[решено] Все три машины в сети заражены одной и той же нечестью

Drongo · Конфигурация компьютера

moonis, Привет.

• HiJackThis Нужно пофиксить эти строки в HiJackThis. Выставив галочки напротив этих пунктов и нажмите кнопку Fix Checked. Как пофиксить в HijackThis

Код:

R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - (no file)
O2 - BHO: (no name) - {6D125299-C2A9-4DBC-BEC3-6F7124E39A41} - (no file)
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O9 - Extra button: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - (no file)
O9 - Extra 'Tools' menuitem: Mail.Ru Агент - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - (no file)

• Скрипт AVZ.
Выполните скрипт AVZ. Меню Файл - Выполнить скрипт, вставляем написаный скрипт - кнопка Запустить, после выполнения компьютер перезагрузится.

Код:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('-.exe','');
 DeleteFile('d:\autorun.inf');
 DelBHO('{D4027C7F-154A-4066-A1AD-4243D8127440}');
 DelBHO('{6D125299-C2A9-4DBC-BEC3-6F7124E39A41}');
 DelBHO('{83821C2B-32A8-4DD7-B6D4-44309A78E668}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls','Nero BurnRights');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
 ExecuteRepair(1);
RebootWindows(true);
end.

После всех процедур выполните скрипт

Код:

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

В результате выполнения скрипта будет сформирован карантин quarantine.zip. Полученный архив отправьте на quarantine<at>virusnet.info (at=@) с указанной ссылкой на тему.

, в названии темы укажите - "Проверка карантина". В теле сообщения укажите адрес своей темы на форуме. Результаты ответа, сообщите здесь, в теме.

Повторите логи

moonis · Отправлено: **15:25, 26-11-2010** | #3

пофиксил, скрипты выполнил, письмо написал - пока не ответили...
Логи после проделанного:

zirreX · Конфигурация компьютера

• Выполните скрипт AVZ
Перед выполнением скрипта отключитесь от сети и отключите защитное ПО (антивирус, файрволл)!

AVZ, меню "Файл -> Выполнить скрипт" -> Скопировать ниже написанный
скрипт -> Нажать кнопку "Запустить".

Код:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
 QuarantineFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp',''); 
 QuarantineFile('d:\autorun.inf','');
 QuarantineFile('d:\wumbdu.exe','');
 DeleteFile('d:\wumbdu.exe');
 DeleteFile('d:\autorun.inf');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\appdata\local\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\documents and settings\moonis\local settings\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\appdata\local\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\appdata\local\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\appdata\local\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\application data\temp\~df9d3d06f91b2bd8c5.tmp');
 DeleteFile('c:\users\moonis\local settings\temp\~df045e01d289a4ad9b.tmp');
 DeleteFile('c:\users\moonis\local settings\temp\~df9194ffd9aa190f4d.tmp');
 DeleteFile('c:\users\moonis\local settings\temp\~df9d3d06f91b2bd8c5.tmp');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится!

После перезагрузки выполните такой скрипт

AVZ, меню "Файл -> Выполнить скрипт" -> Скопировать ниже написанный
скрипт -> Нажать кнопку "Запустить".

Код:

begin
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

В результате выполнения скрипта будет сформирован карантин.Отправьте c:\quarantine.zip при помощи этой формы

Повторите логи AVZ + подготовьте лог RSIT

Скачайте Malwarebytes' Anti-Malware или с зеркала, установите, обновите базы, выберите "Perform Full Scan", нажмите "Scan", после сканирования - Ok - Show Results (показать результаты) - Откройте лог и скопируйте в блокнот и прикрепите его к следующему посту.

moonis · mbam-log-2010-11-27 (19-59-22).rar

Fedin,
скрипт всетаки выполнил,
Отослал через предложенную вам форму сегодняшний quarantine.zip и virusinfo_cure.zip.
Логи от AVZ, RSIT и Malwarebytes' Anti-Malware: фух... 4000+

zirreX · Конфигурация компьютера

Ждём.

moonis · Отправлено: **17:16, 27-11-2010** | #7

Malwarebytes' Anti-Malware почикал все 4357 нечистых Trojan.Chydo файла, но после ребута все ребята на месте как ни в чем не бывало

З.ы. там в архивах фотка ранеток... поди сестренка любимая ченить нацепляла... фанатка хренова(

zirreX · Конфигурация компьютера

Цитата moonis:

Malwarebytes' Anti-Malware почикал все 4357 нечистых Trojan.Chydo файла »

Скачайте свежий Dr.Web CureIt и просканируйте компьютер.

