Подозрение на вирус

[spirit207]

сегодня после серфа по инету словил виря , аваст руганулся но не удалил... дальнейшее лечение авастом ничего не дало.. вот требуемые логи..

[Гриша]

Интересно по каким помойкам вы лазили?

Отключите восстановление системы,антивирус и интернет!

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 TerminateProcessByName('c:\documents and settings\all users\application data\fohkdczi\bcdqreri.exe');
 TerminateProcessByName('36DC.tmp');
 TerminateProcessByName('c:\winnt\system32\lwnkbgdg.exe');
 TerminateProcessByName('c:\winnt\taskmon.exe');
 TerminateProcessByName('c:\winnt\temp\severa.exe');     
 TerminateProcessByName('c:\winnt\temp\istst.exe');
 TerminateProcessByName('c:\winnt\system32\hurm618.exe');
 TerminateProcessByName('c:\documents and settings\spirit1\Избранное\ie_updates3r.exe');     
 TerminateProcessByName('c:\winnt\temp\19.tmp');
 TerminateProcessByName('c:\winnt\winlogon.exe');
 TerminateProcessByName('c:\winnt\system32\vedxga1me4t1.exe');
 TerminateProcessByName('c:\winnt\totacon.exe');     
 TerminateProcessByName('c:\winnt\system32\vedxg6ame4.exe');     
 SetServiceStart('Google Online Services', 4);
 StopService('Google Online Services');    
 QuarantineFile('C:\WINNT\winlogon.exe','');
 QuarantineFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OD8LQLOD\access[1].htm','');
 QuarantineFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\MLEVEZYX\access[2].htm','');
 QuarantineFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\MLEVEZYX\access[1].htm','');
 QuarantineFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\0D81MLCF\pinch2[1].exe','');
 QuarantineFile('C:\WINNT\exqb.exe','');
 QuarantineFile('C:\доки\Spirit(Admin)\Local Settings\Temporary Internet Files\Content.IE5\7Z9J3H4W\systemdll[1].exe','');
 QuarantineFile('C:\доки\Spirit(Admin)\Local Settings\Temp\594D.tmp','');
 QuarantineFile('c:\winnt\vbksrofa.dll','');
 QuarantineFile('C:\WINNT\TEMP\ac8zt2\pvnsmfor.dll','');
 QuarantineFile('C:\WINNT\fvowketqonp.dll','');
 QuarantineFile('ljJCrqRL.dll','');
 QuarantineFile('C:\WINNT\system32\wind32.exe','');
 QuarantineFile('C:\WINNT\system32\qtplugin.exe','');
 QuarantineFile('C:\WINNT\system32\maxpaynow1.exe','');
 QuarantineFile('C:\WINNT\svchost.exe','');
 QuarantineFile('C:\WINNT\mrofinu27.exe','');
 QuarantineFile('C:\Documents and Settings\All Users\Application Data\fohkdczi\bcdqreri.exe','');
 QuarantineFile('C:\Documents and Settings\Default User\cftmon.exe','');
 QuarantineFile('C:\WINNT\system32\drivers\qandr.sys','');
 QuarantineFile('C:\WINNT\system32\drivers\spools.exe','');
 QuarantineFile('C:\WINNT\system32\adptifl.exe','');
 QuarantineFile('C:\WINNT\win32ole.dll','');
 QuarantineFile('C:\WINNT\vbksrofa.dll','');
 QuarantineFile('36DC.tmp','');     
 QuarantineFile('C:\WINNT\system32\Заставка КАНАЛЫr.dll','');
 QuarantineFile('C:\WINNT\system32\wm1dap.dll','');
 QuarantineFile('C:\WINNT\system32\tuvSkkjG.dll','');
 QuarantineFile('C:\WINNT\system32\mylfdnqc.dll','');
 QuarantineFile('C:\WINNT\system32\lwnkbgdg.exe','');
 QuarantineFile('C:\WINNT\system32\ljJCrqRL.dll','');
 QuarantineFile('C:\WINNT\system32\hurm618.exe','');
 QuarantineFile('C:\WINNT\system32\ftpdll.dll','');
 QuarantineFile('C:\WINNT\mpfanvqg.dll','');
 QuarantineFile('c:\winnt\winlogon.exe','');
 QuarantineFile('c:\winnt\system32\vedxga1me4t1.exe','');
 QuarantineFile('c:\winnt\system32\vedxg6ame4.exe','');
 QuarantineFile('c:\winnt\totacon.exe','');
