delref HTTP://CRASH.STEAMPOWERED.COM/SUBMIT
delref %SystemRoot%\DEBUG\ITEM.DAT
delref WMI:\\.\ROOT\SUBSCRIPTION\__INTERVALTIMERINSTRUCTION\FUCKYOUMM2_ITIMER
delref A.EXE
delref S&C:\WINDOWS\UPDATE.EXE
delref S.DAT
delref S.RAR
delref PS&C:\WINDOWS\HELP\LSMOSEE.EXE
delref %SystemRoot%\DEBUG\OK.DAT
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DNECFMKPLPMINFJAGBLFABGGOMDPAAKAN%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://SEARCH.QIP.RU/?QUERY={SEARCHTERMS}
delref HTTP://JS.0603BYE.INFO:280/V.SCT
delref {3706EE7C-3CAD-445D-8A43-03EBC3B75908}\[CLSID]
delref HTTP://JS.FTP0118.INFO:280/V.SCT
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\NECFMKPLPMINFJAGBLFABGGOMDPAAKAN\2.0.3.15_0\ПОИСК ЯНДЕКСA
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DDHDGFFKKEBHMKFJOJEJMPBLDMPOBFKFO%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DFCFENMBOOJPJINHPGGGODEFCCIPIKBPD%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://SEARCH.QIP.RU/SEARCH?QUERY={SEARCHTERMS}&FROM=IE
delref HTTP://SEARCH.QIP.RU/IE
delref HTTP://QIP.RU
delref HTTP://SEARCH.QIP.RU
apply
deltmp
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\TEMP\CHROME_BITS_5964_5729\ANEU5FI7G7LBZNLTZ-0FAYC
delref {23E5D772-327A-42F5-BDEE-C65C6796BB2A}\[CLSID]
delref {177AFECE-9599-46CF-90D7-68EC9EEB27B4}\[CLSID]
delref {CEF51277-5358-477B-858C-4E14F0C80BF7}\[CLSID]
delref {59116E30-02BD-4B84-BA1E-5D77E809B1A2}\[CLSID]
delref %SystemDrive%\USERS\USER\DESKTOP\AUTOSHUTDOWN_SEVENGADGETS.RU.ZIP
delref %SystemDrive%\USERS\USER\DESKTOP\KRT CLUB 1.1.0.19\KRT_CLUB.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\MAIL.RU\AGENT\MAGENT.EXE
delref %SystemDrive%\USERS\USER\DESKTOP\REALTEK HD AUDIO DRIVER R2.68_[SOFT95]\WDM_R268.EXE
delref %SystemDrive%\PROGRAM FILES (X86)\OPERA\OPERA.EXE
delref %SystemRoot%\SYSWOW64\TBSSVC.DLL
delref %SystemRoot%\SYSWOW64\PEERDISTSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\NDIS.SYS
delref %SystemRoot%\SYSWOW64\UMPO.DLL
delref %SystemRoot%\SYSWOW64\IPHLPSVC.DLL
delref %SystemRoot%\SYSWOW64\CSCSVC.DLL
delref %SystemRoot%\SYSWOW64\PNRPSVC.DLL
delref %SystemRoot%\SYSWOW64\DRIVERS\PACER.SYS
delref %SystemRoot%\SYSWOW64\LSM.EXE
delref {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\[CLSID]
delref {166B1BCA-3F9C-11CF-8075-444553540000}\[CLSID]
delref {233C1507-6A77-46A4-9443-F871F945D258}\[CLSID]
delref {4063BE15-3B08-470D-A0D5-B37161CFFD69}\[CLSID]
delref {88D969C0-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C1-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C2-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C3-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C4-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {88D969C5-F192-11D4-A65F-0040963251E5}\[CLSID]
delref {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA}\[CLSID]
delref %SystemRoot%\SYSWOW64\WIN32K.SYS
delref {E0DD6CAB-2D10-11D2-8F1A-0000F87ABD16}\[CLSID]
delref %SystemRoot%\SYSWOW64\BLANK.HTM
delref {0006F045-0000-0000-C000-000000000046}\[CLSID]
delref {0563DB41-F538-4B37-A92D-4659049B7766}\[CLSID]
delref {E6FB5E20-DE35-11CF-9C87-00AA005127ED}\[CLSID]
delref %Sys32%\BLANK.HTM
delref {472083B0-C522-11CF-8763-00608CC02F24}\[CLSID]
delref HELPSVC\[SERVICE]
delref SACSVR\[SERVICE]
delref VMMS\[SERVICE]
delref MESSENGER\[SERVICE]
delref RDSESSMGR\[SERVICE]
delref 513100472\[SERVICE]
delref %Sys32%\DRIVERS\TBPANEL.SYS
delref %Sys32%\PSXSS.EXE
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.34.7\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.23.9\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.27.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.26.9\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.3\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.32.7\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.11\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.29.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.30.3\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.31.5\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.28.1\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.7\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.24.15\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.28.13\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.23\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.29.1\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.28.15\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.17\PSUSER_64.