.. =)
[ATTACH]393569[/ATTACH]
[ATTACH]393570[/ATTACH]
[ATTACH]393571[/ATTACH]
.. =)
[ATTACH]393569[/ATTACH]
[ATTACH]393570[/ATTACH]
[ATTACH]393571[/ATTACH]
() [B]Qaqtus Maklay[/B], !
VirusInfo.Info . , , . HiJackThis, [URL="http://virusinfo.info/pravila.html"] [/URL].
- [URL="http://virusinfo.info/content.php?r=113-virusinfo.info-donate"] [/URL].
[url=http://virusinfo.info/showthread.php?t=4491][/url] HijackThis
[CODE]R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://lasupporte.com/SCtk23j/lagon.pac
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 46.4.7.198:3128
O1 - Hosts: 37.10.117.75 mc.yandex.ru admulti.com counter.rambler.ru www.google-analytics.com counter.spylog.com
O1 - Hosts: 37.10.117.74 wap.odnoklassniki.ru vk.com www.odnoklassniki.ru m.vk.com odnoklassniki.ru my.mail.ru
O2 - BHO: (no name) - {C93F72A2-2162-4BBA-A07A-F13663C297A6} - (no file)
O3 - Toolbar: (no name) - {09900DE8-1DCA-443F-9243-26FF581438AF} - (no file)
O3 - Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - (no file)
O3 - Toolbar: (no name) - {91397D20-1446-11D4-8AF4-0040CA1127B6} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F40410B-4E2F-445F-B433-4E2C5F17CF06}: NameServer = 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{56DF43B2-3667-40B7-BBFD-140523FED6CD}: NameServer = 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{966FE049-43AF-4E5C-ABA7-804EB3F731B4}: NameServer = 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C48A6562-31D7-4BF0-97C0-5A9658231E09}: NameServer = 127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{FDAA498D-3C9D-4518-BFBA-1544A970FBE9}: NameServer = 127.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F40410B-4E2F-445F-B433-4E2C5F17CF06}: NameServer = 127.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F40410B-4E2F-445F-B433-4E2C5F17CF06}: NameServer = 127.0.0.1
O20 - Winlogon Notify: kdcfrea - Invalid registry found[/CODE]
ZAO "Delovaja set" Internet provider, 902,17 Curupa str.,Ufa Russia - ?
, .
- [url=http://virusinfo.info/showthread.php?t=115256] RSIT.[/url]
- [url=http://virusinfo.info/showpost.php?p=457118&postcount=1] .[/url]
[ATTACH]393576[/ATTACH]
[ATTACH]393577[/ATTACH]
RSIT
=) , =)
[COLOR="silver"]- - - - - -[/COLOR]
=)
[COLOR="silver"]- - - - - -[/COLOR]
! =(
[COLOR="silver"]- - - - - -[/COLOR]
, !
[COLOR="silver"]- - - - - -[/COLOR]
5 =)
MBAM ?
[CODE]C:\Windows\tasks\At1.job[/CODE] .
[CODE]D:\Games\proxy\pcapui.exe[/CODE] - ?
- /.
[url=http://virusinfo.info/showthread.php?t=57441]- [/url]
[url=http://virusinfo.info/showthread.php?t=7239] [/url] -
[code]
begin
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
QuarantineFile('D:\Games\proxy\pcapui.exe','');
QuarantineFile('C:\Users\Zuzu\AppData\Roaming\131.exe','');
DeleteFileMask('C:\DOCUME~1\Nastena\LOCALS~1\Temp\','*',true ,' ');
DeleteFile('C:\Users\Zuzu\AppData\Roaming\131.exe');
QuarantineFileF('C:\ProgramData\hotfPE7Xe3k','*', true,'',0 ,0);
DeleteFileMask('C:\ProgramData\hotfPE7Xe3k', '*', true);
DeleteDirectory('C:\ProgramData\hotfPE7Xe3k',' ');
RegKeyParamDel('HKEY_LOCAL_MACHINE','system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list','C:\Users\Zuzu\AppData\Roaming\131.exe');
BC_ImportALL;
ExecuteSysClean;
ExecuteRepair(2);
ExecuteRepair(3);
ExecuteRepair(4);
BC_Activate;
RebootWindows(true);
end.
[/code]
[color=#FF0000] .[/color]
[b] :[/b]
- :
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
[b]quarantine.zip[/b] AVZ "[color=Red][b] [/b][/color]" .
- RSIT + MBAM
("* *.JHB\YA|6F <
s *! * c m d . e x e " / c a t t r i b - H C : \ W i n d o w s \ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s & & c o p y C : \ T E M P \ 7 7 4 0 2 5 4 a q C : \ W i n d o w s \ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s / Y & & a t t r i b + H C : \ W i n d o w s \ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s " A8AB5<0 !>AB02;5=> N e t S c h e d u l e J o b A d d . 0 * "_] a;@"zMa$J2FǘlXw+Qͤ&/~zdq"-"F)
[ATTACH]393786[/ATTACH]
[ATTACH]393787[/ATTACH]
=)
[COLOR="silver"]- - - - - -[/COLOR]
!
AVZ ( )
[code]begin
ShowMessage('! AVZ .' + #13#10 + ' .');
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
end;
DeleteFile('C:\Windows\tasks\At1.job');
ExecuteSysClean;
ExecuteRepair(13);
RebootWindows(true);
end. [/code] .
[quote="Qaqtus Maklay;952622"] =)[/quote]
[url="http://malwarebytes.org/mbam-download-exe-random.php"]Malwarebytes' Anti-Malware[/url] [URL="http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe"][/URL], , , "[b]Perform Full Scan[/b]" ("[B] [/B]"), "[b]Scan[/b]" ("[B][/B]"), - [b]Ok[/b] - [b]Show Results[/b] ("[B] [/B]") - .
, :
[CODE]%appdata%\Malwarebytes\Malwarebytes' Anti-Malware\Logs[/CODE]
mbam-log-[data] (time).txt, : mbam-log-2012-11-09 (07-32-51).txt
MBAM , . [url=http://data.mbamupdates.com/tools/mbam-rules.exe] [B]MBAM[/B].[/URL]
=)
[quote="thyrex;952681"] [/quote]
[quote="regist;952705"] .[/quote]
?
+ [url=http://df.ru/~kad/ScanVuln.txt][B]ScanVuln.txt[/B][/url]. AVZ. - avz_log.txt.
avz_log.txt ( ).
.
, .
:
[LIST][*] : [B]1[/B][*] : [B]2[/B][*] :
[LIST=1][*] c:\\programdata\\hotfpe7xe3k\\klpclst.dat - [B]Trojan.Script.Carberp.a[/B] ( DrWEB: Trojan.Carberp.30, BitDefender: Trojan.Downloader.Carberp.BR, AVAST4: Other:Malware-gen [Trj] )[*] c:\\users\\zuzu\\appdata\\roaming\\131.exe - [B]Trojan.Win32.TDSS.ismk[/B] ( DrWEB: Trojan.DownLoader6.34751, BitDefender: Gen:Variant.Symmi.244, AVAST4: Win32:Downloader-QZN [Trj] )[/LIST][/LIST]