На время выполнения скрипта отключите защитное ПО (антивирус, файрволл). Включите брандмауэр Windows
Выполните скрипт в AVZ
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\twex.exe','');
QuarantineFile('C:\WINDOWS\Temp\BN3.tmp','');
QuarantineFile('trinf32.dll','');
QuarantineFile('wqsvlmks.dll','');
QuarantineFile('C:\Documents and Settings\XXL\XXL.exe','');
QuarantineFile('C:\Documents and Settings\XXL\.exe','');
QuarantineFile('C:\WINDOWS\System32\drivers\tcpsr.sys','');
DeleteService('tcpsr');
StopService('ati6nsxx');
DeleteService('ati6nsxx');
QuarantineFile('C:\WINDOWS\system32\Drivers\ati6nsxx.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\amd64si.sys','');
QuarantineFile('C:\WINDOWS\system32\trinf32.dll','');
TerminateProcessByName('c:\documents and settings\xxl\xxl.exe');
QuarantineFile('c:\documents and settings\xxl\xxl.exe','');
DeleteFile('c:\documents and settings\xxl\xxl.exe');
DeleteFile('C:\WINDOWS\system32\trinf32.dll');
DeleteFile('C:\WINDOWS\system32\drivers\amd64si.sys');
BC_DeleteFile('C:\WINDOWS\system32\drivers\amd64si.sys');
DeleteFile('C:\WINDOWS\system32\Drivers\ati6nsxx.sys');
DeleteFile('C:\WINDOWS\System32\drivers\tcpsr.sys');
DeleteFile('C:\Documents and Settings\XXL\.exe');
DeleteFile('C:\Documents and Settings\XXL\XXL.exe');
DeleteFile('wqsvlmks.dll');
DeleteFile('trinf32.dll');
DeleteFile('C:\WINDOWS\Temp\BN3.tmp');
DeleteFile('C:\WINDOWS\system32\twex.exe');
DelBHO('{C2C3339C-2559-4b81-B9EF-CBAF906D5DA2}');
BC_ImportDeletedList;
ExecuteSysClean;
BC_DeleteFile('C:\WINDOWS\system32\Drivers\ati6nsxx.sys');
BC_DeleteSvc('tcpsr');
BC_DeleteSvc('ati6nsxx');
BC_Activate;
RebootWindows(true);
end.
Компьютер перезагрузится
Выполните скрипт в AVZ
Код:
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
quarantine.zip из папки AVZ отправьте на thyrex2002@tut.by. В теле письма укажите ссылку на тему
Пофиксить в HiJack
Код:
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: MS extension - {C2C3339C-2559-4b81-B9EF-CBAF906D5DA2} - trinf32.dll (file missing)
O4 - HKCU\..\Run: [XXL] C:\Documents and Settings\XXL\XXL.exe /i
O4 - HKCU\..\Run: [] C:\Documents and Settings\XXL\.exe /i
O20 - Winlogon Notify: wqsvlmks - wqsvlmks.dll (file missing)
Ваш провайдер?
Код:
org-name: UkrTeleGroup Ltd.
address: UkrTeleGroup Ltd.
address: Mechnikova 58/5 65029 Odessa
Если нет, то в добавок к приведенному выше нужно пофиксить в HiJack
Код:
O17 - HKLM\System\CCS\Services\Tcpip\..\{2EC85DF5-566A-4290-8C64-C61470558850}: NameServer = 85.255.115.117,85.255.112.184
O17 - HKLM\System\CCS\Services\Tcpip\..\{2FCA64DA-9EF8-49FC-9022-59C8C2E8352F}: NameServer = 82.207.66.242 82.207.66.249
O17 - HKLM\System\CCS\Services\Tcpip\..\{555DB3D7-FDB3-491E-8B23-C279E532F635}: NameServer = 85.255.115.117,85.255.112.184
O17 - HKLM\System\CCS\Services\Tcpip\..\{5E689111-5AE9-4155-A8A8-C95ADD154F73}: NameServer = 85.255.115.117,85.255.112.184
O17 - HKLM\System\CCS\Services\Tcpip\..\{E843F558-6350-496A-905B-822783D97111}: NameServer = 85.255.115.117,85.255.112.184
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{2EC85DF5-566A-4290-8C64-C61470558850}: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS2\Services\Tcpip\..\{2EC85DF5-566A-4290-8C64-C61470558850}: NameServer = 85.255.115.117,85.255.112.184
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
O17 - HKLM\System\CS3\Services\Tcpip\..\{2EC85DF5-566A-4290-8C64-C61470558850}: NameServer = 85.255.115.117,85.255.112.184
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.39,85.255.112.40
Повторите логи |
