Temporary internet files, куча заражённых cab файлов

Printable View

Показывать 40 сообщений этой темы на одной странице

06.11.2008, 15:07
Alkoroller

Temporary internet files, куча заражённых cab файлов

Здравствуйте... Вот опять столкнулся с примерно той же проблемой что и раньше. Virus.Win32 _PE Type1. При попытке очистить Темп инет файлс - выпадает в BSOD. Дикое количество "hijacked" hosts....
Вот логи. Сразу же по запросу могу выслать карантин... Он большой :(
06.11.2008, 16:13
Alkoroller

Помогите пожалуйста, люди добрые...
06.11.2008, 17:06
wise-wistful

Очистите корзину.
Обновите базы АВЗ.
1.[url=http://virusinfo.info/showthread.php?t=7239]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/url]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\017[1].cab','');
QuarantineFile('C:\WINDOWS\system32\Drivers\HBKernel32.sys','');
QuarantineFile('C:\WINDOWS\system32\HBZHUXIAN.dll','');
QuarantineFile('C:\WINDOWS\system32\HBQQFFO.dll','');
QuarantineFile('C:\WINDOWS\system32\HBmhly.dll','');
QuarantineFile('C:\WINDOWS\system32\HBCHIBI.dll','');
QuarantineFile('C:\WINDOWS\system32\HBBO.dll','');
QuarantineFile('C:\WINDOWS\system32\F65BDEC7.dll','');
QuarantineFile('C:\WINDOWS\system32\E3367679.dll','');
QuarantineFile('C:\WINDOWS\system32\DE02F764.dll','');
QuarantineFile('C:\WINDOWS\system32\DA63E650.dll','');
QuarantineFile('C:\WINDOWS\system32\D91BC61E.dll','');
QuarantineFile('C:\WINDOWS\system32\C250CF20.dll','');
QuarantineFile('C:\WINDOWS\system32\A8FC611B.dll','');
QuarantineFile('C:\WINDOWS\system32\9F684DE8.dll','');
QuarantineFile('C:\WINDOWS\system32\9CA963CA.dll','');
QuarantineFile('C:\WINDOWS\system32\7ADC2AB1.dll','');
QuarantineFile('C:\WINDOWS\system32\58FF3024.dll','');
QuarantineFile('C:\WINDOWS\system32\4D023DE9.dll','');
QuarantineFile('C:\WINDOWS\system32\4BF9CBA3.dll','');
QuarantineFile('C:\WINDOWS\system32\495271CA.dll','');
QuarantineFile('C:\WINDOWS\system32\43ACDCC5.dll','');
QuarantineFile('C:\WINDOWS\system32\3474A8C2.dll','');
QuarantineFile('C:\WINDOWS\system32\22D75360.dll','');
QuarantineFile('C:\WINDOWS\system32\122B901E.dll','');
QuarantineFile('C:\WINDOWS\system32\08223B03.dll','');
DeleteFile('C:\WINDOWS\system32\System.exe');
DeleteFile('C:\WINDOWS\system32\08223B03.dll');
DeleteFile('C:\WINDOWS\system32\122B901E.dll');
DeleteFile('C:\WINDOWS\system32\22D75360.dll');
DeleteFile('C:\WINDOWS\system32\3474A8C2.dll');
DeleteFile('C:\WINDOWS\system32\495271CA.dll');
DeleteFile('C:\WINDOWS\system32\4BF9CBA3.dll');
DeleteFile('C:\WINDOWS\system32\4D023DE9.dll');
DeleteFile('C:\WINDOWS\system32\58FF3024.dll');
DeleteFile('C:\WINDOWS\system32\7ADC2AB1.dll');
DeleteFile('C:\WINDOWS\system32\9CA963CA.dll');
DeleteFile('C:\WINDOWS\system32\9F684DE8.dll');
DeleteFile('C:\WINDOWS\system32\A8FC611B.dll');
DeleteFile('C:\WINDOWS\system32\C250CF20.dll');
DeleteFile('C:\WINDOWS\system32\D91BC61E.dll');
DeleteFile('C:\WINDOWS\system32\DA63E650.dll');
DeleteFile('C:\WINDOWS\system32\DE02F764.dll');
DeleteFile('C:\WINDOWS\system32\E3367679.dll');
DeleteFile('C:\WINDOWS\system32\F65BDEC7.dll');
DeleteFile('C:\WINDOWS\system32\HBBO.dll');
DeleteFile('C:\WINDOWS\system32\HBCHIBI.dll');
DeleteFile('C:\WINDOWS\system32\HBmhly.dll');
DeleteFile('C:\WINDOWS\system32\HBQQFFO.dll');
DeleteFile('C:\WINDOWS\system32\HBZHUXIAN.dll');
DeleteFile('C:\WINDOWS\system32\Drivers\HBKernel32.sys');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\003[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\007[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\011[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\015[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\0001[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\004[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\008[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\012[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\016[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\001[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\005[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\009[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\013[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\017[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\002[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\006[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\010[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\014[1].cab');
DeleteFile('C:\Documents and Settings\alter\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\018[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\05[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\07[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\102[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\10[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\13[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\3R4MJM00\15[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\03[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\08[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\11[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\16[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\20[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\26[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\CH83Z6F2\eee[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\01[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\06[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\14[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\18[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\21[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\LIXYN95G\27[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\02[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\04[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\09[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\101[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\19[1].cab');
DeleteFile('C:\Documents and Settings\chuprov\Local Settings\Temporary Internet Files\Content.IE5\QK1DGKCM\24[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\004[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\008[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\013[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\018[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\022[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\026[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\4WMP4N9Y\030[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\0001[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\005[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\009[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\014[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\019[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\032[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\029[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\025[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\021[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\016[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\012[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\007[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\003[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\8F68D20V\001[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\031[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\027[1].cab');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temporary Internet Files\Content.IE5\5NLPOO7J\023[1].cab');
BC_ImportAll;
BC_DeleteSvc('9fd8db');
BC_DeleteSvc('8b52f47');
BC_DeleteSvc('5102a80');
BC_DeleteSvc('4901228');
BC_DeleteSvc('19b5406');
BC_DeleteSvc('HBKernel32');
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]
После выполнения скрипта компьютер перезагрузится.
Прислать карантин согласно [b]приложения 3 [url=http://virusinfo.info/showthread.php?t=1235]правил [/url][/b].
Загружать по ссылке: [url]http://virusinfo.info/upload_virus.php?tid=33394[/url]

