Внимание. Восстановление баз 1С7, 1C8 и Mssql после атаки шифровальщика, подробности и отзывы читайте в профильной теме.
begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('C:\Users\User\AppData\Local\appdater\Appdater.exe','');
QuarantineFile('C:\Users\User\AppData\Local\yaoffer50160\yaoffer50160.exe','');
QuarantineFile('c:\users\user\appdata\local\appdater\appdater.exe','');
DeleteFile('c:\users\user\appdata\local\appdater\appdater.exe','32');
DeleteFile('C:\Users\User\AppData\Local\yaoffer50160\yaoffer50160.exe','64');
DeleteFile('C:\Users\User\AppData\Local\appdater\Appdater.exe','64');
RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\yaoffer50160','x64');
DeleteSchedulerTask('Appdater_tray.job');
DeleteSchedulerTask('Appdater_tray');
BC_Activate;
ExecuteSysClean;
ExecuteWizard('SCU', 2, 3, true);
BC_ImportALL;
RebootWindows(true);
end.begin
DeleteFile(GetAVZDirectory+'quarantine.7z');
ExecuteFile(GetAVZDirectory+'7za.exe', 'a -mx9 -pmalware quarantine .\Quarantine\*', 1, 300000, false);
end.O22 - Task: (disabled) CCleaner Update - C:\Program Files\CCleaner\CCUpdate.exe (file missing)
O22 - Task: (disabled) CCleanerSkipUAC - C:\Program Files\CCleaner\CCleaner.exe $(Arg0) (file missing)Start::
CreateRestorePoint:
GroupPolicy: Restriction ? <==== ATTENTION
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => -> No File
ContextMenuHandlers1: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
ContextMenuHandlers3: [{4A7C4306-57E0-4C0C-83A9-78C1528F618C}] -> {4A7C4306-57E0-4C0C-83A9-78C1528F618C} => -> No File
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => -> No File
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> No File
ContextMenuHandlers6: [BriefcaseMenu] -> {85BBD920-42A0-1069-A2E4-08002B30309D} => -> No File
FirewallRules: [UDP Query User{A8D7AD29-FF02-4150-9E7E-A1857B6FD85C}D:\games\wotlauncher.exe] => (Allow) D:\games\wotlauncher.exe No File
FirewallRules: [TCP Query User{C7D5004B-C027-4DDE-8404-1EF4745FE494}D:\games\wotlauncher.exe] => (Allow) D:\games\wotlauncher.exe No File
FirewallRules: [{D59311E0-5C05-4F9C-AD7B-BB079707468E}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe No File
FirewallRules: [{BEECF486-388A-4D66-B255-8C6FC515CD78}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe No File
FirewallRules: [{F8D259B1-304F-4F7D-8E78-F166557242A4}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe No File
FirewallRules: [{29285952-DF4C-4498-B498-7C4B0D395928}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe No File
FirewallRules: [{9B7433E3-87CF-4765-9B76-9E80778FC437}] => (Allow) C:\Users\User\AppData\Local\GameCenter\GameCenter.exe No File
FirewallRules: [{7BDAFB3D-576F-4375-96A7-BFE232903B3A}] => (Allow) C:\Users\User\AppData\Local\GameCenter\GameCenter.exe No File
FirewallRules: [{61573B60-51EA-4EB2-A055-6B638979FA63}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe No File
FirewallRules: [{15B4EB25-EAFD-4349-8630-DB255CB97104}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe No File
FirewallRules: [{C98E7D12-FDA0-481E-ADBA-8AE3960E3D15}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe No File
FirewallRules: [{5835971B-0295-410D-AD63-FA95A6128EE8}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe No File
FirewallRules: [{13D46863-6653-42B2-A6A3-49B207879AB4}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin64\Crysis.exe No File
FirewallRules: [{5DF00FEB-B4F5-431A-9951-9E63A540EC9E}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin64\Crysis.exe No File
FirewallRules: [{699AE037-5AFE-4100-9A85-3C47C6D3A0DB}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin64\CrysisDedicatedServer.exe No File
FirewallRules: [{E4178E7E-F3FF-4217-8F20-5E82B6773F61}] => (Allow) C:\Program Files (x86)\Electronic Arts\Crytek\Crysis\Bin64\CrysisDedicatedServer.exe No File
FirewallRules: [{10E1AE19-C0DE-42F0-BC11-590D6D8BA26C}] => (Allow) C:\Users\User\Desktop\Steam.exe No File
FirewallRules: [{B5A01A95-F1C1-4ED2-865D-F2DA181FEAD5}] => (Allow) C:\Users\User\Desktop\Steam.exe No File
FirewallRules: [{2C5AB8CC-8183-44C8-A668-1FDEF82FC0D0}] => (Allow) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{502DE618-CF1B-4BF1-B4A3-5632F2296E33}] => (Allow) D:\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{6AA55593-EF54-4D9A-BE4A-2F6E787CEB85}] => (Allow) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe No File
FirewallRules: [{A9829C33-240C-4282-80E8-896CB880DDF7}] => (Allow) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe No File
FirewallRules: [{E5D7FABE-AA68-4EA7-9CD1-74DF2259796A}] => (Allow) D:\Program Files\Nox\bin\Nox.exe No File
FirewallRules: [{57228AB9-B8FD-4780-8E51-CF9A6007651E}] => (Allow) C:\Program Files (x86)\Bignox\BigNoxVM\RT\NoxVMHandle.exe No File
FirewallRules: [{C752945D-7FDB-41F6-98F0-CBB0FC92304A}] => (Allow) C:\Program Files\BlueStacks\HD-Player.exe No File
FirewallRules: [{592EA06C-BA95-4791-BF99-8E5B9FD0AA0F}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.6.0\DriverBooster.exe No File
FirewallRules: [{D10F021A-E948-4C12-AC72-F6AC97429216}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.6.0\DriverBooster.exe No File
FirewallRules: [{842B7BDA-6BC9-4C26-A5A5-617F9221AA5E}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.6.0\DBDownloader.exe No File
FirewallRules: [{296DF83E-B93B-4346-BD02-922EA1A6AAF7}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.6.0\DBDownloader.exe No File
FirewallRules: [{CB85C9D9-9AB8-4023-8D20-455AA44F0240}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.6.0\AutoUpdate.exe No File
FirewallRules: [{C6369C42-A824-495F-9334-A7351E1AFFDC}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\6.6.0\AutoUpdate.exe No File
FirewallRules: [{CBDBE105-45DD-4313-8B8D-D7A2A16269E5}] => (Allow) C:\Users\User\AppData\Local\MediaGet2\mediaget.exe No File
FirewallRules: [{054A9B95-E375-4B05-81DD-92E31914CBC6}] => (Allow) C:\Users\User\AppData\Local\MediaGet2\mediaget.exe No File
FirewallRules: [{D4BC64B5-D8F7-4E75-B66B-42226E045818}] => (Allow) C:\Users\User\AppData\Local\MediaGet2\mediaget.exe No File
FirewallRules: [{C85AEEC0-236A-4D4E-9125-0A324B385F9F}] => (Allow) C:\Users\User\AppData\Local\MediaGet2\mediaget.exe No File
EmptyTemp:
Reboot:
End::
Вопрос относился к текущему лечению. Что сейчас с проблемой из вашего первого сообщения?
