Win32/Wigon.CK Троян

Вложений: 3

Проблема при запуске компьютера, nod32 выдает,что у меня вирус,название файла всегда разное,сейчас: C:\WINDOWS\System32\drivers\Winuk72.sys
Win32/Wigon.CK
Событие в новом файле,созданном приложением C:\WINDOWS\TEMP\BNAA.tmp.
С уважением, Bazich.

[url=http://virusinfo.info/showthread.php?t=7239]Выполните скрипт в AVZ[/url]:
[code]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\taskmon.exe','');
QuarantineFile('C:\WINDOWS\System32\Drivers\yqK28.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\yiC04.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ygA50.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winxw61.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winxp04.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winxn04.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winxh47.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winxf14.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winvu47.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Wintl37.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Wintj36.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winti10.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Wintc03.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winsr58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winsk14.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winrs58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winrs15.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winrj47.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winrb37.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winra71.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winqq48.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winpg12.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winow65.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winnw83.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winnw82.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winnf60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt83.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt61.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winlt35.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winjy58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winja78.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winja60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winiq73.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winiq51.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winii37.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winhy60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winhy37.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Wingp58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Wingg72.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winfn58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Windc58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winck48.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Winay50.sys','');
DeleteService('vnP52');
QuarantineFile('C:\WINDOWS\System32\Drivers\vnP52.sys','');
DeleteService('ufH14');
DeleteService('scE60');
QuarantineFile('C:\WINDOWS\System32\Drivers\ufH14.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\scE60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\qaC73.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\phJ68.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\opR58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ooI50.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\olN47.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\neX60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\luW37.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\kbd.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\jbU04.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\irL37.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\hyS73.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\hyB70.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\hxA72.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Hvx16.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\goA73.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ggI60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Fgq02.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\enH27.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\duW04.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\Dkm43.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\dcV71.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\dcE58.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ctV61.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\ctN60.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\bjL47.sys','');
DeleteService('bjL47');
DeleteService('asc3550p');
QuarantineFile('C:\WINDOWS\System32\Drivers\asc3550p.sys','');
QuarantineFile('C:\WINDOWS\system32\actxprxyr.exe','');
DeleteService('winmgmtProtectedStorage');
DeleteService('TapiSrvPolicyAgent');
QuarantineFile('C:\WINDOWS\system32\drivers\','');
DeleteService('Schedule');
DeleteService('oseMessenger');
DeleteService('NetDDEdsdmupnphostNtmsSvc');
DeleteService('NetDDEdsdmupnphost');
DeleteService('LPTRDCsrv');
QuarantineFile('C:\WINDOWS\ctfmon.exe','');
DeleteService('LmHostsRemoteAccess');
DeleteService('Google Online Services');
QuarantineFile('C:\Program Files\uTorrent\ieupdr2.exe','');
DeleteService('ClipSrvEhttpSrv');
DeleteService('CiSvcW32Time');
DeleteService('BITSwinmgmt');
QuarantineFile('srv.exe','');
QuarantineFile('C:\WINDOWS\System32\Drivers\srv.exe','');
QuarantineFile('C:\WINDOWS\Temp\srv.exe','');
QuarantineFile('C:\srv.exe','');
DeleteService('AppMgmtDnscache');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\tcpip.sys','');
QuarantineFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\yCY1mwt7.sys','');
QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
DeleteFile('C:\DOCUME~1\Admin\LOCALS~1\Temp\yCY1mwt7.sys');
DeleteFile('C:\Program Files\uTorrent\ieupdr2.exe');
DeleteFile('C:\WINDOWS\ctfmon.exe');
