Printable View
В компе сидит вирус, достать не могу. Слетела полностью автозагрузка, прописываются только какой-то левый файл winhelp32.exe в систем32, дрвеб сам не грузится, но если и загрузить ничего не видит. Постоянно подгружаются новые вирусы, от которых приходиться чистить комп, части чно только вручную. Периодически глушится инет, отсылается бешенное количество запросов, но АВЗ лечит.
[URL="http://www.majorgeeks.com/downloadget.php?id=5199&file=15&evp=0d36c3ec48c6373fd5daac78f0c6a417"]скачайте [/URL] E:\WINDOWS\SYSTEM32\VIDEO.sys - force delete
выполните скрипт ...
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DelBHO('{7C6E1044-DBF1-EDB3-57BB-D40A130EA5BD}');
QuarantineFile('E:\WINDOWS\SYSTEM32\winhelp32.exe','');
DeleteService('ynM22');
QuarantineFile('E:\WINDOWS\System32\Drivers\ynM22.sys','');
QuarantineFile('E:\WINDOWS\System32\Drivers\ygF55.sys','');
DeleteService('ygF55');
DeleteService('Wcb55');
QuarantineFile('E:\WINDOWS\System32\Drivers\Wcb55.sys','');
DeleteService('vpimrjfkwnszepl');
QuarantineFile('vpimrjfkwnszepl.sys','');
DeleteService('Uet44');
QuarantineFile('E:\WINDOWS\System32\Drivers\Uet44.sys','');
DeleteService('tcpsr');
QuarantineFile('E:\WINDOWS\System32\drivers\tcpsr.sys','');
DeleteService('SjyPkt');
QuarantineFile('E:\WINDOWS\System32\Drivers\SjyPkt.sys','');
DeleteService('smtpdrv');
QuarantineFile('E:\WINDOWS\system32\DRIVERS\smtpdrv.sys','');
DeleteService('Ovu00');
QuarantineFile('E:\WINDOWS\System32\Drivers\Ovu00.sys','');
DeleteService('Nbe11');
QuarantineFile('E:\WINDOWS\System32\Drivers\Nbe11.sys','');
DeleteService('keD88');
QuarantineFile('E:\WINDOWS\System32\Drivers\keD88.sys','');
QuarantineFile('E:\WINDOWS\System32\Drivers\Fdl77.sys','');
DeleteService('Fdl77');
DeleteService('ethpaszs');
QuarantineFile('E:\WINDOWS\system32\drivers\ethpaszs.sys','');
DeleteService('ecT22');
QuarantineFile('E:\WINDOWS\System32\Drivers\ecT22.sys','');
DeleteService('bpX77');
QuarantineFile('E:\WINDOWS\System32\Drivers\bpX77.sys','');
DeleteService('asc');
QuarantineFile('E:\WINDOWS\System32\Drivers\aoN88.sys','');
DeleteService('VIDEO');
QuarantineFile('E:\WINDOWS\SYSTEM32\VIDEO.sys','');
DeleteService('hotcore3');
QuarantineFile('E:\WINDOWS\system32\drivers\hotcore3.sys','');
DeleteService('Erl66');
QuarantineFile('E:\DOCUME~1\Irinka\LOCALS~1\Temp\30.tmp srv','');
DeleteService('WmdmPmSN BackItUp Scheduler 3');
QuarantineFile('E:\WINDOWS\system32\drivers\spools.exe','');
QuarantineFile('e:\windows\system32\mssrv32.exe','');
DeleteService('msupdate');
DeleteService('lanmanserverWmi');
QuarantineFile('E:\WINDOWS\system32\a3de.exe','');
QuarantineFile('E:\Documents and Settings\Irinka\ie_updates3r.exe','');
DeleteService('Google Online Services');
DeleteService('Dhcpxmlprov');
QuarantineFile('E:\WINDOWS\TEMP\3ad6b687.tmp srv','');
DeleteService('aspnet_stateUMWdf');
QuarantineFile('E:\WINDOWS\system32\2052w.exe','');
QuarantineFile('\??\E:\WINDOWS\system32\drivers\vmfgilnlxwdgfv.sys','');
QuarantineFile('\??\E:\WINDOWS\SYSTEM32\VIDEO.sys','');