Повторите логи.
06.11.2008, 18:02
Alkoroller

Логи и карантин:
06.11.2008, 20:16
Гриша

[URL="http://mail.ustc.edu.cn/~jfpan/download/IceSword122en.zip"]Скачать[/URL],меню,File,появится аналог проводника,найти:

[CODE]C:\WINDOWS\system32\DRIVERS\HBKernel32.sys[/CODE]

правая кнопка мыши Force Delete на запрос о перезагрузке ответьте положительно.

[URL="http://virusinfo.info/showthread.php?t=4491"]Пофиксить[/URL]

[CODE]O4 - HKLM\..\Run: [screen] \\ts1\screen\svchost.exe
O20 - AppInit_DLLs: HBmhly.dll,HB1000Y.dll,HBWOOOL.dll,HBXY2.dll,HBJXSJ.dll,HBSO2.dll,HBFS2.dll,HBXY3.dll,HBSHQ.dll,HBFY.dll,HBWULIN2.dll,HBW2I.dll,HBKDXY.dll,HBWORLD2.dll,HBASKTAO.dll,HBZHUXIAN.dll,HBWOW.dll,HBZERO.dll,HBBO.dll,HBCONQUER.dll,HBSOUL.dll,HBCHIBI.dll,HBDNF.dll,HBWARLORDS.dll,HBTL.dll,HBPICKCHINA.dll,HBCT.dll,HBGC.dll,HBHM.dll,HBHX2.dll,HBQQHX.dll,HBTW2.dll,HBQQSG.dll,HBQQFFO.dll,HBZT.dll,HBMIR2.dll,HBRXJH.dll,HBYY.dll,HBMXD.dll,HBSQ.dll,HBTJ.dll,HBFHZL.dll,HBWLQX.dll,HBLYFX.dll,HBR2.dll,HBCHD.dll,HBTZ.dll,HBQQXX.dll,HBWD.dll,HBZG.dll,HBPPBL.dll,HBXMJ.dll,HBJTLQ.dll,HBQJSJ.dll[/CODE]

[URL="http://virusinfo.info/showthread.php?t=7239"]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/URL]

[CODE]begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\DRIVERS\nvmini.sys','');
DeleteService('eth8023');
DeleteService('HBKernel32');
DeleteService('5102a80');
DeleteFile('C:\WINDOWS\system32\43ACDCC5.dll');
DeleteFile('C:\WINDOWS\system32\Drivers\HBKernel32.sys');
DeleteFile('C:\WINDOWS\system32\5102a80.sys');
DeleteFile('C:\WINDOWS\system32\DRIVERS\HBKernel32.sys');
DeleteFile('C:\WINDOWS\system32\drivers\eth8023.sys');
DeleteFile('C:\WINDOWS\system32\01BD9E17.dll');
BC_ImportALL;
ExecuteSysClean;
BC_DeleteSvc('eth8023');
BC_DeleteSvc('HBKernel32');
BC_DeleteSvc('5102a80');
BC_QrSvc('cdralw');
BC_Activate;
ExecuteRepair(13);
RebootWindows(true);
end.[/CODE]

