Printable View
После чистки копьютера от вирусов (Dr.Web), осталась проблема: при выключении компьютера сначала приходится долго ждать меню выключения, а затем очень долго происходит само отключение.
При лечении AVZ с режимом блокировки RootKit-ов проблема исчезает, но после перезагрузки компьютера возникает вновь.
Посоветуйте, пожалуйста, как бороться с этой проблемой.
Закройте все программы
Отключите
- ПК от интернета/локалки.
- Антивирус и Файрвол
[URL="http://virusinfo.info/showthread.php?t=4905"]- Системное восстановление[/URL]
[URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в АВЗ[/URL] -
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
DeleteService('ego83y7ei8dee');
QuarantineFile('C:\WINDOWS\system32\zummoopatej.exe','');
DeleteService('kfgzgmww');
QuarantineFile('C:\WINDOWS\System32\Drivers\kfgzgmww.sys','');
QuarantineFile('C:\Documents and Settings\Admin\pcjgsrn.exe','');
QuarantineFile('C:\Program Files\cdslow.exe','');
QuarantineFile('C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe','');
QuarantineFile('C:\WINDOWS\TEMP\winsp1up.exe','');
QuarantineFile('C:\WINDOWS\Temp\291.exe','');
QuarantineFile('C:\WINDOWS\cidrive32.exe','');
QuarantineFile('C:\WINDOWS\ndll.exe','');
QuarantineFile('C:\WINDOWS\system32\651ac17d.exe','');
QuarantineFile('C:\WINDOWS\system32\hoozuzon.exe','');
QuarantineFile('C:\WINDOWS\system32\lqbmdl.exe','');
QuarantineFile('C:\WINDOWS\system32\msvmcls64.exe','');
QuarantineFile('C:\WINDOWS\system32\regedit.exe','');
DelCLSID('{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}');
QuarantineFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe','');
DeleteFile('C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe');
DeleteFile('C:\WINDOWS\system32\regedit.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Regedit32');
DeleteFile('C:\WINDOWS\system32\msvmcls64.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','MS Virtual CLS');
DeleteFile('C:\WINDOWS\system32\lqbmdl.exe');
DeleteFile('C:\WINDOWS\system32\hoozuzon.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','guligoo');
DeleteFile('C:\WINDOWS\system32\651ac17d.exe');
DeleteFile('C:\WINDOWS\ndll.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','oo');
DeleteFile('C:\WINDOWS\cidrive32.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Driver Setup');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Driver Setup');
DeleteFile('C:\WINDOWS\Temp\291.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Advanced DHTML Enable');
DeleteFile('C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe');
DeleteFile('C:\Documents and Settings\Admin\pcjgsrn.exe');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MSConfig');
DeleteFile('C:\WINDOWS\System32\Drivers\kfgzgmww.sys');
BC_DeleteSvc('kfgzgmww');
DeleteFile('C:\WINDOWS\system32\zummoopatej.exe');
BC_DeleteSvc('ego83y7ei8dee');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]
После выполнения скрипта компьютер перезагрузится.
После перезагрузки:
- выполните такой скрипт
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
Пришлите файл [B][COLOR="Red"]quarantine.zip[/COLOR][/B] из папки AVZ по ссылке [COLOR="Red"][B][U]Прислать запрошенный карантин[/U][/B][/COLOR] над первым сообщением этой темы.
- Повторите логи
Высылаю архив карантина (надеюсь, так и туда, куда надо)....
Спасибо.
Не, не сюда, прочитайте пожалуйста повнимательнее, по ссылке вверху надо прислать.
[QUOTE=Olejah;732201]Не, не сюда, прочитайте пожалуйста повнимательнее, по ссылке вверху надо прислать.[/QUOTE] Выслал архив в теме по ошибке. Прошу прощения.
Продублировал по ссылке вверху темы.
[QUOTE='Olejah;731673']- Повторите логи[/QUOTE] Теперь это.
[QUOTE=Olejah;732249]Теперь это.[/QUOTE] Отправляю!
