Помогите вроде вирус!!!!!!!!!!!!!

Printable View

04.06.2010, 14:02
mcpasha

Помогите вроде вирус!!!!!!!!!!!!!

1) При включении компьютера, который подключен к сети выдаёт ошибку lsass.exe отключаю от сети перестаёт выдавать ошибку.
2) Неактивный Диспечер задач
3) Вчера выдавала информер "оплатите на plati.ru"....
4) Почистил в безопасном режиме CureIt, нашел много зараженных файлов, но проблема не решилась (
5) virusinfo_syscheck.zip делаю без подключенного интернета, так как подключаю сразу выдаёт lsass.exe и 60 сек...(((
04.06.2010, 14:18
polword

- [URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/URL]
[CODE]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
RegKeyStrParamWrite('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon','UserInit', GetEnvironmentVariable ('WinDir')+'\System32\userinit.exe,');
QuarantineFile('\\?\globalroot\systemroot\system32\vsnb5ia.exe','');
QuarantineFile('\\?\globalroot\systemroot\system32\dpoazxn.exe','');
DeleteFile('\\?\globalroot\systemroot\system32\vsnb5ia.exe');
DeleteFile('\\?\globalroot\systemroot\system32\dpoazxn.exe');
RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
QuarantineFile('C:\WINDOWS\system32\wshom.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\sqlsodbc.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\rsvpcnts.h:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\pubprn.vbs:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\pschdcnt.h:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\perfwci.h:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\OUTLPERF.H:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\odbccp32.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\msscript.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\msdtcprf.h:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\msadds32.ax:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\kstvtune.ax:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\ksproxy.ax:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\joy.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\homepage.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\wmidx.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\wiasf.ax:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\telephon.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\tdc.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\pubprn.vbs:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\ncpa.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\main.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\inetcpl.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\ieinfo5.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\hhctrl.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\dllcache\dmview.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\daxctle.ocx:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\CONFIG.TMP:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\cliconf.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\ativdaxx.ax:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\ALSNDMGR.WAV:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\ALSNDMGR.CPL:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\access.cpl:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\wmpocm.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\wmaccess.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\wfp3.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\vgx.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\trid3d.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\swflash.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\spx.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\sffdisk.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\secrecs.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\s3sav4.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\oem7.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nvdm.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nokia_6270_IrDA.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nokia9500IrDA.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\Nokia8800Bluetooth.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\Nokia7380Bluetooth.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nokia7280IrDA.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nokia6021IrDA.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\Nokia6021Bluetooth.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nN92BT.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\nettiger.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netsnip.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netpschd.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netosi5.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netoc.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netnm.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netmadge.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netepro.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\netbcm4u.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\net650d.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\net5515n.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\n6108Cable.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mpsstln.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\monitor3.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mfmhzn5.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mfcem56.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmusrk1.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmpn1.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmnttd2.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmcpq.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmcodex.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmchipv.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmbtmdm.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\mdmaiwa5.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\lwngmadi.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\kdkscan.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\irdaalif.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\hpdigwia.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\dxbda.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\defltwk.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\d3dx9_28_x86.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\cyclad-z.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\corelist.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\certclas.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\brmfcumd.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\brmfcmdm.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\atim128.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\inf\ati1xwdm.inf:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\imsins.BAK:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\wshconcepts.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\wininstl.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\winchat.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\whatsnew.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\webpub.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\wbemtest.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\useract.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\update1.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\telnet.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\sys_srv.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\sysrestore.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\sysmon.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\sr_ui.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\splash.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\spad.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\snmpconcepts.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\sndvol32.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\shvl.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\sendcmsg.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\rvse.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\ratings.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\qosconcepts.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\printing.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\packager.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\osk.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\omc.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\nthelp.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\ntart.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\notepad.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\nofts.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\newfeat5.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\newfeat2.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\mstsc.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\msorcl32.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\mouse.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\mls_trb.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\migwiz.htm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\magnify.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\ipv6.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\ipsecsnp.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\iewebhlp.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\icwdial.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\hardware.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\freecell.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\fonts.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\file_srv.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\filefold.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\eudcedit.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\dxdiag.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\dskquoui.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\display.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\diskmgmt.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\digiras.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\diagboot.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\devmgr.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\cpanel.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\compmgmt.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\chkr.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\charmap.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\cdmedia.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\brief.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\bootcons.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\blutooth.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\bckg.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\apps_sp.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\addremov.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\Help\access.chm:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\002270_.tmp:UdpRIA:$DATA','');
