Блокируется доступ на сайт касперского HELP [Rootkit.Win32.TDSS.dio, , HackTool.Win32.KKFinder.a ]

Printable View

10.01.2009, 18:12
KOT_DOG

Блокируется доступ на сайт касперского HELP [Rootkit.Win32.TDSS.dio, , HackTool.Win32.KKFinder.a ]

Здраствуйте. У меня 2 проблемы:
1. Установлен KAV 7.0.325 пытаюсь обновиться пишет Ошибка при подключении к источнику обновлений сайт касперского тоже не доступен. на все осттальные сайты захожу без проблем. сетевой активности вроде нет.
2. Браузер Maxthon. При входе на сайты попутно открывается еще одно окно с рекламой ( рандомно ). от сайта это не зависит. В IE точно такая же вещь.
10.01.2009, 18:13
Гриша

[url]http://virusinfo.info/showthread.php?t=1235[/url]
10.01.2009, 18:15
KOT_DOG

не могу загрузить файлы. пишет что Ваш аккаунт имеет недостаточно прав для доступа к этой странице. Вы пытаетесь редактировать чьё-то сообщение, использовать административные полномочия или прочие опции ограниченного доступа?
Вы пытаетесь написать сообщение, но ваш аккаунт отключён администрацией или ожидает активации.
10.01.2009, 18:16
Гриша

Активацию по e-mail проходили?
10.01.2009, 18:17
KOT_DOG

Конечно. Пишет что авторизирован и просят залогинится
10.01.2009, 18:26
Гриша

Залейте сюда [url]http://www.virusinfo.ifolder.ru/[/url] в одном архиве и дайте ссылку...
10.01.2009, 20:31
Гриша

Нужна ссылка на закачку, а не на управление файлами...
10.01.2009, 20:56
KOT_DOG

извините подобным сервисом ни разу не пользовался. не знаю где там взять ссылку имеено на файл. Могу дать номер моего файла 9962219.
10.01.2009, 20:58
Гриша

Залейте [url]http://depositfiles.com/ru/[/url]
10.01.2009, 21:18
KOT_DOG

[url]http://depositfiles.com/files/fhz785bwz[/url]
10.01.2009, 21:24
Гриша

Архив битый...
10.01.2009, 21:33
KOT_DOG

ДА что за неудачи то ....ррр...
повторим тогда...[url]http://depositfiles.com/files/jvshxo0wp[/url]
10.01.2009, 21:41
Гриша

Я торжественно вручаю вашей системе звание "Помойка года" :)

[URL="http://virusinfo.info/showthread.php?t=7239"]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/URL]

