Trojan-Downloader.Win32.Mutant.aze

[canr]

Не могу разобраться

[Rene-gad]

Скачайте IceSword , поищите и скопируйте файлы:

C:\WINDOWS\system32\WinCtrl32.dll
C:\WINDOWS\system32\WinCtrl32.bak
C:\WINDOWS\system32\WinCtrl32.dl_

Скопированные с помощью IceSword файлы сохраните в карантине (Приложение 2 правил).
Потом удалите их с помощью force delete
Если Вы какие-то файлы не обнаружите - переходите к следующему шагу.

Отключите
- ПК от интернета/локалки
- Антивирус и Файрвол.
- Системное восстановление.


- Выполните скрипт

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteService('Wintg33');
 DeleteService('Winsu25');
 DeleteService('Winsg55');
 DeleteService('Winqr11');
 DeleteService('Winpq88');
 DeleteService('Winpp11');
 DeleteService('Winpf88');
 DeleteService('Winoq33');
 DeleteService('Winop03');
 DeleteService('Winno58');
 DeleteService('Winlb30');
 DeleteService('Winlb25');
 DeleteService('Winkv33');
 DeleteService('Winkm00');
 DeleteService('Winij06');
 DeleteService('Winhj66');
 DeleteService('Wingt47');
 DeleteService('Wings82');
 DeleteService('Winft85');
 DeleteService('Winec85');
 DeleteService('Winde00');
 DeleteService('Wincd60');
 DeleteService('Winbt25');
 DeleteService('Winbq47');
 DeleteService('Winbp55');
 DeleteService('Winac82');
 DeleteService('Winac58');
 DeleteService('Winab22');
 DeleteService('AlerterRDSessMgr');
 DeleteService('AppMgmtMessenger');
 DeleteService('AudioSrvUPS');
 DeleteService('AVPFastUserSwitchingCompatibility');
 DeleteService('COMSysAppRDSessMgr');
 DeleteService('CryptSvcRDSessMgr');
 DeleteService('CryptSvcwinmgmt');
 DeleteService('DcomLaunchSpooler');
 DeleteService('ERSvcVSS');
 DeleteService('LmHostsImapiService');
 DeleteService('MSIServerLmHosts');
 DeleteService('MSIServerMSDTC');
 DeleteService('MSIServerSSDPSRV');
 DeleteService('MSIServerTrkWks');
 DeleteService('NetDDEERSvcVSS');
 DeleteService('NetDDEwinmgmtCOMSysAppwscsvc');
 DeleteService('NetmanSCardSvr');
 DeleteService('NtLmSspupnphost');
 DeleteService('PolicyAgentWebClient');
 DeleteService('RasAutoWmdmPmSN');
 DeleteService('RasManSwPrv');
 DeleteService('RasManSwPrvEventlog');
 DeleteService('RasManTermService');
 DeleteService('RemoteRegistryVSS');
 DeleteService('Schedulewuauserv');
 DeleteService('ShellHWDetectionTermService');
 DeleteService('srserviceNla');
 DeleteService('srserviceNlaSysmonLogVSSNetman');
 DeleteService('SysmonLogVSSNetman');
 DeleteService('UPSDhcp');
 DeleteService('UPSRasMan');
 DeleteService('VSSNetman');
 DeleteService('winmgmtCOMSysApp');
 DeleteService('winmgmtCOMSysAppwscsvc');
 DeleteService('WmiApSrvRpcSs');
 DeleteService('wuauservSysmonLog');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winab22.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winac58.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winac82.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winbp55.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winbq47.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winbt25.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wincd60.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winde00.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winec85.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winft85.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wings82.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wingt47.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winhj66.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winij06.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winkm00.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winkv33.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winlb25.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winlb30.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winno58.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winop03.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winoq33.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winpf88.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winpp11.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winpq88.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winqr11.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winsg55.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winsu25.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wintg33.sys','');
 QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