QuarantineFile('c:\windows\system32\hidphone.tsp:UdpRIA:$DATA','');
QuarantineFile('c:\windows\system32\ipconf.tsp:UdpRIA:$DATA','');
QuarantineFile('C:\WINDOWS\system32\sdra64.exe','');
QuarantineFile('C:\Documents and Settings\1\Application Data\Qoan\kozoi.exe','');
DeleteFile('C:\Documents and Settings\1\Application Data\Qoan\kozoi.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','{F289ADD3-7554-D978-BD9A-8615E18CF415}');
DeleteFile('C:\WINDOWS\system32\sdra64.exe');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','userinit');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','userinit');
DeleteFile('c:\windows\system32\ipconf.tsp:UdpRIA:$DATA');
DeleteFile('c:\windows\system32\hidphone.tsp:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\002270_.tmp:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\access.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\addremov.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\apps_sp.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\bckg.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\blutooth.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\bootcons.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\brief.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\cdmedia.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\charmap.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\chkr.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\compmgmt.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\cpanel.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\devmgr.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\diagboot.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\digiras.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\diskmgmt.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\display.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\dskquoui.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\dxdiag.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\eudcedit.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\filefold.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\file_srv.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\fonts.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\freecell.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\hardware.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\icwdial.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\iewebhlp.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\ipsecsnp.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\ipv6.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\magnify.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\migwiz.htm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\mls_trb.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\mouse.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\msoe.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\msorcl32.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\mstsc.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\newfeat2.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\newfeat5.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\nofts.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\notepad.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\ntart.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\nthelp.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\omc.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\osk.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\packager.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\printing.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\qosconcepts.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\ratings.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\rvse.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\sendcmsg.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\shvl.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\sndvol32.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\snmpconcepts.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\spad.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\splash.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\sr_ui.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\sysmon.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\sysrestore.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\sys_srv.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\telnet.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\update1.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\useract.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\wbemtest.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\webpub.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\whatsnew.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\winchat.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\wininstl.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\Help\wshconcepts.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\imsins.BAK:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\ati1xwdm.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\atim128.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\brmfcmdm.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\brmfcumd.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\certclas.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\corelist.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\cyclad-z.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\d3dx9_28_x86.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\defltwk.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\dxbda.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\hpdigwia.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\irdaalif.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\kdkscan.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\lwngmadi.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmaiwa5.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmbtmdm.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmchipv.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmcodex.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmcpq.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmnttd2.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmpn1.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mdmusrk1.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mfcem56.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mfmhzn5.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\monitor3.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\mpsstln.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\n6108Cable.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\net5515n.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\net650d.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netbcm4u.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netejxmp.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netepro.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netmadge.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netnm.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netoc.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netosi5.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netpschd.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\netsnip.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nettiger.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nN92BT.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\Nokia6021Bluetooth.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nokia6021IrDA.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nokia7280IrDA.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\Nokia7380Bluetooth.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\Nokia8800Bluetooth.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nokia9500IrDA.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nokia_6270_IrDA.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\nvdm.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\oem7.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\s3sav4.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\secrecs.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\sffdisk.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\spx.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\swflash.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\trid3d.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\vgx.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\wdma_m2e.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\wfp3.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\wmaccess.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\inf\wmpocm.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\access.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\ALSNDMGR.CPL:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\ALSNDMGR.WAV:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\ativdaxx.ax:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\cliconf.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\CONFIG.TMP:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\daxctle.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\dmview.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\hhctrl.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\ieinfo5.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\inetcpl.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\main.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\ncpa.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\pubprn.vbs:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\tdc.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\telephon.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\wiasf.ax:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\dllcache\wmidx.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\homepage.inf:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\intl.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\ksproxy.ax:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\kstvtune.ax:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\msadds32.ax:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\msdtcprf.h:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\msscript.ocx:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\odbccp32.cpl:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\OUTLPERF.H:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\perfwci.h:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\pschdcnt.h:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\pubprn.vbs:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\rsvpcnts.h:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\sqlsodbc.chm:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\usrlogon.cmd:UdpRIA:$DATA');
DeleteFile('C:\WINDOWS\system32\wshom.ocx:UdpRIA:$DATA');
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(11);
ExecuteRepair(17);
ExecuteRepair(20);
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
BC_Activate;
RebootWindows(true);
end.[/CODE]

