Запустите OTL. Скопируйте ниже написанный скрипт в окно
Custom Scans/Fixes и нажмите кнопку
Run Fix
Код:
:OTL
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://webalta.ru
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://webalta.ru/poisk
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://webalta.ru/poisk
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://webalta.ru
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://webalta.ru/poisk
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://webalta.ru
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://webalta.ru/poisk
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://webalta.ru/poisk
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://webalta.ru
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://webalta.ru/poisk
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://webalta.ru
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://webalta.ru/poisk
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://webalta.ru/poisk
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://webalta.ru
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://webalta.ru/poisk
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://webalta.ru
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://webalta.ru/poisk
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://webalta.ru/poisk
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://webalta.ru
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://webalta.ru/poisk
O33 - MountPoints2\{131c825e-9ba8-11dc-b1a8-001bfc8893c3}\Shell\Auto\command - "" = F:\sal.xls.exe
O33 - MountPoints2\{131c825e-9ba8-11dc-b1a8-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{1761e0be-dfd3-11dc-b2df-001bfc8893c3}\Shell\Auto\command - "" = G:\sal.xls.exe
O33 - MountPoints2\{1761e0be-dfd3-11dc-b2df-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{3a8a363a-9ceb-11dc-b1ad-001bfc8893c3}\Shell\Auto\command - "" = F:\sal.xls.exe
O33 - MountPoints2\{3a8a363a-9ceb-11dc-b1ad-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{5a6bb3a1-764a-11dc-b0ed-001bfc8893c3}\Shell - "" = AutoRun
O33 - MountPoints2\{5a6bb3a1-764a-11dc-b0ed-001bfc8893c3}\Shell\AutoRun\command - "" = E:\Autorun.exe
O33 - MountPoints2\{693d44a5-7353-11dc-b0dd-001bfc8893c3}\Shell - "" = AutoRun
O33 - MountPoints2\{693d44a5-7353-11dc-b0dd-001bfc8893c3}\Shell\AutoRun\command - "" = E:\
O33 - MountPoints2\{89b2418a-4c1d-11dd-b49c-e7a6bca9c3b3}\Shell\AutoRun\command - "" = E:\qlwhor.exe
O33 - MountPoints2\{89b2418a-4c1d-11dd-b49c-e7a6bca9c3b3}\Shell\explore\Command - "" = E:\qlwhor.exe
O33 - MountPoints2\{89b2418a-4c1d-11dd-b49c-e7a6bca9c3b3}\Shell\open\Command - "" = E:\qlwhor.exe
O33 - MountPoints2\{89b2418c-4c1d-11dd-b49c-e7a6bca9c3b3}\Shell\Auto\command - "" = F:\sal.xls.exe
O33 - MountPoints2\{89b2418c-4c1d-11dd-b49c-e7a6bca9c3b3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{9556da6c-7e52-11dc-b112-001bfc8893c3}\Shell\Auto\command - "" = G:\sal.xls.exe
O33 - MountPoints2\{9556da6c-7e52-11dc-b112-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{9556da6d-7e52-11dc-b112-001bfc8893c3}\Shell\Auto\command - "" = H:\sal.xls.exe
O33 - MountPoints2\{9556da6d-7e52-11dc-b112-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{99b831f4-993d-11dc-b19d-001bfc8893c3}\Shell\Auto\command - "" = F:\sal.xls.exe
O33 - MountPoints2\{99b831f4-993d-11dc-b19d-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{cf5501ea-cf64-11dc-b2a1-001bfc8893c3}\Shell\Auto\command - "" = F:\sal.xls.exe
O33 - MountPoints2\{cf5501ea-cf64-11dc-b2a1-001bfc8893c3}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
O33 - MountPoints2\{df275920-58ac-11dd-b4c7-ce000837ce36}\Shell\Auto\command - "" = F:\sal.xls.exe
O33 - MountPoints2\{df275920-58ac-11dd-b4c7-ce000837ce36}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe
@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DAF83BD
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BF14D50A
:Files
autorun.inf /alldrives
recycler /alldrives
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
[CREATERESTOREPOINT]
[emptyflash]
[Reboot]
Внимание! Компьютер перезагрузится!
Прикрепите полученный лог к вашему сообщению.
• Выполните скрипт AVZ
Код:
begin
ExecuteRepair(7);
end.
