[snifer67]

Выполните скрипт в avz

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
  BC_DeleteFile('c:\windows\temp\934223.exe');
 BC_DeleteFile('c:\windows\tasks\conime.exe');
 BC_DeleteFile('c:\windows\system32\imvnk29y8k\j002.exe');
 BC_DeleteFile('c:\windows\qq.exe');
 BC_DeleteFile('c:\windows\system32\rifhiw.exe');
 BC_DeleteFile('c:\program files\microsoft office\svchost.exe');
 BC_DeleteFile('c:\windows\system32\anitsvstart.dll');
 BC_DeleteFile('C:\WINDOWS\System32\anitsclib.dll');
 BC_DeleteFile('C:\WINDOWS\QQ.exe');
 BC_DeleteFile('c:\windows\system32\bbdydm.dll');
 BC_DeleteFile('c:\windows\system32\bbdydmz.dll');
 DeleteFile('C:\WINDOWS\system32\rifhiw.exe');
 DeleteFile('C:\WINDOWS\system32\FFrrfox2.exe');
 DeleteFile('C:\WINDOWS\system32\IMVNK29Y8K\J002.exe');
 DeleteFile('C:\WINDOWS\system32\IMVNK29Y8K\J001.exe');
 DeleteFile('C:\WINDOWS\system32\sqlserv.exe');
 DeleteFile('C:\WINDOWS\QQ.exe');
 DeleteFile('C:\WINDOWS\Wins.exe');
 DeleteFile('C:\WINDOWS\system32\z\B7878.exe');
 DeleteFile('C:\WINDOWS\system32\rmxdmm.exe');
 DeleteFile('C:\WINDOWS\system32\z\J002.exe');
 DeleteFile('C:\WINDOWS\system32\z\eoo1.exe');
 DeleteFile('C:\WINDOWS\system32\acpi24.sys');
 DeleteFile('C:\DOCUME~1\ALLUSE~1\APPLIC~1\Storm\update\xtiid.dlc');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\irmon\Parameters','ServiceDll');
 DeleteFile('C:\PROGRA~1\Google\huifh.dlc');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\ias\Parameters','ServiceDll');
 BC_DeleteFile('C:\WINDOWS\114\lsass.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','lasst');
 BC_DeleteFile('C:\WINDOWS\system32\anitsvstart.dll');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\AniSrv\Parameters','ServiceDll');
 BC_DeleteFile('C:\WINDOWS\system32\scvhost.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','360Soft');
 BC_DeleteFile('Explorer.exe    C:\WINDOWS\csrsc.exe');
 BC_DeleteFile('c:\windows\qvodv\smss.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','smss');
 DeleteFile('c:\windows\system32\f02359192k.cmd');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SYSTEM\CurrentControlSet\Services\F02359192K\Parameters','ServiceDll');
 BC_DeleteFile('C:\WINDOWS\Windows7\Print32.dll');
 BC_DeleteFile('C:\Program Files\Microsoft Office\svchost.exe');
 BC_DeleteFile('C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CVBLSWRD\F001[1].exe');
 BC_DeleteFile('C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\XNECRRYQ\get[1].zip');
 BC_DeleteFile('C:\WINDOWS\system32\IMVNK29Y8K\F001.exe');
 BC_DeleteFile('c:\windows\system32\imvnk29y8k\j003.exe');
 BC_DeleteFile('C:\WINDOWS\system32\regedit32.exe');
 BC_DeleteFile('C:\WINDOWS\system32\Drivers\pcidump.sys');
BC_ImportDeletedList;
BC_Activate;
ExecuteSysClean;
ExecuteRepair(16);
RebootWindows(true);
end.

ПК перезагрузится.

Выполнить скрипт в AVZ.

var
  qfolder: string;
  qname: string;
begin
  qname := GetAVZDirectory + '..\Quarantine\quarantine.zip';
  qfolder := ExtractFilePath(qname);
  if (not DirectoryExists(qfolder)) then CreateDirectory(qfolder);
  CreateQurantineArchive(qname);
  ExecuteFile('explorer.exe', qfolder, 1, 0, false);
end.

Вы увидите папку с архивом. Это - карантин.
quarantine.zip из папки AVZ отправьте на snifer67@tut.by
Сделайте новые логи.