C:\1,1) b957z6h4.exe - это что у вас?Не cureit случайно?

Скачайте ComboFix здесь, здесь или здесь и сохраните на рабочий стол.

1. Внимание! Обязательно закройте все браузеры, временно выключите антивирус, firewall и другое защитное программное обеспечение. Не запускайте других программ во время работы Combofix. Combofix может отключить интернет через некоторое время после запуска, не переподключайте интернет пока Combofix не завершит работу. Если интернет не появился после окончания работы Combofix, перезагрузите компьютер. Во время работы Combofix не нажимайте кнопки мыши, это может стать причиной зависания Combofix.
2. Запустите combofix.exe, когда процесс завершится, скопируйте текст из C:\ComboFix.txt и вставьте в следующее сообщение или запакуйте файл C:\ComboFix.txt и прикрепите к сообщению.
Прим: В случае, если ComboFix не запускается, переименуйте combofix.exe в combo-fix.exe

Подробнее в "ComboFix. Руководство по применению."

moonis · Отправлено: **19:22, 27-11-2010** | #9

Цитата Fedin:

C:\1,1) b957z6h4.exe - это что у вас?Не cureit случайно? »

Он самый.
Прогнал еще раз Malwarebytes' Anti-Malware - Зараженные файлы: 488.
Зайти в безопасный так и не удалось (хотя теперь ребутнулся уже на экране приветствия

) - проверяю вэбом так...
...
cureit промолчал
логи ComboFix прилагаю.
Утилита малёх поворотила систему, а назад не вернула(: появились $RECYCLE.BIN, Boot, MSOCache, Config.Msi и т.п.

zirreX · Конфигурация компьютера

Скопируйте текст ниже в блокнот и сохраните как файл с названием CFScript.txt на рабочий стол.

Код:

KillAll::

File::


Driver::

Folder::


Registry::

