модиф. Adware.UltimateDefender.AA

Printable View

19.11.2008, 11:30
Anatoliy221

Вложений: 3

модиф. Adware.UltimateDefender.AA

Доброго времени суток.
Подхватил модификацию win32.Adware.UltimateDefender.AA
файлы tm8259.exe и update.exe, update.vbs.
Каспер, ДокторВеб, AVZ не видят. Видит NOD32.
Не могу вылечить, стандартные методы лечения Adware.UltimateDefender не помогли.
Могу если надо дать exe-шники и vbs.
19.11.2008, 11:45
Rene-gad

Закройте все открытые приложения, кроме АVZ и Internet Explorer.
Отключите
- ПК от интернета/локалки
- Антивирус и Файрвол.
[COLOR="Red"][B]- Системное восстановление.[/B][/COLOR]

- [URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
StopService('nvpqsups');
QuarantineFile('C:\WINDOWS\system32\drivers\nvpqsups.sys','');
QuarantineFile('C:\WINDOWS\system32\ntos.exe','');
DeleteService('nvpqsups');
DeleteFile('C:\WINDOWS\system32\ntos.exe');
DeleteFile('C:\WINDOWS\system32\drivers\nvpqsups.sys');
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(13);
BC_DeleteSvc('nvpqsups');
BC_Activate;
RebootWindows(true);
end.
[/CODE]

После перезагрузки:
- [url="http://virusinfo.info/showthread.php?t=10025"] Очистите [/url]темп-папки, кэш проводников и корзину.
- Закройте все программы, включая Антивирус и Файрвол, Оставьте запущенным [B]только Internet Explorer[/B]. Если он не запущен - запустите!!!
- Сделайте повторные логи по правилам.
- Включите Антвирус и Файрволл
- Подключите ПК к интернету/локалке
- Закачайте карантин по ссылке [COLOR="Red"][B]Прислать запрошенный карантин[/B][/COLOR] вверху темы (Приложение 3 правил).
- Прикрепите логи к новому сообщению.
19.11.2008, 13:44
Anatoliy221

Отлично, лечение помогло, большое Вам спасибо :)
Логи и карантин все еще нужны???
Симптомы вируса надо описать?
19.11.2008, 13:49
Гриша

Карантин прислать и логи новые сделать...
19.11.2008, 13:57
Anatoliy221

Вложений: 3

Вот новые логи
19.11.2008, 14:34
Anatoliy221

блин, сейчас зашел под другим пользователем, опять таже бойда... сейчас буду скрипт выполнять

[size="1"][color="#666686"][B][I]Добавлено через 26 минут[/I][/B][/color][/size]

Итак, что имеем...
файлов из скрипта нету C:\WINDOWS\system32\ntos.exe
и C:\WINDOWS\system32\drivers\nvpqsups.sys;
скрипт нормально сработал... но старая зараза так и осталась :O
что делать?!

tm8259.exe - прописывается в реестре в userinit посредством update.vbs
19.11.2008, 14:43
Гриша

Логи нужны из обычного режима...
19.11.2008, 15:37
Anatoliy221

в обычном выбивает, комп перезагружается как только начинаю проверку делать

[size="1"][color="#666686"][B][I]Добавлено через 44 минуты[/I][/B][/color][/size]

Так че делать то?
19.11.2008, 16:08
PavelA

вот это почистим.
[CODE]begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0112818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0111818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0110818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0109818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0108818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0107818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0106818.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0106814.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0106806.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0106802.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0105802.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0104806.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0104802.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0103806.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0103802.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0103794.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP621\A0103789.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0102795.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0102789.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0102785.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0102781.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101781.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101778.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101774.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101771.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101768.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101765.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0101762.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0100762.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP620\A0100759.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP619\A0099757.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP618\A0099750.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP618\A0099735.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP617\A0099728.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP617\A0099714.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP617\A0099696.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP616\A0099679.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP615\A0099661.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP614\A0099639.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP614\A0099612.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP614\A0099577.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP614\A0099531.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP614\A0099524.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP614\A0098515.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP613\A0096516.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP612\A0096497.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP612\A0096492.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP612\A0096473.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP612\A0096468.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP611\A0096459.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP611\A0096453.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP611\A0096448.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP611\A0096435.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP611\A0096430.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP610\A0096422.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP610\A0096417.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP609\A0096414.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP609\A0096410.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP609\A0096403.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP609\A0096399.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP608\A0096388.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP607\A0096361.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP607\A0096356.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP606\A0096346.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP606\A0096341.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP606\A0096328.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP606\A0096323.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP606\A0096319.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP606\A0096314.dll');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP605\A0096308.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP605\A0095309.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP604\A0095284.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP601\A0095203.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP600\A0095166.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP600\A0095133.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP599\A0095114.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP598\A0095089.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP598\A0095066.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP597\A0095040.sys');
DeleteFile('C:\System Volume Information\_restore{71E5F0CD-6B2E-4FA4-95D2-5FA80A1272B9}\RP585\A0094527.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]

Те файлы, что ты выловил положи в карантин AVZ и пришли.
20.11.2008, 10:23
Anatoliy221

Вложений: 3

Скрипт выполнил, сделал новые логи в обычном режиме, и свежий карантин, и тудаже вложил то что сам выловил
только чето карантин теперь загрузить не могуу.... 3 разапробовал...
20.11.2008, 11:54
Rene-gad