[QUOTE]Система загружена в режиме защиты от сбоев (SafeMode)[/QUOTE] Не пойдёт, логи нужны в обычном режиме.
[QUOTE=Olejah;732517]Не пойдёт, логи нужны в обычном режиме.[/QUOTE] Можно и так:
Закройте все программы
Отключите
- ПК от интернета/локалки.
- Антивирус и Файрвол
[URL="http://virusinfo.info/showthread.php?t=4905"]- Системное восстановление[/URL]
[URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в АВЗ[/URL] -
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
QuarantineFile('C:\WINDOWS\system32\umdmgr.exe','');
DeleteFile('C:\WINDOWS\system32\umdmgr.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','035');
DeleteFile('C:\WINDOWS\TEMP\winsp1up.exe');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','winsp1up.exe');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','winsp1up.exe');
DeleteFile('C:\Documents and Settings\Admin\csrss.exe');
DeleteFile('C:\Documents and Settings\Admin\Application Data\juzjf.exe');
DeleteFile('C:\RECYCLER\S-1-5-21-4527638344-9809121452-195623189-9092\yv8g67.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]
После выполнения скрипта компьютер перезагрузится.
После перезагрузки:
- выполните такой скрипт
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
Пришлите файл [B][COLOR="Red"]quarantine.zip[/COLOR][/B] из папки AVZ по ссылке [COLOR="Red"][B][U]Прислать запрошенный карантин[/U][/B][/COLOR] над первым сообщением этой темы.
- Повторите логи АВЗ
- [B]c:\program files\cdslow.exe[/B] - Вам знаком этот файл?
Высылаю логи.
Программу cdslow.exe знаю. Это программа, позволяющая ограничивать скорость CD-приводов. Загружается автоматически, висит в трее.
Сейчас выгрузил и отключил автозагрузку (явно имеет неправильную дату создания).
Что с проблемой?
[QUOTE=Olejah;732733]Что с проблемой?[/QUOTE]
Увы, все равно тормозит при выходе из системы (и до выдачи меню выхода и после, перед отключением).
Сделайте лог [URL="http://virusinfo.info/showpost.php?p=457118&postcount=1"]полного сканирования МВАМ[/URL]
Не совсем разобрался, как получить лог. Автоматически в каталог ничего не записалось. Сохранил протокол полного сканирования со всеми пакостями. Не подойдет?
После сканирования AVZ комп не перезагружал.
[url="http://virusinfo.info/showpost.php?p=493584&postcount=2"]Удалите в МВАМ[/url] [code]Зараженные ключи в реестре:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\idid (Trojan.Sasfix) -> No action taken.
Зараженные параметры в реестре:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\forceclassiccontrolpanel (Hijack.ControlPanelStyle) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_1 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_2 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\option_3 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\128.111.48.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\128.130.56.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\128.130.60.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\139.91.222.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\141.202.248.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\149.101.225.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\150.70.93.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\155.35.248.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\162.40.10.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\165.160.15.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\166.70.98.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\174.120.184.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\174.120.185.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\174.120.186.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\174.133.38.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\18.85.2.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\188.40.74.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\188.93.8.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\192.150.94.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.0.6.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.1.193.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.110.109.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.17.85.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.193.194.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.24.237.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.66.251.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.69.114.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\193.71.68.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\194.0.200.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\194.109.142.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\194.112.106.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\194.206.126.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\194.33.180.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.137.160.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.146.235.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.2.240.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.210.42.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.55.72.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.64.225.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\195.70.37.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\198.6.49.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\199.203.243.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\203.160.188.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\204.14.90.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\205.178.145.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\205.227.136.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\207.44.154.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\207.44.254.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\207.46.18.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\207.46.20.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\207.46.232.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\207.66.0.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\208.43.44.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\208.43.71.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\208.79.250.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.124.55.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.157.69.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.160.22.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.216.46.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.51.167.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.62.112.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.62.68.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\209.87.209.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\212.47.219.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\212.67.88.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\212.72.62.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\212.8.79.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\213.133.34.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\213.171.218.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\213.198.89.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\213.220.100.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\213.31.172.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\216.10.192.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\216.12.145.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\216.239.122.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\216.49.94.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\216.55.183.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\216.99.133.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\217.106.234.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\217.16.16.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\217.170.21.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\217.174.103.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\38.113.1.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.14.249.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.146.66.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.189.194.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.213.110.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.67.184.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.75.163.