DeleteFile('C:\WINDOWS\System32\Drivers\asc3550p.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\bjL47.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ctN60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ctV61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\dcE58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\dcV71.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Dkm43.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\duW04.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\enH27.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Fgq02.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ggI60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\goA73.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Hvx16.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\hxA72.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\hyB70.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\hyS73.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\irL37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\jbU04.sys');
DeleteFile('C:\WINDOWS\system32\drivers\kbd.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\luW37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\neX60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\olN47.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ooI50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\opR58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\phJ68.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\qaC73.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\scE60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ufH14.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\vnP52.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winay50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winck48.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Windc58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winfn58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wingg72.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wingp58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winhy37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winhy60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winii37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winiq51.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winiq73.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winja60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winja78.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winjy58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt35.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winlt83.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winnf60.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winnw82.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winnw83.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winow65.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winpg12.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winqq48.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winra71.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winrb37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winrj47.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winrs15.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winrs58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winsk14.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winsr58.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wintc03.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winti10.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wintj36.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Wintl37.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winvu47.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxf14.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxh47.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxn04.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxp04.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winxw61.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\ygA50.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\yiC04.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\yqK28.sys');
DeleteService('qaC73');
DeleteService('phJ68');
DeleteService('opR58');
DeleteService('ooI50');
DeleteService('olN47');
DeleteService('Dkm43');
DeleteService('dcV71');
DeleteService('dcE58');
DeleteService('ctV61');
DeleteService('ctN60');
DeleteService('yqK28');
DeleteService('yiC04');
DeleteService('ygA50');
DeleteService('Winxw61');
DeleteService('Winxp04');
DeleteService('Winxn04');
DeleteService('Winxh47');
DeleteService('Winxf14');
DeleteService('Winvu47');
DeleteService('Wintl37');
DeleteService('Wintj36');
DeleteService('Winti10');
DeleteService('Wintc03');
DeleteService('Winsr58');
DeleteService('Winsk14');
DeleteService('Winrs58');
DeleteService('Winrs15');
DeleteService('Winrj47');
DeleteService('Winrb37');
DeleteService('Winra71');
DeleteService('Winqq48');
DeleteService('Winpg12');
DeleteService('Winow65');
DeleteService('Winnw83');
DeleteService('Winnw82');
DeleteService('Winnf60');
DeleteService('Winlt83');
DeleteService('Winlt61');
DeleteService('Winlt58');
DeleteService('Winlt35');
DeleteService('Winjy58');
DeleteService('Winja78');
DeleteService('Winja60');
DeleteService('Winiq73');
DeleteService('Winiq51');
DeleteService('Winii37');
DeleteService('Winhy60');
DeleteService('Winhy37');
DeleteService('Wingp58');
DeleteService('Wingg72');
DeleteService('Winfn58');
DeleteService('Windc58');
DeleteService('Winck48');
DeleteService('Winay50');
DeleteService('neX60');
DeleteService('luW37');
DeleteService('kbd');
DeleteService('jbU04');
DeleteService('irL37');
DeleteService('hyS73');
DeleteService('hyB70');
DeleteService('hxA72');
DeleteService('Hvx16');
DeleteService('goA73');
DeleteService('ggI60');
DeleteService('Fgq02');
DeleteService('enH27');
DeleteService('duW04');
DelWinlogonNotifyByKeyName('WinCtrl32');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
ExecuteRepair(11);
RebootWindows(true);
end.[/code]