Пришлите карантин по правилам, очистите корзину и повторите логи...
07.11.2008, 10:59
Alkoroller

Всё сделал... Icesword запускаться отказался...
07.11.2008, 11:00
Гриша

Где логи AVZ? Что написал айс?
07.11.2008, 11:09
Alkoroller

Чёрт.
Не заметил - превысил предел вложений.
Про айс - через 5 минут отпишу
07.11.2008, 11:14
Гриша

вы случайно не в безопасном режиме мой скрипт и удаление айсом делали?
07.11.2008, 11:53
Alkoroller

Ваш скрипт выполнял в обычном режиме.
Скрипт сбора инфы для раздела - в обычном.
Скрипт карантина - в обычном завис на завершении, пришлось делать в безопасном.
А айс только в обычном работает?
07.11.2008, 12:24
Гриша

Да айсом нужно работать в обычном режиме...
07.11.2008, 13:05
Alkoroller

Ок, сейчас сделаю всё заново в указанной последовательности.
07.11.2008, 14:55
Alkoroller

Вот, сделал всё по порядку в обычном режиме.
07.11.2008, 15:01
Гриша

[URL="http://virusinfo.info/showthread.php?t=4491"]Пофиксить[/URL]

[CODE]O4 - HKLM\..\Run: [HBService32] SYSTEM.EXE[/CODE]

[URL="http://virusinfo.info/showthread.php?t=7239"]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/URL]

[CODE]begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\DRIVERS\nvmini.sys','');
DeleteService('19b5406');
DeleteService('WudfSvc');
DeleteFile('C:\WINDOWS\system32\19b5406.sys');
DeleteFile('SYSTEM.EXE');
DeleteFile('F65BDEC7.dll');
DeleteFile('E3367679.dll');
DeleteFile('DE02F764.dll');
DeleteFile('C250CF20.dll');
DeleteFile('A8FC611B.dll');
DeleteFile('9F684DE8.dll');
DeleteFile('7ADC2AB1.dll');
DeleteFile('58FF3024.dll');
DeleteFile('4BF9CBA3.dll');
DeleteFile('495271CA.dll');
DeleteFile('43ACDCC5.dll');
DeleteFile('3474A8C2.dll');
DeleteFile('22D75360.dll');
DeleteFile('122B901E.dll');
DeleteFile('08223B03.dll');
DeleteFile('01BD9E17.dll');
DeleteFile('C:\Documents and Settings\market\Local Settings\Temp\QQ_Update.cab');
BC_ImportDeletedList;
ExecuteSysClean;
BC_DeleteSvc('19b5406');
BC_DeleteSvc('WudfSvc');
BC_QrSvc('cdralw');
BC_Activate;
ExecuteRepair(13);
RebootWindows(true);
end.[/CODE]

Пришлите карантин по правилам и повторите логи...
07.11.2008, 15:28
Alkoroller

Вложений: 3

Вот:
07.11.2008, 15:42
Гриша

[URL="http://virusinfo.info/showthread.php?t=7239"]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/URL]

[CODE]begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('WudfRd');
DeleteService('WudfPf');
DeleteFile('4D023DE9.dll');
DeleteFile('9CA963CA.dll');
SysCleanAddFile('4D023DE9.dll');
SysCleanAddFile('4D023DE9.dll');
BC_ImportDeletedList;
ExecuteSysClean;
BC_DeleteSvc('WudfRd');
BC_DeleteSvc('WudfPf');
BC_Activate;
RebootWindows(true);
end.[/CODE]

Повторить логи...
07.11.2008, 16:35
Alkoroller

Вложений: 3

Готово, скрипт лечения/карантина в обычном режиме опять повис, после вылета ошибки в процессе svchost.
07.11.2008, 16:47
V_Bond

проверку cureit выполняли ? (вот это нужно делать в safe mode)
07.11.2008, 16:49
Alkoroller

Выполнял, перед всеми вышеописанными действиями. Она повисла :(
07.11.2008, 16:56
V_Bond

значит проверяйтесь при помощи [URL="http://freedrweb.com/livecd"]этого[/URL]

Показывать 40 сообщений этой темы на одной странице