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\tcpip\parameters\persistentroutes]
"2.94.48.0,255.255.252.0,192.168.1.1,1"=-
"2.94.52.0,255.255.254.0,192.168.1.1,1"=-
"46.30.32.0,255.255.248.0,192.168.1.1,1"=-
"62.68.128.0,255.255.224.0,192.168.1.1,1"=-
"77.106.64.0,255.255.192.0,192.168.1.1,1"=-
"77.235.211.192,255.255.255.248,192.168.1.1,1"=-
"77.245.160.0,255.255.240.0,192.168.1.1,1"=-
"78.136.192.0,255.255.192.0,192.168.1.1,1"=-
"78.139.192.0,255.255.192.0,192.168.1.1,1"=-
"78.140.0.0,255.255.192.0,192.168.1.1,1"=-
"79.122.222.0,255.255.254.0,192.168.1.1,1"=-
"79.136.128.0,255.255.128.0,192.168.1.1,1"=-
"79.175.39.0,255.255.255.128,192.168.1.1,1"=-
"80.72.208.0,255.255.240.0,192.168.1.1,1"=-
"80.89.133.32,255.255.255.224,192.168.1.1,1"=-
"81.1.229.72,255.255.255.248,192.168.1.1,1"=-
"81.1.229.96,255.255.255.224,192.168.1.1,1"=-
"81.1.229.128,255.255.255.128,192.168.1.1,1"=-
"82.117.64.0,255.255.224.0,192.168.1.1,1"=-
"82.117.160.0,255.255.224.0,192.168.1.1,1"=-
"82.200.5.0,255.255.255.224,192.168.1.1,1"=-
"82.200.24.0,255.255.255.192,192.168.1.1,1"=-
"82.200.70.0,255.255.254.0,192.168.1.1,1"=-
"82.200.110.0,255.255.254.0,192.168.1.1,1"=-
"82.200.114.0,255.255.255.224,192.168.1.1,1"=-
"82.200.114.160,255.255.255.224,192.168.1.1,1"=-
"83.172.0.0,255.255.192.0,192.168.1.1,1"=-
"84.237.0.0,255.255.240.0,192.168.1.1,1"=-
"88.204.0.0,255.255.128.0,192.168.1.1,1"=-
"90.188.64.0,255.255.224.0,192.168.1.1,1"=-
"90.188.96.0,255.255.240.0,192.168.1.1,1"=-
"90.188.112.0,255.255.248.0,192.168.1.1,1"=-
"90.189.192.29,255.255.255.255,192.168.1.1,1"=-
"91.193.88.0,255.255.254.0,192.168.1.1,1"=-
"91.210.72.0,255.255.252.0,192.168.1.1,1"=-
"91.210.184.0,255.255.254.0,192.168.1.1,1"=-
"91.211.236.0,255.255.252.0,192.168.1.1,1"=-
"91.217.110.0,255.255.254.0,192.168.1.1,1"=-
"92.63.64.0,255.255.240.0,192.168.1.1,1"=-
"92.125.0.0,255.255.224.0,192.168.1.1,1"=-
"92.126.224.0,255.255.224.0,192.168.1.1,1"=-
"92.243.96.0,255.255.224.0,192.168.1.1,1"=-
"93.91.168.0,255.255.254.0,192.168.1.1,1"=-
"94.28.4.0,255.255.254.0,192.168.1.1,1"=-
"95.170.96.0,255.255.224.0,192.168.1.1,1"=-
"95.170.136.0,255.255.254.0,192.168.1.1,1"=-
"95.170.138.0,255.255.254.0,192.168.1.1,1"=-
"95.170.140.0,255.255.252.0,192.168.1.1,1"=-
"95.170.144.0,255.255.254.0,192.168.1.1,1"=-
"95.170.156.0,255.255.254.0,192.168.1.1,1"=-
"95.174.192.0,255.255.224.0,192.168.1.1,1"=-
"95.191.0.0,255.255.192.0,192.168.1.1,1"=-
"95.191.130.3,255.255.255.255,192.168.1.1,1"=-
"95.191.130.4,255.255.255.255,192.168.1.1,1"=-
"95.191.130.5,255.255.255.255,192.168.1.1,1"=-
"109.123.128.0,255.255.192.0,192.168.1.1,1"=-
"109.124.0.0,255.255.192.0,192.168.1.1,1"=-
"109.202.12.0,255.255.252.0,192.168.1.1,1"=-
"109.227.192.0,255.255.192.0,192.168.1.1,1"=-
"178.213.72.0,255.255.248.0,192.168.1.1,1"=-
"188.65.16.0,255.255.248.0,192.168.1.1,1"=-
"193.106.132.0,255.255.252.0,192.168.1.1,1"=-
"194.226.60.0,255.255.252.0,192.168.1.1,1"=-
"195.211.196.0,255.255.252.0,192.168.1.1,1"=-
"212.73.124.0,255.255.252.0,192.168.1.1,1"=-
"212.107.224.0,255.255.240.0,192.168.1.1,1"=-
"212.107.240.0,255.255.248.0,192.168.1.1,1"=-
"212.192.112.0,255.255.240.0,192.168.1.1,1"=-
"213.183.96.0,255.255.224.0,192.168.1.1,1"=-
"213.210.64.0,255.255.192.0,192.168.1.1,1"=-
"213.228.87.5,255.255.255.255,192.168.1.1,1"=-
"217.8.224.80,255.255.255.240,192.168.1.1,1"=-
"217.8.237.112,255.255.255.240,192.168.1.1,1"=-
"217.18.128.0,255.255.224.0,192.168.1.1,1"=-
"217.29.80.0,255.255.240.0,192.168.1.1,1"=-
"217.70.106.24,255.255.255.255,192.168.1.1,1"=-
"217.70.106.29,255.255.255.255,192.168.1.1,1"=-
"217.70.119.194,255.255.255.255,192.168.1.1,1"=-
"217.106.147.0,255.255.255.240,192.168.1.1,1"=-

FileLook::

DirLook::

Reboot::

После сохранения переместите CFScript.txt на пиктограмму ComboFix.exe.

Когда сохранится новый отчет ComboFix, запакуйте ComboFix.txt и прикрепите к сообщению.