Компьютер перезагрузится.

Пришлите карантин согласно приложению №3 [url=http://virusinfo.info/showthread.php?t=1235]правил[/url] (загружать здесь: [url]http://virusinfo.info/upload_virus.php?tid=25963[/url] ).

AVZ => Файл => Мастер поиска и устранения проблем. Категория проблемы - поставьте "Системные проблемы", степень опасности - "Все проблемы". Нажмите "Пуск". Всё найденное следует пометить и исправить. Данную операцию повторить для категории "Настройки и твики браузера".

Очистите временные папки и кеш браузера.
Сделайте новые логи.

Вложений: 3

Скрипт выполнил, карантин прислал.
Новые логи выкладываю.

[url=http://virusinfo.info/showthread.php?t=4491]Пофиксите в HijackThis[/url]:
[code]O4 - HKLM\..\Run: [taskmon] C:\WINDOWS\taskmon.exe[/code]

Вот это вам знакомо?
[code]O17 - HKLM\System\CCS\Services\Tcpip\..\{2B56E617-400E-49FD-B0CA-141B28BF1D49}: NameServer = 85.255.116.26,85.255.112.89
O17 - HKLM\System\CCS\Services\Tcpip\..\{62CC5673-097E-42B6-A104-ABCD9F4A3189}: NameServer = 85.255.116.26,85.255.112.89
O17 - HKLM\System\CCS\Services\Tcpip\..\{B029F1F0-3BF8-4254-B3C9-AEB037A2188D}: NameServer = 85.255.116.26 85.255.112.89
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1F0A3B-A1C0-4643-93D8-EF5BC2A7DDA3}: NameServer = 85.255.116.26,85.255.112.89
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.26 85.255.112.89
O17 - HKLM\System\CS1\Services\Tcpip\..\{2B56E617-400E-49FD-B0CA-141B28BF1D49}: NameServer = 85.255.116.26,85.255.112.89
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.26 85.255.112.89
O17 - HKLM\System\CS2\Services\Tcpip\..\{2B56E617-400E-49FD-B0CA-141B28BF1D49}: NameServer = 85.255.116.26,85.255.112.89
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.26 85.255.112.89[/code]
Если незнакомо, то тоже пофиксите в Hijackthis эти строчки.

[url=http://virusinfo.info/showthread.php?t=7239]Выполните скрипт в AVZ[/url]:
[code]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('C:\WINDOWS\System32\Drivers\asc3550p.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winkc82.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winox24.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winuk72.sys');
DeleteFile('C:\WINDOWS\System32\WinCtrl32.dll');
DeleteFile('C:\WINDOWS\System32\WinCtrl32.dl_');
DelWinlogonNotifyByKeyName('partnershipreg');
DelWinlogonNotifyByKeyName('WinCtrl32');
BC_ImportDeletedList;
ExecuteSysClean;
RegKeyParamDel('HKEY_USERS', '.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run', 'ntuser');
BC_DeleteSvc('asc3550p');
BC_DeleteSvc('wuauservNtmsSvc');
BC_DeleteSvc('winmgmtProtectedStorage');
BC_DeleteSvc('TapiSrvPolicyAgent');
BC_DeleteSvc('Schedule');
BC_DeleteSvc('RasManBITSwinmgmt');
BC_DeleteSvc('oseMessenger');
BC_DeleteSvc('NetDDEdsdmupnphostNtmsSvc');
BC_DeleteSvc('NetDDEdsdmupnphost');
BC_DeleteSvc('LmHostsRemoteAccess');
BC_DeleteSvc('ClipSrvEhttpSrv');
BC_DeleteSvc('CiSvcW32Time');
BC_DeleteSvc('BITSwinmgmtNetDDEdsdmupnphost');
BC_DeleteSvc('BITSwinmgmt');
BC_DeleteSvc('AppMgmtDnscache');
BC_DeleteSvc('ALGRasMan');
BC_DeleteSvc('Winuk72');
BC_DeleteSvc('Winox24');
BC_DeleteSvc('Winkc82');
BC_Activate;
RebootWindows(true);
end.[/code]

Компьютер перезагрузится.

Очистите временные папки и кеш браузера.
Сделайте новые логи.

Вложений: 3

Скрипт выполнил. Пофиксил.
Новые логи выкладываю.

Теперь чисто. Какие-то проблемы остались?

Проблем нет, система работает стабильно. Открылся даже диспечер задач. Огромное спасибо.

Нам интересно [url=http://virusinfo.info/showthread.php?t=19883]Ваше мнение[/url] о нашем ресурсе. Будем очень благодарны за отзыв, он может помочь нам улучшить ресурс.

Советуем прочитать электронную [url=http://security-advisory.virusinfo.info/]книгу[/url] "Безопасный Интернет. Универсальная защита для Windows ME - Vista".

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]176[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\\windows\\system32\\winctrl32.dll - [B]Trojan-Downloader.Win32.Mutant.aks[/B] (DrWEB: Trojan.Rntm.7)[/LIST][/LIST]