Вот набросал инструкцию по удалению пока сканировалась одна из зараженных машин. Есть только на английском — столько времени потратил на лечение, теперь некогда переводить.
1. Open your C:\users\%username%\AppData\Roaming directory or for WinXP C:\Documents and Settings\%username%\Application Data\
2. Find there any suspicious *.exe files
3. Run task manager and try to kill their processes, their names will be the same as in the directory
4. Run msconfig.exe from Run menu and look through Autorun tab, there you should find a program running from the directory located above. In my case it was C:\Documents and Settings\%username%\Application Data\sawkwc.exe (the name could be different in your case). This file won't be visible in explorer even if you see other hidden files. Write down it's exact name somewhere for future use.
5. Now we will need Malwarebytes Free software, but the virus won't let us visit most of antivirus sites. So I googled for Malwarebytes Free and downloaded it from CNET site. You can do it from any trustable software distribution sites.
6. Install Malwarebytes, there may be some errors during installation, that's fine, just skip it by clicking OK.
7. Run Malwarebytes and find tab with Others functions, run FileASSASIN from there and delete all *.exe files form the root of directory above. Now we have one final step to delete that single superhidden file. Open FileASSASIN once again and go to the directory there may be no files shown, but you just type its name in and it will be found and vanished by the software.
8. Reboot. Download Everything software from Voidtools website. Search for the virus file by typing it's name in searchbox. If all was ok it won't show any files with this name.
9. Go to www.eset.com/home/products/online-scanner/ from IE and run online scan. If eset.com can not be open you threat is still there preventing you from opening antivirus sites. Try to find some other ways.
10. Remember to change all your passwords including Skype password.
1. Open your C:\users\%username%\AppData\Roaming directory or for WinXP C:\Documents and Settings\%username%\Application Data\
2. Find there any suspicious *.exe files
3. Run task manager and try to kill their processes, their names will be the same as in the directory
4. Run msconfig.exe from Run menu and look through Autorun tab, there you should find a program running from the directory located above. In my case it was C:\Documents and Settings\%username%\Application Data\sawkwc.exe (the name could be different in your case). This file won't be visible in explorer even if you see other hidden files. Write down it's exact name somewhere for future use.
5. Now we will need Malwarebytes Free software, but the virus won't let us visit most of antivirus sites. So I googled for Malwarebytes Free and downloaded it from CNET site. You can do it from any trustable software distribution sites.
6. Install Malwarebytes, there may be some errors during installation, that's fine, just skip it by clicking OK.
7. Run Malwarebytes and find tab with Others functions, run FileASSASIN from there and delete all *.exe files form the root of directory above. Now we have one final step to delete that single superhidden file. Open FileASSASIN once again and go to the directory there may be no files shown, but you just type its name in and it will be found and vanished by the software.
8. Reboot. Download Everything software from Voidtools website. Search for the virus file by typing it's name in searchbox. If all was ok it won't show any files with this name.
9. Go to www.eset.com/home/products/online-scanner/ from IE and run online scan. If eset.com can not be open you threat is still there preventing you from opening antivirus sites. Try to find some other ways.
10. Remember to change all your passwords including Skype password.
но вообще движение, думаю, должно принести пользу.