 QuarantineFile('c:\winnt\taskmon.exe','');
 QuarantineFile('c:\winnt\temp\severa.exe','');
 QuarantineFile('c:\winnt\system32\lwnkbgdg.exe','');
 QuarantineFile('c:\winnt\temp\istst.exe','');
 QuarantineFile('c:\documents and settings\spirit1\Избранное\ie_updates3r.exe','');
 QuarantineFile('c:\winnt\system32\hurm618.exe','');
 QuarantineFile('c:\documents and settings\all users\application data\fohkdczi\bcdqreri.exe','');
 QuarantineFile('c:\winnt\temp\19.tmp','');
 QuarantineFile('c:\winnt\17pholmes27.exe','');
 DeleteService('Schedule');
 DeleteService('qandr');
 DeleteService('MSIServeraswUpdSv');
 DeleteService('Google Online Services');      
 DeleteFile('c:\winnt\17pholmes27.exe');
 DeleteFile('c:\winnt\temp\19.tmp');
 DeleteFile('36DC.tmp');
 DeleteFile('c:\documents and settings\all users\application data\fohkdczi\bcdqreri.exe');
 DeleteFile('c:\winnt\system32\hurm618.exe');
 DeleteFile('c:\documents and settings\spirit1\Избранное\ie_updates3r.exe');
 DeleteFile('c:\winnt\temp\istst.exe');
 DeleteFile('c:\winnt\system32\lwnkbgdg.exe');
 DeleteFile('c:\winnt\temp\severa.exe');
 DeleteFile('c:\winnt\taskmon.exe');
 DeleteFile('c:\winnt\totacon.exe');
 DeleteFile('c:\winnt\system32\vedxg6ame4.exe');
 DeleteFile('c:\winnt\system32\vedxga1me4t1.exe');
 DeleteFile('c:\winnt\winlogon.exe');
 DeleteFile('C:\WINNT\mpfanvqg.dll');
 DeleteFile('C:\WINNT\system32\ftpdll.dll');
 DeleteFile('C:\WINNT\system32\hurm618.exe');
 DeleteFile('C:\WINNT\system32\ljJCrqRL.dll');
 DeleteFile('C:\WINNT\system32\lwnkbgdg.exe');
 DeleteFile('C:\WINNT\system32\mylfdnqc.dll');
 DeleteFile('C:\WINNT\system32\tuvSkkjG.dll');
 DeleteFile('C:\WINNT\system32\wm1dap.dll');
 DeleteFile('C:\WINNT\system32\Заставка КАНАЛЫr.dll');
 DeleteFile('C:\WINNT\vbksrofa.dll');
 DeleteFile('C:\WINNT\win32ole.dll');
 DeleteFile('C:\WINNT\system32\adptifl.exe');
 DeleteFile('C:\WINNT\system32\drivers\spools.exe');
 DeleteFile('C:\WINNT\system32\drivers\qandr.sys');
 DeleteFile('C:\Documents and Settings\Default User\cftmon.exe');
 DeleteFile('C:\Documents and Settings\All Users\Application Data\fohkdczi\bcdqreri.exe');
 DeleteFile('C:\WINNT\mrofinu27.exe');
 DeleteFile('C:\WINNT\svchost.exe');
 DeleteFile('C:\WINNT\system32\maxpaynow1.exe');
 DeleteFile('C:\WINNT\system32\qtplugin.exe');
 DeleteFile('C:\WINNT\system32\wind32.exe');
 DeleteFile('ljJCrqRL.dll');
 DeleteFile('C:\WINNT\fvowketqonp.dll');
 DeleteFile('C:\WINNT\TEMP\ac8zt2\pvnsmfor.dll');
 DeleteFile('c:\winnt\vbksrofa.dll');
 DeleteFile('C:\доки\Spirit(Admin)\Local Settings\Temp\594D.tmp');
 DeleteFile('C:\доки\Spirit(Admin)\Local Settings\Temporary Internet Files\Content.IE5\7Z9J3H4W\systemdll[1].exe');
 DeleteFile('C:\WINNT\exqb.exe');
 DeleteFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\0D81MLCF\pinch2[1].exe');
 DeleteFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\MLEVEZYX\access[1].htm');
 DeleteFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\MLEVEZYX\access[2].htm');
 DeleteFile('C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OD8LQLOD\access[1].htm');
 DeleteFile('C:\WINNT\winlogon.exe');
 DelBHO('{E738884B-E75D-4AC3-B03F-62F7E7DD853E}');
 DelBHO('{89A9CC26-4818-4FFD-82E0-9C3CF815FEB2}');
 DelBHO('{5874B483-42D1-42AB-B5CA-6BD391EFEA69}');     
 BC_ImportALL;  
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится.
Прислать карантин согласно приложения 3 правил .
Загружать по ссылке:http://virusinfo.info/upload_virus.php?tid=22928

Очистите временные папки,кеш браузера и повторите логи.