Цитата:
Сообщение от marina.s.ivanov
отчет прилагаю.
|
выполняем скрипт в uVS
- скопировать содержимое кода в буфер обмена;
- стартуем uVS(start.exe), далее выбираем: текущий пользователь, меню - скрипты - выполнить скрипт из буфера обмена;
- закрываем все браузеры перед выполнением скрипта;
при деинсталляции программ - соглашаемся на деинсталляцию_удаление подтверждаем "да"
Код:
;uVS v3.87.7 [http://dsrt.dyndns.org]
;Target OS: NTv6.1
OFFSGNSAVE
zoo %SystemDrive%\USERS\USER\APPDATA\ROAMING\IMAGE EDITOR PACKAGES\UNINSTALLER.EXE
addsgn A7679B19919AF4468194AE59313DEDFA258AFCF689FA1F7885C3C5BC50D6714C2317C3573E559D492B80849F461649FA7DDFE87255DAB02C2D77A42FC7062273 9 Win32/InstallCore.AZ
;------------------------autoscript---------------------------
chklst
delvir
deldirex %SystemDrive%\PROGRAM FILES (X86)\ANYPROTECTEX
deldirex %SystemDrive%\USERS\USER\APPDATA\ROAMING\PENNYBEE\UPDATE~1
deldirex %SystemDrive%\USERS\USER\APPDATA\ROAMING\MYSTARTSEARCH
deldirex %SystemDrive%\PROGRAM FILES (X86)\XTAB
delref %SystemDrive%\PROGRAM FILES (X86)\АУДИО И ВИДЕО СКАЧИВАНИЕ\IE\X86\DOWNLOADER.DLL
delref %SystemDrive%\USERS\USER\APPDATA\LOCAL\MAIL.RU\SPUTNIK\IESEARCHPLUGIN.DLL
delref %SystemDrive%\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WINDOWS LIVE\WINDOWSLIVELOGIN.DLL
delref %SystemDrive%\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\WINDOWS LIVE\WINDOWSLIVELOGIN.DLL
delref {D5FEC983-01DB-414A-9456-AF95AC9ED7B5}\[CLSID]
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DAMINLPMKFCDIBGPGFAJLGNAMICJCKKJF%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DBGCIFLJFAPBHGIEHKJLCKFJMGEOJIJCB%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DCCFIFBOJENKENPKMNBNNDEADPFDIFFOF%26INSTALLSOURCE%3DONDEMAND%26UC
deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIABUZZV1\MEDIABUZZV1MODE7521\CH
deldirex %SystemDrive%\PROGRAM FILES (X86)\WEBEXPENHANCEDV1\WEBEXPENHANCEDV1ALPHA552\CH
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DGEHNGEIFMELPHPLLNCOBKMIMPHFKCKNE%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DJDKIHDHLEGCDGGKNOKFEKOEMKJJNJHGI%26INSTALLSOURCE%3DONDEMAND%26UC
deldirex %SystemDrive%\PROGRAM FILES (X86)\RICHMEDIAVIEWV1\RICHMEDIAVIEWV1RELEASE86\CH
delref HTTP://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DMDELDJOLAMFBCGNNDJMJJIINNHBNBNLA%26INSTALLSOURCE%3DONDEMAND%26UC
deldirex %SystemDrive%\PROGRAM FILES (X86)\MEDIAWATCHV1\MEDIAWATCHV1HOME1348\CH
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOELPKEPJLGMEHAJEHFEICFBJDIOBDKFJ%26INSTALLSOURCE%3DONDEMAND%26UC
delref HTTPS://CLIENTS2.GOOGLE.COM/SERVICE/UPDATE2/CRX?RESPONSE=REDIRECT&PRODVERSION=38.0&X=ID%3DOJLCEBDKBPJDPILIGKDBBKDKFJMCHBFD%26INSTALLSOURCE%3DONDEMAND%26UC
deldirex %SystemDrive%\PROGRAM FILES (X86)\ZAXAR
deldirex %SystemDrive%\PROGRAMDATA\TIMETASKS
delref HTTP://WWW.DELTA-HOMES.COM/?TYPE=HP&TS=1438158938&Z=4B2C338A0732F4B52A2D3DEG6ZECDB8G8WFB9TFC6T&FROM=WPM07173&UID=ST320LT020-9YG142_W045X34JXXXXW045X34J
delref HTTP://WWW.MYSTARTSEARCH.COM/WEB/?TYPE=DS&TS=1422640997&FROM=IMA&UID=ST320LT020-9YG142_W045X34JXXXXW045X34J&Q={SEARCHTERMS}
delref %SystemDrive%\PROGRAM FILES (X86)\IOBIT\IOBIT UNINSTALLER\UNINSTALLEXPLORER64.DLL
delref %Sys32%\IHCTRL32.DLL
delref %Sys32%\WSAUDIO.DLL
delref HTTP://DO-SEARCH.COM/WEB/?UTM_SOURCE=B&UTM_MEDIUM=&UTM_CAMPAIGN=INSTALL_IE&UTM_CONTENT=DS&FROM=&UID=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&TS=1420373293&TYPE=DEFAULT&Q={SEARCHTERMS}
delref HTTP://SEARCH.DELTA-HOMES.COM/WEB/?TYPE=DS&TS=1432167051&Z=373A269D46ED9A3FE224AA3G7Z0C8O1G8Q4MCE0WBE&FROM=WPM05203&UID=ST320LT020-9YG142_W045X34JXXXXW045X34J&Q={SEARCHTERMS}
deldirex %SystemDrive%\USERS\USER\APPDATA\LOCAL\KOMETA\APPLICATION
deldirex %SystemDrive%\PROGRAMDATA\APPDATA\ROAMING\FLVPLAYER
deldirex %SystemDrive%\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\FLVPLAYER
deldirex %SystemDrive%\PROGRAM FILES (X86)\WINZIPPER
; McAfee Security Scan Plus
exec C:\Program Files\McAfee Security Scan\uninstall.exe
; Media Watch
exec C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home1348\uninstall.exe
; Rich Media View
exec C:\Program Files (x86)\RichMediaViewV1\RichMediaViewV1release86\uninstall.exe
deltmp
delnfr
;-------------------------------------------------------------
restart
перезагрузка, пишем о старых и новых проблемах.
----------
далее,
выполните сканирование (угроз) в Malwarebytes