вирус WIN32/WIGON.CK ТРОЯН

[doublew]

Постоянно нортоном блокируются кикие то исходящие письма, переодически некоторые файлы перемещаются в карантин
Вот логи

[V_Bond]

выполните скрипт ...

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 BC_DeleteSvc('Windi38');
 BC_DeleteSvc('MaxAntiSpyFilter');
 BC_DeleteSvc('xmlprovPlugPlay');
 BC_DeleteSvc('wscsvcAlerter');
 BC_DeleteSvc('WmiSharedAccess');
 BC_DeleteSvc('WmiRasAuto');
 BC_DeleteSvc('WmiNtmsSvc');
 BC_DeleteSvc('WebClient LM Service');
 BC_DeleteSvc('TrkWksPlugPlayAudioSrv');
 BC_DeleteSvc('ThemesHTTPFilter');
 BC_DeleteSvc('SysmonLogSSDPSRV');
 BC_DeleteSvc('stisvcSamSs');
 BC_DeleteSvc('SSDPSRVWmiNtmsSvc');
 BC_DeleteSvc('seclogonclr_optimization_v2.0.50727_32');
 BC_DeleteSvc('ScheduleRSVP');
 BC_DeleteSvc('ScheduleRDSessMgr');
 BC_DeleteSvc('RpcSsNetmanWmiNtmsSvc');
 BC_DeleteSvc('RasManBrowser');
 BC_DeleteSvc('RasAutoNtLmSsp');
 BC_DeleteSvc('NetmanWmiNtmsSvc');
 BC_DeleteSvc('NetlogonClipSrv');
 BC_DeleteSvc('NetDDEdsdmdmadmin');
 BC_DeleteSvc('NBServiceDcomLaunch');
 BC_DeleteSvc('FastUserSwitchingCompatibilityxmlprov');
 BC_DeleteSvc('Dhcpupnphost');
 BC_DeleteSvc('CiSvc LM Service');
 BC_DeleteSvc('aspnet_stateWmiNtmsSvc');
 QuarantineFile('srv.exe','');
 BC_DeleteSvc('aspnet_stateBrowser');
 BC_DeleteSvc('aspnet_stateAudioSrv');
 BC_DeleteSvc('AppMgmthelpsvc');
 BC_DeleteSvc('ALG LM Service');
 BC_DeleteSvc('AlerterDhcp');
 QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
 DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 DeleteFile('srv.exe');
 DeleteFile('C:\WINDOWS\System32\Drivers\Windi38.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winrw61.sys');
 DeleteFile('WinCtrl32.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

пришлите карантин согласно приложения 3 правил ....
повторите логи ...