QuarantineFile('E:\WINDOWS\system32\drivers\synsenddrv.sys','');
QuarantineFile('E:\WINDOWS\system32\Drivers\Erl66.sys','');
QuarantineFile('E:\WINDOWS\system32\vmmreg32.dll','');
TerminateProcessByName('e:\windows\system32\cpl32ver.exe');
QuarantineFile('e:\windows\system32\cpl32ver.exe','');
DeleteFile('e:\windows\system32\cpl32ver.exe');
DeleteFile('E:\WINDOWS\system32\vmmreg32.dll');
DeleteFile('E:\WINDOWS\system32\Drivers\Erl66.sys');
DeleteFile('E:\WINDOWS\system32\drivers\synsenddrv.sys');
DeleteFile('\??\E:\WINDOWS\SYSTEM32\VIDEO.sys');
DeleteFile('\??\E:\WINDOWS\system32\drivers\vmfgilnlxwdgfv.sys');
DeleteFile('E:\WINDOWS\system32\2052w.exe');
DeleteFile('E:\WINDOWS\TEMP\3ad6b687.tmp srv');
DeleteFile('E:\Documents and Settings\Irinka\ie_updates3r.exe');
DeleteFile('E:\WINDOWS\system32\a3de.exe');
DeleteFile('e:\windows\system32\mssrv32.exe');
DeleteFile('E:\WINDOWS\system32\drivers\spools.exe');
DeleteFile('E:\DOCUME~1\Irinka\LOCALS~1\Temp\30.tmp srv');
DeleteFile('E:\WINDOWS\System32\Drivers\Erl66.sys');
DeleteFile('E:\WINDOWS\system32\drivers\hotcore3.sys');
DeleteFile('E:\WINDOWS\SYSTEM32\VIDEO.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\aoN88.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\bpX77.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\ecT22.sys');
DeleteFile('E:\WINDOWS\system32\drivers\ethpaszs.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Fdl77.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\keD88.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Nbe11.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Ovu00.sys');
DeleteFile('E:\WINDOWS\system32\DRIVERS\smtpdrv.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\SjyPkt.sys');
DeleteFile('E:\WINDOWS\System32\drivers\tcpsr.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Uet44.sys');
DeleteFile('vpimrjfkwnszepl.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\Wcb55.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\ygF55.sys');
DeleteFile('E:\WINDOWS\System32\Drivers\ynM22.sys');
DeleteFile('E:\WINDOWS\SYSTEM32\winhelp32.exe');
DeleteFile('WinCtrl32.dll');
DeleteFile('vmmreg32.dll');
DeleteFile('E:\WINDOWS\Temp\BN1.tmp');
DeleteFile('E:\WINDOWS\Temp\BN11.tmp');
DeleteFile('E:\WINDOWS\Temp\BN12.tmp');
DeleteFile('E:\WINDOWS\Temp\BN13.tmp');
DeleteFile('E:\WINDOWS\Temp\BN15.tmp');
DeleteFile('E:\WINDOWS\Temp\BN2.tmp');
DeleteFile('E:\WINDOWS\Temp\BN3.tmp');
DeleteFile('E:\WINDOWS\Temp\BN4.tmp');
DeleteFile('E:\WINDOWS\Temp\BN5.tmp');
DeleteFile('E:\WINDOWS\Temp\BN6.tmp');
DeleteFile('E:\WINDOWS\Temp\BN7.tmp');
DeleteFile('E:\WINDOWS\Temp\BN8.tmp');
DeleteFile('E:\WINDOWS\Temp\BN9.tmp');
DeleteFile('E:\WINDOWS\Temp\BNA.tmp');
DeleteFile('E:\WINDOWS\Temp\BNB.tmp');
DeleteFile('E:\WINDOWS\Temp\BNC.tmp');
DeleteFile('E:\WINDOWS\Temp\BND.tmp');
DeleteFile('E:\WINDOWS\Temp\BNE.tmp');
DeleteFile('E:\WINDOWS\Temp\BNF.tmp');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/code]
пришлите карантин согласно приложения 3 правил ...
повторите логи ...