[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('fed4410820d3f377');
DeleteService('fd339f448daf534b');
DeleteService('fc9dbfc85eda13b1');
DeleteService('faec9fac4c529a93');
DeleteService('f95c7c402258299a');
DeleteService('f94bfde8a8f6ab87');
DeleteService('f830bd48cefecb24');
DeleteService('f7bbda7c8ef726b6');
DeleteService('f7ab5c2415a5a2a4');
DeleteService('f6a099dca2ff4e1b');
DeleteService('f574dae44144017e');
DeleteService('f34ed7fcfee1e722');
DeleteService('f33e59a4896ba037');
DeleteService('f11856bc24dac7e4');
DeleteService('ef77b4f8987d4610');
DeleteService('eee1d57c6eb3e7ae');
DeleteService('ee4bf6003bd6773b');
DeleteService('ecab543c90bd0757');
DeleteService('eb1b30d07a318397');
DeleteService('ea74d2fcde8da619');
DeleteService('e9ef71d812503041');
DeleteService('e7c96ef0c516338d');
DeleteService('e628cd2c3eb312e2');
DeleteService('e5826f589a2311d4');
DeleteService('e50d8c8c5abbc207');
DeleteService('e3e1cd94fe1e1b49');
DeleteService('e2412bd0427d0b7e');
DeleteService('e1bbcaac8e80716d');
DeleteService('e1ab4c5437cfec03');
DeleteService('e1366988f7d7795d');
DeleteService('e125eb307d60fa5b');
DeleteService('e0a08a0caa940192');
DeleteService('deef69f0b58b8a94');
DeleteService('ddd42950d5844af1');
DeleteService('db1846ec54ff11c3');
DeleteService('da92e5c89f0a470a');
DeleteService('d8f24404f92f3777');
DeleteService('d8e1c5ac6ee1be05');
DeleteService('d86ce2e02ee5a147');
DeleteService('d7c6850c83158669');
DeleteService('d74123e8ca6aac11');
DeleteService('d5a0822459b4de2e');
DeleteService('d3ef6208377ee7f8');
DeleteService('d36a00e46195cee0');
DeleteService('d24ec0448d9878c4');
DeleteService('d1337fa4b584f8b9');
DeleteService('d028bd5c5b6ecb19');
DeleteService('cefcfe64fde38873');
DeleteService('cdf23c1c6319dc43');
DeleteService('cc519a58c1f12a37');
DeleteService('cc411c007a27d2c5');
DeleteService('c7d41980ca75b438');
DeleteService('c75f36b48a8cc102');
DeleteService('c3fcf67c509cd31f');
DeleteService('c377955899b1e94e');
DeleteService('c2f234342342febe');
DeleteService('c2e1b5dcaa9000a3');
DeleteService('c1411418d1baf988');
DeleteService('bfa07254761e1495');
DeleteService('bd69f114a80f944e');
DeleteService('bc4eb0748307af63');
DeleteService('babe8d08a7b5225a');
DeleteService('b8778d7064d80092');
DeleteService('b7f22c4cad87d9d9');
DeleteService('b75c4cd078a450cf');
DeleteService('b6d6ebac807f19fe');
DeleteService('b2ffc8a86be2fc55');
DeleteService('b0d9c5c0d9585821');
DeleteService('ae92c6289bf4dbd8');
DeleteService('ae0d6504d1400080');
DeleteService('ab5182a056bd3632');
DeleteService('a9a062844573411c');
DeleteService('a88521e4ad831170');
DeleteService('a6e48020c6de14a5');
DeleteService('a5c93f802cc6ecc2');
DeleteService('a4adfee030ce741f');
DeleteService('a4391c14eed9e9e9');
DeleteService('a4289dbc583b7fef');
DeleteService('a392be400ae5fcfc');
DeleteService('9fbb9b3ce45c1f5a');
DeleteService('9ec1574cec2d3274');
DeleteService('9eb0d8f45a8aad7a');
DeleteService('9ea05a9cc348287f');
DeleteService('9c7a57b4ace23cb3');
DeleteService('9b5f17148ede24d0');
DeleteService('9ad9b5f037690b88');
DeleteService('9ac93798b98b8595');
DeleteService('99cef3a8a0df59f7');
DeleteService('99adf6f89d9badf2');
DeleteService('9787f410600c8bbf');
DeleteService('96f214941e3f634c');
DeleteService('9561f12834a1667b');
DeleteService('955172d0ba13fb78');
DeleteService('9446b08828b5ed58');
DeleteService('93b0d10cc9f77195');
DeleteService('932b6fe8028a4525');
DeleteService('931af190fc54c832');
DeleteService('918ace24a655d7d9');
DeleteService('917a4fcc11e75ddf');
DeleteService('905f0f2c7d8e85fc');
DeleteService('8f544ce4ec373613');
DeleteService('8eceebc0250800ab');
DeleteService('8e288dec419a25c6');
DeleteService('8c87ec28e4452752');
DeleteService('8b6cab88c7712e7f');
DeleteService('8a516ae82a64c61c');
DeleteService('89dc881cea7e952e');
DeleteService('89362a480f689fb9');
DeleteService('8443c6a4d6fb06bc');
DeleteService('8187e44029965c06');
DeleteService('8102831cf3bb1245');
DeleteService('7fe7427c8fc3c22a');
DeleteService('7edc8034226d318a');
DeleteService('7ecc01dcab30b38f');
DeleteService('7e571f10ebba4cc1');
DeleteService('7e46a0b8701fb8df');
DeleteService('7dc13f94396921ef');
DeleteService('7af4ded8c1215ac5');