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.135\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.34.7\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.23.9\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.27.5\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.26.9\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.149\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.145\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.5\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.3\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.32.7\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.25.11\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.5\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.29.5\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.165\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.30.3\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.21.153\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.31.5\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.28.1\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.7\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.24.15\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.28.13\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.23\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.22.5\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.29.1\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.28.15\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.33.17\PSUSER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\GOOGLE\UPDATE\1.3.22.3\PSUSER.DLL
delref %Sys32%\SHAREMEDIACPL.CPL
delref %SystemDrive%\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\ACRORD32INFO.EXE
delref {1FBA04EE-3024-11D2-8F1F-0000F87ABD16}\[CLSID]
delref {0000036B-C524-4050-81A0-243669A86B9F}\[CLSID]
delref {0E2877D3-2641-4970-B794-A553E295428D}\[CLSID]
delref {0E5680D1-BF44-4929-94AF-FD30D784AD1D}\[CLSID]
delref {0F3DC9E0-C459-4A40-BCF8-747BD9322E10}\[CLSID]
delref {18DF081C-E8AD-4283-A596-FA578C2EBDC3}\[CLSID]
delref {219C3416-8CB2-491A-A3C7-D9FCDDC9D600}\[CLSID]
delref {3AD14F0C-ED16-4E43-B6D8-661B03F6A1EF}\[CLSID]
delref {4248FE82-7FCB-46AC-B270-339F08212110}\[CLSID]
delref {4853DF44-7D6B-48E9-9258-D800EEE54AF6}\[CLSID]
delref {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\[CLSID]
delref {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\[CLSID]
delref {6D53EC84-6AAE-4787-AEEE-F4628F01010C}\[CLSID]
delref {7558B7E5-7B26-4201-BEDB-00D5FF534523}\[CLSID]
delref {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\[CLSID]
delref {8E5E2654-AD2D-48BF-AC2D-D17F00898D06}\[CLSID]
delref {92780B25-18CC-41C8-B9BE-3C9C571A8263}\[CLSID]
delref {9BFBA68E-E21B-458E-AE12-FE85E903D2C1}\[CLSID]
delref {CCF151D8-D089-449F-A5A4-D9909053F20F}\[CLSID]
delref {E33CF602-D945-461A-83F0-819F76A199F8}\[CLSID]
delref %SystemDrive%\PROGRAM FILES (X86)\QIP 2012\QIP.EXE
delref %SystemDrive%\USERS\UPDATUSUSER\APPDATA\ROAMING\MAIL.RU\AGENT\MAGENT.EXE
delref {8DCB7100-DF86-4384-8842-8FA844297B3F}\[CLSID]
delref {D2CE3E00-F94A-4740-988E-03DC2F38C34F}\[CLSID]
delref D:\GAMES\CS 1.5\HL.EXE
;-------------------------------------------------------------
restart
1.1)
У вас серьёзное вирусное заражение системы. 2) Удалите программу: ADGUARD
3) У вас левый не подписанный установщик: C:\USERS\USER\DESKTOP\ESET V12.1.34.0 REPACK BY KPOJIUK\EAV.EIS.ESSP.V12.1.34.0.EXE
3.1) Удалите вашу версию антивируса;
! ( после завершения лечения ) скачайте установщик с официального сайта:
https://www.esetnod32.ru/download/home/commercial/ 4) Установите заплатку безопасности для системы:
MS17-010
Microsoft Security Bulletin MS17-010 - Critical
Security Update for Microsoft Windows SMB Server (4013389)
Published: March 14, 2017
CVE-2017-0144
https://www.comss.ru/download/page.php?id=4017 https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2017/ms17-010 4.1) После установки заплатки
Нужен лог Tdsskiller
Скачайте tdsskiller отсюда:
http://support.kaspersky.ru/viruses/disinfection/5350 *Лог в будет в корне диска.
Мой компьютер диск С:\
Например: " TDSSKiller.3.6.4.0_28.11.2019_01.39.05_log.txt "
** Если программа найдет файл WINDOWS\system32\Drivers\sptd.sys, то не удаляйте его.
Лог в тему !