После перезагрузки:
- выполните такой скрипт
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
- Файл [B][COLOR="Red"]quarantine.zip[/COLOR][/B] из папки AVZ загрузите по ссылке [B][COLOR="Red"]Прислать запрошенный карантин[/COLOR][/B] вверху темы
- Сделайте повторные логи по [URL="http://virusinfo.info/pravila_old.html"]правилам[/URL] п.2 и 3 раздела Диагностика.(virusinfo_syscheck.zip; hijackthis.log)
04.06.2010, 14:33
mcpasha

Сделал

При подключении кабеля снова выпадает lsass.exe
04.06.2010, 14:40
mcpasha

quarantine.zip загружается 21 мб ( подвисло и весит, незнаю загружается или нет ...
04.06.2010, 14:43
polword

1. Профиксите в HijackThis [URL="http://virusinfo.info/showthread.php?t=4491"]как "профиксить в HiJackThis"[/URL]
[CODE]
R3 - URLSearchHook: (no name) - - (no file)
O4 - HKCU\..\Policies\Explorer\Run: [servises] C:\WINDOWS\system32\servises.exe
[/CODE]

- Сделайте лог [URL="http://virusinfo.info/showthread.php?t=53070"]MBAM[/URL]

[size="1"][color="#666686"][B][I]Добавлено через 31 секунду[/I][/B][/color][/size]

подождите может загрузится
04.06.2010, 15:51
mcpasha

Сделал.....
04.06.2010, 16:26
thyrex

[URL="http://virusinfo.info/showpost.php?p=493584&postcount=2"]Удалите в МВАМ[/URL] все, кроме
[CODE]Объекты реестра заражены:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.[/CODE]
04.06.2010, 18:26
mcpasha

Удалил, всёравно призагрузке выдаётся ошибка lsass.exe, вообщем я понял лу4ше винду снести и новую поставить, спасибо Вам за помощь....
04.06.2010, 21:16
thyrex

Выполните скрипт в AVZ
[code]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\servises.exe','');
DeleteFile('C:\WINDOWS\system32\servises.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','servises');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end. [/code]Компьютер перезагрузится.

Пришлите карантин согласно [B]Приложения 3[/B] правил по красной ссылке [COLOR="Red"][U][B]Прислать запрошенный карантин[/B][/U][/COLOR] вверху темы

Сделайте новые логи
05.06.2010, 21:16
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]501[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\documents and settings\1\application data\qoan\kozoi.exe - [B]Trojan-Spy.Win32.Zbot.ajlx[/B] ( DrWEB: Trojan.Proxy.16068, BitDefender: Trojan.Generic.4100955 )[*] c:\windows\help\access.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\addremov.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\apps_sp.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\bckg.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\blutooth.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\bootcons.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\brief.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\cdmedia.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\charmap.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\chkr.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\compmgmt.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\cpanel.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\devmgr.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\diagboot.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\digiras.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\diskmgmt.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\display.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\dskquoui.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\dxdiag.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\eudcedit.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\filefold.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\file_srv.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\fonts.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\freecell.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\hardware.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\icwdial.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\iewebhlp.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\ipsecsnp.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\ipv6.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\magnify.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\migwiz.htm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\mls_trb.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\mouse.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\msoe.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\msorcl32.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\mstsc.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\newfeat2.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\newfeat5.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\nofts.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\notepad.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\ntart.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\nthelp.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\omc.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\osk.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\packager.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\printing.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\qosconcepts.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\ratings.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\rvse.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\sendcmsg.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\shvl.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\sndvol32.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\snmpconcepts.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\spad.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\splash.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\sr_ui.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\sysmon.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\sysrestore.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\sys_srv.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\telnet.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\update1.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\useract.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\wbemtest.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\webpub.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\whatsnew.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\winchat.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\wininstl.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\help\wshconcepts.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\imsins.bak:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\atim128.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\ati1xwdm.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\brmfcmdm.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\brmfcumd.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\certclas.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\corelist.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\cyclad-z.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\defltwk.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\dxbda.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\d3dx9_28_x86.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\hpdigwia.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\irdaalif.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\kdkscan.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\lwngmadi.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmaiwa5.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmbtmdm.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmchipv.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmcodex.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmcpq.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmnttd2.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmpn1.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mdmusrk1.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mfcem56.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mfmhzn5.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\monitor3.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\mpsstln.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netbcm4u.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netejxmp.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netepro.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netmadge.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netnm.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netoc.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netosi5.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netpschd.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\netsnip.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nettiger.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\net5515n.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\net650d.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nn92bt.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia6021bluetooth.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia6021irda.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia_6270_irda.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia7280irda.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia7380bluetooth.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia8800bluetooth.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nokia9500irda.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\nvdm.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\n6108cable.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\oem7.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\secrecs.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\sffdisk.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\spx.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\swflash.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\s3sav4.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\trid3d.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\vgx.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\wdma_m2e.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\wdma_neo.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\wfp3.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\wmaccess.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\inf\wmpocm.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\access.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\alsndmgr.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\alsndmgr.wav:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\ativdaxx.ax:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\cliconf.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\config.tmp:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\daxctle.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\dmview.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\hhctrl.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\ieinfo5.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\inetcpl.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\main.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\ncpa.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\pubprn.vbs:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\tdc.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\telephon.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\wiasf.ax:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\dllcache\wmidx.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\hidphone.tsp:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\homepage.inf:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\intl.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\ipconf.tsp:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\joy.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\ksproxy.ax:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\kstvtune.ax:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\msadds32.ax:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\msdtcprf.h:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\msscript.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\odbccp32.cpl:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\outlperf.h:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\perfwci.h:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\pschdcnt.h:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\pubprn.vbs:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\rsvpcnts.h:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\sqlsodbc.chm:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\usrlogon.cmd:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\system32\wshom.ocx:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[*] c:\windows\002270_.tmp:udpria:$data - [B]Packed.Win32.Krap.gx[/B] ( DrWEB: Trojan.Packed.20343, AVAST4: Win32:Rootkit-gen [Rtk] )[/LIST][/LIST]
Рекомендации:
[LIST=1][*]Обнаружены троянские программы класса Trojan-PSW/Trojan-Spy - настоятельно рекомендуется поменять все пароли ![/LIST]