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\62.75.216.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\63.85.36.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.128.133.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.13.134.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.202.189.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.246.4.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.41.142.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.41.151.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.66.190.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\64.78.182.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\65.175.38.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\65.55.184.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\65.55.240.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\66.249.17.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\66.77.70.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\67.134.208.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\67.15.103.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\67.19.34.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\67.192.135.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\67.225.206.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\67.227.172.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\68.177.102.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\69.162.79.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\69.18.148.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\69.20.104.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\69.57.142.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\69.93.226.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\70.84.211.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\72.232.246.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\72.32.125.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\72.32.70.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.125.77.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.208.158.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.208.20.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.50.0.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.52.233.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.53.70.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.54.130.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.54.139.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.54.46.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.55.40.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.55.74.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.86.125.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\74.86.232.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\75.125.185.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\75.125.189.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\75.125.212.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\75.125.29.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\75.125.43.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\75.125.82.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\78.108.86.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\78.137.164.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\78.47.87.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\79.125.5.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\80.153.193.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\80.190.130.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\80.190.154.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\80.237.132.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\80.86.107.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\81.176.66.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\81.176.67.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\81.24.35.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\82.117.238.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\82.151.107.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\82.165.103.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\82.98.86.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\83.102.130.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\83.202.175.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\83.222.23.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\83.222.31.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\83.223.117.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\84.40.30.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\85.17.210.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\85.214.106.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\85.255.19.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\85.31.222.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.106.242.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.106.254.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.230.79.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.238.48.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.242.74.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.242.75.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\87.242.79.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\88.221.119.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\89.111.176.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\89.202.149.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\89.202.157.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\90.156.159.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\90.183.101.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\91.121.97.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\91.199.212.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\91.209.196.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\92.123.155.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\92.53.106.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\93.184.71.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\94.23.206.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\94.236.0.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\95.140.225.0,255.255.255.0,77.244.72.64,1 (TCPRoute.Hijack) -> No action taken.
Зараженные папки:
C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455 (Worm.AutoRun) -> No action taken.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> No action taken.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> No action taken.
Зараженные файлы:
C:\RECYCLER\S-1-5-21-1343024091-412668190-1801674531-1004\Dc22.exe (Trojan.Dropper) -> No action taken.
C:\System Volume Information\_restore{852DF3F8-DE76-425A-BD81-0FB07D2913DA}\RP126\A0069399.sys (Trojan.Agent) -> No action taken.
C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1455\Desktop.ini (Worm.AutoRun) -> No action taken.
C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> No action taken.
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> No action taken.
C:\Documents and Settings\All Users\Application Data\common.data (Malware.Trace) -> No action taken.
C:\Documents and Settings\Admin\Application Data\wiaservg.log (Malware.Trace) -> No action taken.
C:\Program Files\Common Files\keylog.txt (Malware.Trace) -> No action taken.
C:\Documents and Settings\Admin\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> No action taken.
C:\Documents and Settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) -> No action taken.
C:\WINDOWS\logfile32.txt (Malware.Trace) -> No action taken.[/code]
Провел чистку в МВАМ. Лог чистки прикреплен.
Провел сканирование после чистки. Тоже прикрепляю лог.
Проблема осталась...
Прилагаю логи AVZ после чистки.
После перезагрузки и работы программ, МВАМ новых проблем не нашел (новых зараженных объектов относительно mbam-log-2010-11-16 (19-15-53).txt не появилось).
Выполните скрипт в AVZ
[code]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('creik.sys');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end. [/code]Компьютер перезагрузится.
Больше придраться не к чему
ОГРОМНОЕ спасибо [B]thyrex[/B] и [B]Olejah[/B] за решение проблемы!!!
Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]2[/B][*]Обработано файлов: [B]33[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]