cfdrive32.exe. msvmiode.exe и ещё куча всего.

[vova0084]

помогите пожалуйста справится с вирусом.

[olejah]

Закройте все программы
Отключите
- ПК от интернета/локалки.
- Антивирус и Файрвол
- Системное восстановление

Выполните скрипт в АВЗ -

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 TerminateProcessByName('c:\docume~1\81a4~1\locals~1\temp\298.exe');
 QuarantineFile('c:\docume~1\81a4~1\locals~1\temp\298.exe','');
 DeleteFile('c:\docume~1\81a4~1\locals~1\temp\298.exe');  
 QuarantineFile('C:\RECYCLER\S-1-5-21-4446574796-1154716010-497388860-6475\syscr.exe','');
 DeleteFile('C:\RECYCLER\S-1-5-21-4446574796-1154716010-497388860-6475\syscr.exe');      
 TerminateProcessByName('c:\windows\cfdrive32.exe');
 QuarantineFile('C:\Documents and Settings\ааа\Application Data\ltzqai.exe','');
 QuarantineFile('C:\WINDOWS\system32\msvmiode.exe','');
 QuarantineFile('C:\WINDOWS\cfdrive32.exe','');
 DeleteFile('C:\WINDOWS\cfdrive32.exe');
 DeleteFile('C:\WINDOWS\system32\msvmiode.exe');
 DeleteFile('C:\Documents and Settings\ааа\Application Data\ltzqai.exe');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MSODESNV7');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Driver Setup');
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Driver Setup');      
 DeleteFileMask('c:\docume~1\81a4~1\locals~1\temp','*.*',true);  
 RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');   
 BC_ImportAll;
 ExecuteSysClean;
 ExecuteWizard('TSW',2,2,true);
 BC_Activate;
 RebootWindows(true);
end.

После выполнения скрипта компьютер перезагрузится.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

Пришлите файл quarantine.zip из папки AVZ по ссылке Прислать запрошенный карантин над первым сообщением этой темы.

- Повторите логи

[vova0084]

скрипты выполнил, карантин отослал.

новые логи:

[olejah]

В логах плохого нет. А на деле?

[vova0084]

инет по прежниму тормозит. звук пока не вылитает.

[olejah]

Сделайте лог полного сканирования МВАМ

[vova0084]

сделал

[olejah]

Удалите в МВАМ -

Зараженные папки:
C:\Program Files\VVSN (Adware.WhenU) -> No action taken.
C:\Program Files\VVSN\URL1 (Adware.WhenU) -> No action taken.

Зараженные файлы:
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\xwkuc[1].png (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\ccun[1].png (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\cgyt[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\edxffzm[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\fpqf[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\kdwkwgxy[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\lmevp[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\mtikipc[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\pjqog[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\qjoaq[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\xwkuc[5].png (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\zsihfnxv[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\FKYN5VJ6\qmeoymmc[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\dlkv[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\hbluxyun[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\iuih[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\jbgeqop[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\moixsve[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\omoftcm[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\qskhtrfg[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\xngn[1].png (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\yzwtpab[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\I7S7K5O5\ztnqngjj[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\cxyd[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\ishgh[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\jbgeqop[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\kdabyb[1].png (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\tvgdef[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\xwkuc[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\IIH2BZE0\xwkuc[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\jbgeqop[1].bmp (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\jbgeqop[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\jbgeqop[1].png (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\rqzg[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\svnahuhq[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\xsjowt[1].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\xwkuc[2].jpg (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\Y9DYRXQ1\zwhdhu[1].gif (Extension.Mismatch) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\4WYK419J\474[1].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\4WYK419J\si[1].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\474[1].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\474[2].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\575[2].exe (Backdoor.Bot) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\cisi[1].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\ci[2].exe (Heuristics.Shuriken) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\si[1].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\BTYHSKX0\si[2].exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\ааа\Local Settings\Temporary Internet Files\Content.IE5\ZGONJPZF\575[1].exe (Backdoor.Bot) -> No action taken.
D:\System Volume Information\_restore{16B7BBD9-3172-4C55-BA70-AAA32340C903}\RP81\A0053187.exe (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{62D17673-6237-4818-BA11-508F1691D84C}\RP4\A0000385.exe (RiskWare.Tool.CK) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP44\A0021149.sys (Rootkit.Agent) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP44\A0021563.sys (Rootkit.Agent) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP49\A0023601.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP84\A0075057.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP84\A0075067.EXE (Trojan.Agent.CK) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP84\A0075250.EXE (Trojan.Agent.CK) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP84\A0075276.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{7655EFDC-4A2F-433C-89EC-EA008BF68F46}\RP84\A0075322.EXE (Trojan.Agent.CK) -> No action taken.
D:\avz4\avz\avz4\Infected\2010-10-01\avz00001.dta (Adware.WhenU) -> No action taken.
D:\avz4\avz\avz4\Quarantine\2010-10-01\avz00002.dta (Trojan.Agent) -> No action taken.
C:\Program Files\VVSN\URL1\vsn.cfg (Adware.WhenU) -> No action taken.

- Повторите лог МВАМ

[vova0084]

удалил

[Никита Соловьев]

Что сейчас с проблемой?

[vova0084]

пока вроде всё хорошо. если будет хуже я напишу. а пока огромное вам всем спасибо!!!!!!!!

[olejah]

- Microsoft прекратил поддержку и выпуск обновлений безопасности для ОС Windows XP, на которых не установлен Сервис Пак 3. Установите Сервис Пак 3 - возможно потребуется активация. Перед установкой Сервис Пака необходимо выгрузить все защитные приложения (антивирус, файрвол а так же резидентные приложения типа TeaTimer (Spybot Search and Destroy) и др.)
- Установите все важные обновления.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 14
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\documents and settings\\ааа\\application data\\ltzqai.exe - Trojan.Win32.Pincav.aibq ( DrWEB: Trojan.DownLoader1.24508, BitDefender: Trojan.Generic.6947933, NOD32: Win32/Bflient.K worm, AVAST4: Win32:Malware-gen )
  2. c:\\docume~1\\81a4~1\\locals~1\\temp\\298.exe - Trojan.Win32.Jorik.SdBot.ej ( DrWEB: Trojan.AVKill.2, BitDefender: Trojan.Generic.5900258, NOD32: IRC/SdBot trojan, AVAST4: Win32:Rebhip-AC [Trj] )
  3. c:\\recycler\\s-1-5-21-4446574796-1154716010-497388860-6475\\syscr.exe - P2P-Worm.Win32.Palevo.awdy ( DrWEB: Win32.HLLW.Autoruner.26149, BitDefender: Worm.Generic.282984, NOD32: Win32/Peerfrag.FD worm, AVAST4: Win32:Malware-gen )
  4. c:\\windows\\system32\\msvmiode.exe - Email-Worm.Win32.Joleee.fgg ( DrWEB: Trojan.DownLoader1.25939, BitDefender: Trojan.Generic.7104599, NOD32: Win32/SpamTool.Tedroo.AN trojan, AVAST4: Win32:Rebhip-AC [Trj] )