- [URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт[/URL]
[CODE]begin
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\userinit.exe','');
BC_ImportAll;
BC_Activate;
RebootWindows(true);
end.
[/CODE]

После перезагрузки:
- Закачайте карантин по ссылке [COLOR="Red"][B]Прислать запрошенный карантин[/B][/COLOR] вверху темы (Приложение 3 правил).
20.11.2008, 12:24
Anatoliy221

сделал
20.11.2008, 12:29
Гриша

userinit.exe- [B]Trojan-Downloader.Win32.Agent.kdk[/B] его нужно заменить на чистый из дистрибутива...
20.11.2008, 15:21
Anatoliy221

Спасибо большое!!! Все отлично работает!!!
22.02.2009, 08:53
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]7[/B][*]Обработано файлов: [B]195[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp585\\a0094527.dll - [B]Trojan-Spy.Win32.Iespy.bqk[/B][*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp597\\a0095040.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp598\\a0095066.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp598\\a0095089.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp599\\a0095114.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp600\\a0095133.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp600\\a0095166.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp601\\a0095203.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp604\\a0095284.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp605\\a0095309.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp605\\a0096308.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp606\\a0096314.dll - [B]Trojan-Downloader.Win32.Mutant.asp[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp606\\a0096319.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp606\\a0096323.dll - [B]Trojan-Downloader.Win32.Mutant.asp[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp606\\a0096328.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp606\\a0096341.dll - [B]Trojan-Downloader.Win32.Mutant.asp[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp606\\a0096346.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp607\\a0096356.dll - [B]Trojan-Downloader.Win32.Mutant.asp[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp607\\a0096361.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp608\\a0096388.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp609\\a0096399.dll - [B]Trojan-Downloader.Win32.Mutant.auw[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp609\\a0096403.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp609\\a0096410.dll - [B]Trojan-Downloader.Win32.Mutant.auw[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp609\\a0096414.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp610\\a0096417.dll - [B]Trojan-Downloader.Win32.Mutant.avs[/B] (DrWEB: BackDoor.Bulknet.206)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp610\\a0096422.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp611\\a0096430.dll - [B]Trojan-Downloader.Win32.Mutant.avs[/B] (DrWEB: BackDoor.Bulknet.206)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp611\\a0096435.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp611\\a0096448.dll - [B]Trojan-Downloader.Win32.Mutant.bbs[/B] (DrWEB: Trojan.MulDrop.18278)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp611\\a0096453.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp611\\a0096459.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp612\\a0096468.dll - [B]Trojan-Downloader.Win32.Mutant.axh[/B] (DrWEB: Trojan.DownLoad.3503)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp612\\a0096473.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp612\\a0096492.dll - [B]Trojan-Downloader.Win32.Mutant.axh[/B] (DrWEB: Trojan.DownLoad.3503)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp612\\a0096497.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp613\\a0096516.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp614\\a0098515.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp614\\a0099524.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp614\\a0099531.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp614\\a0099577.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp614\\a0099612.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp614\\a0099639.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp615\\a0099661.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp616\\a0099679.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp617\\a0099696.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp617\\a0099714.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp617\\a0099728.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp618\\a0099735.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp618\\a0099750.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp619\\a0099757.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0100759.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0100762.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101762.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101765.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101768.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101771.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101774.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101778.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0101781.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0102781.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0102785.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0102789.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp620\\a0102795.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0103789.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0103794.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0103802.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0103806.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0104802.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0104806.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0105802.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0106802.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0106806.sys - [B]Trojan-Downloader.Win32.Mutant.aim[/B] (DrWEB: Trojan.Rntm.10)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0106814.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0106818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0107818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0108818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0109818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0110818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0111818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\system volume information\\_restore{71e5f0cd-6b2e-4fa4-95d2-5fa80a1272b9}\\rp621\\a0112818.dll - [B]Trojan-Downloader.Win32.Mutant.bgk[/B] (DrWEB: BackDoor.Bulknet.225)[*] c:\\windows\\system32\\ntos.exe - [B]Trojan-Spy.Win32.Zbot.hkb[/B] (DrWEB: Trojan.PWS.Panda.54)[*] c:\\windows\\system32\\userinit.exe - [B]Trojan-Downloader.Win32.Agent.kdk[/B] (DrWEB: Trojan.DownLoader.49226)[*] \\выловил\\tm8259.exe - [B]Trojan-Spy.Win32.Zbot.hkb[/B] (DrWEB: Trojan.PWS.Panda.54)[*] \\выловил\\update.exe - [B]Trojan-Spy.Win32.Zbot.hkb[/B] (DrWEB: Trojan.PWS.Panda.54)[*] \\2008-11-19_до лечения\\2008-11-19\\bcqr00003.dta - [B]Trojan-Spy.Win32.Zbot.hkb[/B] (DrWEB: Trojan.PWS.Panda.54)[*] \\2008-11-19_до лечения\\2008-11-19\\bcqr00004.dta - [B]Trojan-Spy.Win32.Zbot.hkb[/B] (DrWEB: Trojan.PWS.Panda.54)[*] \\2008-11-20\\bcqr00002.dta - [B]Trojan-Downloader.Win32.Agent.kdk[/B] (DrWEB: Trojan.DownLoader.49226)[/LIST][/LIST]