Подозрительная активност после отлова Trojan-ов

Посмитрите логи пожалуйста. CureLt и AVZ наловил кучу
Trojan.Win32.Pincan.ajmg
Trojan.Win32.VB.amax
Trojan.PWS.Multi
Email-Worm.MSIL.Agent
вродебы все по удалялось но осталась активность интернет соединения при полном бездействии со стороны пользователя. Идет постоянный прием и отправка пакето в по 2-4 кб в обе стороны

- [URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/URL]
[CODE]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Documents and Settings\Papa\Application Data\10225..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\00748..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\515399..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\463..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\612..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\406..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\588..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\5281914..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\997283..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\3974150..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\740..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\3045..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\034020..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\309..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\243..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\59535..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\2884..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\184523..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\2984329..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\0677794..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\425..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\319..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\1452..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\2779058..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\79589..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\586..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\944814..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\8783..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\344306..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\5468.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\6443.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\940326.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\979.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\689.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\58122.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\1798.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\1251735.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\541170.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\774..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\968781..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\7140108..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\47310..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\6143590..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\870983..exe','');
DeleteFile('C:\Documents and Settings\Deti\Application Data\870983..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\6143590..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\47310..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\7140108..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\968781..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\774..exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\541170.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\1251735.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\1798.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\58122.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\689.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\979.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\940326.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\6443.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\5468.exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\344306..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\8783..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\944814..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\586..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\79589..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\2779058..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\1452..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\319..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\425..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\0677794..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\2984329..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\184523..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\2884..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\59535..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\43966..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\6577114..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\243..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\309..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\034020..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\3045..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\740..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\3974150..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\997283..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\588..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\406..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\612..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\463..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\515399..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\00748..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\10225..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\157..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\699..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\994..exe');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\506604..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\6443..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\3121..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\940326..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\51074..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\979..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\5629..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\0681193..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\689..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\58122..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\29209..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\5481..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\1798..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\549136..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\1251735..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\541170..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\75323..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\5481.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\549136.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\2738889..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\867055..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\1639..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\4197677..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\1617044..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\644114..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\9325..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\3088..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\7105..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\7543938..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\157..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\699..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\994..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\0169777..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe','');
DeleteFile('C:\Documents and Settings\Deti\Application Data\506604..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\6443..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\3121..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\940326..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\51074..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\979..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\5629..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\0681193..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\689..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\58122..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\29209..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\5481..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\1798..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\549136..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\1251735..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\541170..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\75323..exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\5481.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\549136.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\2738889..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\867055..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\1639..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\4197677..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\1617044..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\644114..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\9325..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\3088..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\7105..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\7543938..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\157..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\699..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\994..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\0169777..exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe');
QuarantineFileF('C:\Documents and Settings\Deti\Local Settings\temp','*.exe', false,'', 0, 0, '','');
QuarantineFileF('C:\Documents and Settings\Papa\Application Data','*..exe', false,'', 0, 0, '','');
DeleteFileMask('C:\Documents and Settings\Deti\Local Settings\temp', '*.*', true);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]

После перезагрузки:
- выполните такой скрипт
[CODE]begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]
- Файл [B][COLOR="Red"]quarantine.zip[/COLOR][/B] из папки AVZ загрузите по ссылке [B][COLOR="Red"]Прислать запрошенный карантин[/COLOR][/B] вверху темы
- Сделайте повторные логи по [URL="http://virusinfo.info/pravila_old.html"]правилам[/URL] п.2 и 3 раздела Диагностика.([COLOR="Blue"]virusinfo_syscheck.zip;hijackthis.log[/COLOR])
- Сделайте лог [URL="http://virusinfo.info/showpost.php?p=457118&postcount=1"][COLOR="Blue"][B]MBAM[/B][/COLOR][/URL]

логи АВЗ прилагаю
логи МВАМ делаются

лог МВАМ получить не удается, на 10-12 минуте сканирования комп уходит в перезагрузку

Вложений: 1

Будьте так любезны, гляньте плиз последние логи.
Запрошеный карантин был прилеплен.
Лог МВАМ так и не удалось получить, на 12 минуте сканирования комп уходит в перезагрузку :ohmy:

Ура - удалось сделать лог МВАМ
Посмотрите пожалуйста

наверное все спят :unsure:

1.[URL="http://virusinfo.info/showthread.php?t=4491"]Профиксите[/URL] в HijackThis
[CODE]
O20 - Winlogon Notify: reset5e - reset5e.dll (file missing)
[/CODE]
2.[URL="http://virusinfo.info/showthread.php?t=7239"]Выполните скрипт в AVZ[/URL]
[CODE]
begin
DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
QuarantineFile('c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5\0RK4LGLB\56[1].exe ','');
QuarantineFile('c:\documents and settings\Deti\application data\5468..vexe','');
QuarantineFile('c:\documents and settings\Papa\application data\195..vexe ','');
QuarantineFile('c:\documents and settings\Papa\application data\8542816..vexe','');
DeleteFileMask('c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5', '*.*', true);
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.[/CODE]

- Файл [B][COLOR="Red"]quarantine.zip[/COLOR][/B] из папки AVZ загрузите по ссылке [B][COLOR="Red"]Прислать запрошенный карантин[/COLOR][/B] вверху темы

- [URL="http://virusinfo.info/showpost.php?p=493584&postcount=2"]удалите[/URL] в [B]MBAM[/B]
[CODE]
Заражённые папки:
c:\RECYCLER\s-1-5-21-0243556031-888888379-781863308-1455 (Worm.AutoRun) -> No action taken.
c:\RECYCLER\s-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> No action taken.

Заражённые файлы:
c:\documents and settings\Papa\application data\195..vexe (Trojan.Agent) -> No action taken.
c:\documents and settings\Papa\application data\8542816..vexe (Trojan.Agent) -> No action taken.
c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5\0RK4LGLB\56[1].exe (Trojan.Dropper) -> No action taken.
c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5\0RK4LGLB\fox[1].gif (Extension.Mismatch) -> No action taken.
c:\documents and settings\Deti\application data\5468..vexe (Trojan.Agent) -> No action taken.
c:\WINDOWS\logfile32.txt (Malware.Trace) -> No action taken.
c:\RECYCLER\s-1-5-21-0243556031-888888379-781863308-1455\Desktop.ini (Worm.AutoRun) -> No action taken.
c:\RECYCLER\s-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> No action taken.

[/CODE]
- Сделайте повторный лог [URL="http://virusinfo.info/showpost.php?p=457118&postcount=1"][COLOR="Blue"][B]MBAM[/B][/COLOR][/URL]

какрантин прилепил
Выполнить МВАМ не получается пока - комп при выполнении уходит в перезагрузку.

что с проблемами?

ну активновсть небольшая всетаки осталась, видимо решить это можно будет только радикальной переустановкой Винды. Если получится сделать лог МВАМ, почищу по указаному шаблон. Пока почитистил в руками то что указано в логе МВАМ
что меня больше всего беспокоит - [B]это большое количество процессов svhost.exe [/B] 8шт - непонятно чем он занимается ???

[QUOTE='storno2001;747847']что меня больше всего беспокоит - это большое количество процессов svhost.exe 8шт - непонятно чем он занимается ???[/QUOTE]
в этом нет ничего плохого.

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]2[/B][*]Обработано файлов: [B]40[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]