DeleteService('7a5eff5c1300d03b');
DeleteService('79d99e38e43d1aa2');
DeleteService('78cedbf07787f772');
DeleteService('771dbbd4669dfc1c');
DeleteService('76027b347a8674b1');
DeleteService('74f7b8ec89281820');
DeleteService('734698d0fbcc5fe2');
DeleteService('722b58309fd0d7df');
DeleteService('71a5f70c6805a90f');
DeleteService('707a38148cccae41');
DeleteService('6f6f75cc1e773e51');
DeleteService('6eea14a8eac22578');
DeleteService('6e54352c397f3676');
DeleteService('6cc411c00578db35');
DeleteService('6cb393689cda4422');
DeleteService('6c1db3ece14e953f');
DeleteService('6961d1886682cac9');
DeleteService('67b0b16c55aaf5cb');
DeleteService('66100fa832e56a50');
DeleteService('659b2cdc72fedd6a');
DeleteService('647fec3c18f6248f');
DeleteService('6364ab9c3cce0c2c');
DeleteService('62cecc200a3dadb9');
DeleteService('6238eca44874c326');
DeleteService('611dac046303329b');
DeleteService('60a8c938a38b47c5');
DeleteService('6012e9bc94a5a4fa');
DeleteService('5f8d88985f788fe2');
DeleteService('5ee72ac43b6ab2dd');
DeleteService('5e7247f8787ca70f');
DeleteService('5e61c9a0e1de2c2c');
DeleteService('5d4689009dd65449');
DeleteService('5b2086182f58f076');
DeleteService('5a8aa69c1cab8f4b');
DeleteService('58ea04d8e757ff3f');
DeleteService('5738e4bcf45de7d1');
DeleteService('56c401f0345694fc');
DeleteService('56b38398bf28eef9');
DeleteService('55a8c1502b5e9b19');
DeleteService('5502637c8e6c979b');
DeleteService('54081f8cb6bca335');
DeleteService('53724010e36f0a52');
DeleteService('52dc6094d1ddac5f');
DeleteService('51d19e4c40ac007f');
DeleteService('51c11ff4f9c9857c');
DeleteService('513bbed0b37cba6c');
DeleteService('50b65dac6ca0305c');
DeleteService('50a5df54e5aebd11');
DeleteService('4f15bbe8c12fddc8');
DeleteService('4f053d907b8c4b26');
DeleteService('4e7fdc6c32d89326');
DeleteService('4d541d7455b742e8');
DeleteService('4bc3fa08b00645df');
DeleteService('4b2e1a8ce6e6e20c');
DeleteService('48f7994ca8f78556');
DeleteService('487238286122ec66');
DeleteService('47ecd704dbb1d665');
DeleteService('46d19664ffa55f9a');
DeleteService('46c1180c7616e598');
DeleteService('464c3540b6885032');
DeleteService('45207648ce4b268c');
DeleteService('449b152487b44fdc');
DeleteService('440535a8f5752ee9');
DeleteService('3e9def3843d50a7f');
DeleteService('3e7cf2885490007a');
DeleteService('3df791641fc4df62');
DeleteService('3cdc50c4fbfb0646');
DeleteService('3bd18e7c49257536');
DeleteService('3b3baf009d06f5d3');
DeleteService('39052dc05167f58d');
DeleteService('387fcc9c1ab8c2dd');
DeleteService('3412ca1c8a980048');
DeleteService('31dc48dc4491a3b2');
DeleteService('31676610851ed6dc');
DeleteService('2fb645f4b81addc6');
DeleteService('2e9b05548502959b');
DeleteService('2e15a4305cf74eb3');
DeleteService('2bcea4989f1be40a');
DeleteService('2b4943745426fe72');
DeleteService('2ac3e250ecedf769');
DeleteService('2a3e812cbb80ef61');
DeleteService('2a2e02d4313f7617');
DeleteService('29a8a1b0c8e00046');
DeleteService('24c6bc64bf15320c');
DeleteService('24b63e0c3447b512');
DeleteService('2430dce8cd1abdb9');
DeleteService('21647c2cc31e2c78');
DeleteService('20df1b0885f31a40');
DeleteService('20493b8cb811d59d');
DeleteService('1e33b6fc9de1fddc');
DeleteService('1d9dd780ce837ae9');
DeleteService('1d8d592839f58ad7');
DeleteService('1c72188811c078f4');
DeleteService('1becb764de9573eb');
DeleteService('1ad176c4ba89c3c8');
DeleteService('19b63624908513ad');
DeleteService('1930d5005eb25d5d');
DeleteService('1559b1fcbd053e3b');
DeleteService('143e715c9230a698');
DeleteService('13a891e0c0efb5ed');
DeleteService('117210a09af91627');
DeleteService('0fd16edc2a401804');
DeleteService('0f4c0db8e3afee53');
DeleteService('0e30cd18cf876670');
DeleteService('0d260ad0315d4a80');
DeleteService('094ee7cc9f2cd3f6');
DeleteService('093e697416295dc4');
DeleteService('044c05d0595cc867');
DeleteService('03b62654892fa114');
DeleteService('03414388c8b61c56');
DeleteService('00fa43f008ab5b9e');
DeleteService('0074e2ccbf866ccd');
QuarantineFile('\systemroot\system32\drivers\msqpdxfnvenpkj.sys','');
DeleteFile('\systemroot\system32\drivers\msqpdxfnvenpkj.sys');
DeleteFile('msansspc.dll');
BC_ImportALL;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]