 QuarantineFile('c:\windows\system32\lphc9lsj0ej63.exe','');
 DeleteFile('c:\windows\system32\lphc9lsj0ej63.exe');
 DeleteFile('C:\WINDOWS\system32\blphc9lsj0ej63.scr');
 DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wintg33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winsu25.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winsg55.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winqr11.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winpq88.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winpp11.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winpf88.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winoq33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winop03.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winno58.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winlb30.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winlb25.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winkv33.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winkm00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winij06.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winhj66.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wingt47.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wings82.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winft85.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winec85.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winde00.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wincd60.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winbt25.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winbq47.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winbp55.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winac82.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winac58.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winab22.sys');
 DeleteFile('C:\WINDOWS\system32\lphc9lsj0ej63.exe');
BC_ImportAll;
ExecuteSysClean; 
 BC_DeleteSvc('Wintg33');
 BC_DeleteSvc('Winsu25');
 BC_DeleteSvc('Winsg55');
 BC_DeleteSvc('Winqr11');
 BC_DeleteSvc('Winpq88');
 BC_DeleteSvc('Winpp11');
 BC_DeleteSvc('Winpf88');
 BC_DeleteSvc('Winoq33');
 BC_DeleteSvc('Winop03');
 BC_DeleteSvc('Winno58');
 BC_DeleteSvc('Winlb30');
 BC_DeleteSvc('Winlb25');
 BC_DeleteSvc('Winkv33');
 BC_DeleteSvc('Winkm00');
 BC_DeleteSvc('Winij06');
 BC_DeleteSvc('Winhj66');
 BC_DeleteSvc('Wingt47');
 BC_DeleteSvc('Wings82');
 BC_DeleteSvc('Winft85');
 BC_DeleteSvc('Winec85');
 BC_DeleteSvc('Winde00');
 BC_DeleteSvc('Wincd60');
 BC_DeleteSvc('Winbt25');
 BC_DeleteSvc('Winbq47');
 BC_DeleteSvc('Winbp55');
 BC_DeleteSvc('Winac82');
 BC_DeleteSvc('Winac58');
 BC_DeleteSvc('Winab22');
 BC_DeleteSvc('AlerterRDSessMgr');
 BC_DeleteSvc('AppMgmtMessenger');
 BC_DeleteSvc('AudioSrvUPS');
 BC_DeleteSvc('AVPFastUserSwitchingCompatibility');
 BC_DeleteSvc('COMSysAppRDSessMgr');
 BC_DeleteSvc('CryptSvcRDSessMgr');
 BC_DeleteSvc('CryptSvcwinmgmt');
 BC_DeleteSvc('DcomLaunchSpooler');
 BC_DeleteSvc('ERSvcVSS');
 BC_DeleteSvc('LmHostsImapiService');
 BC_DeleteSvc('MSIServerLmHosts');
 BC_DeleteSvc('MSIServerMSDTC');
 BC_DeleteSvc('MSIServerSSDPSRV');
 BC_DeleteSvc('MSIServerTrkWks');
 BC_DeleteSvc('NetDDEERSvcVSS');
 BC_DeleteSvc('NetDDEwinmgmtCOMSysAppwscsvc');
 BC_DeleteSvc('NetmanSCardSvr');
 BC_DeleteSvc('NtLmSspupnphost');
 BC_DeleteSvc('PolicyAgentWebClient');
 BC_DeleteSvc('RasAutoWmdmPmSN');
 BC_DeleteSvc('RasManSwPrv');
 BC_DeleteSvc('RasManSwPrvEventlog');
 BC_DeleteSvc('RasManTermService');
 BC_DeleteSvc('RemoteRegistryVSS');
 BC_DeleteSvc('Schedulewuauserv');
 BC_DeleteSvc('ShellHWDetectionTermService');
 BC_DeleteSvc('srserviceNla');
 BC_DeleteSvc('srserviceNlaSysmonLogVSSNetman');
 BC_DeleteSvc('SysmonLogVSSNetman');
 BC_DeleteSvc('UPSDhcp');
 BC_DeleteSvc('UPSRasMan');
 BC_DeleteSvc('VSSNetman');
 BC_DeleteSvc('winmgmtCOMSysApp');
 BC_DeleteSvc('winmgmtCOMSysAppwscsvc');
 BC_DeleteSvc('WmiApSrvRpcSs');
 BC_DeleteSvc('wuauservSysmonLog');
BC_Activate;
RebootWindows(true);
end.

После перезагрузки:
- Очистите темп-папки, кэш проводников и корзину.
- Закройте все программы, включая Антивирус и Файрвол, Оставьте запущенным только Internet Explorer. Если он не запущен - запустите!!!
- Сделайте повторные логи по правилам.
- Включите Антвирус и Файрволл
- Подключите ПК к интернету/локалке
- Закачайте карантин по ссылке Прислать запрошенный карантин вверху темы (Приложение 3 правил).
- Прикрепите логи к новому сообщению.