Пришлите карантин по правилам и повторите логи...
11.01.2009, 15:37
KOT_DOG

Вложений: 3

послыаю логи
11.01.2009, 15:49
KOT_DOG

при загрузке карантина произошел сбой=( при повторной загрузке пишет что файл уже загружен. что сделать?
11.01.2009, 15:59
light59

Карантин получен

[size="1"][color="#666686"][B][I]Добавлено через 8 минут[/I][/B][/color][/size]

А AVZ
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DelBHO('{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2}');
BC_DeleteSvc('fed4410820d3f377');
BC_DeleteSvc('fd339f448daf534b');
BC_DeleteSvc('fc9dbfc85eda13b1');
BC_DeleteSvc('faec9fac4c529a93');
BC_DeleteSvc('f95c7c402258299a');
BC_DeleteSvc('f94bfde8a8f6ab87');
BC_DeleteSvc('f830bd48cefecb24');
BC_DeleteSvc('f7bbda7c8ef726b6');
BC_DeleteSvc('f7ab5c2415a5a2a4');
BC_DeleteSvc('f6a099dca2ff4e1b');
BC_DeleteSvc('f574dae44144017e');
BC_DeleteSvc('f34ed7fcfee1e722');
BC_DeleteSvc('f33e59a4896ba037');
BC_DeleteSvc('f11856bc24dac7e4');
BC_DeleteSvc('ef77b4f8987d4610');
BC_DeleteSvc('eee1d57c6eb3e7ae');
BC_DeleteSvc('ee4bf6003bd6773b');
BC_DeleteSvc('ecab543c90bd0757');
BC_DeleteSvc('eb1b30d07a318397');
BC_DeleteSvc('ea74d2fcde8da619');
BC_DeleteSvc('e9ef71d812503041');
BC_DeleteSvc('e7c96ef0c516338d');
BC_DeleteSvc('e628cd2c3eb312e2');
BC_DeleteSvc('e5826f589a2311d4');
BC_DeleteSvc('e50d8c8c5abbc207');
BC_DeleteSvc('e3e1cd94fe1e1b49');
BC_DeleteSvc('e2412bd0427d0b7e');
BC_DeleteSvc('e1bbcaac8e80716d');
BC_DeleteSvc('e1ab4c5437cfec03');
BC_DeleteSvc('e1366988f7d7795d');
BC_DeleteSvc('e125eb307d60fa5b');
BC_DeleteSvc('e0a08a0caa940192');
BC_DeleteSvc('db1846ec54ff11c3');
BC_DeleteSvc('ddd42950d5844af1');
BC_DeleteSvc('deef69f0b58b8a94');
BC_DeleteSvc('da92e5c89f0a470a');
BC_DeleteSvc('d8f24404f92f3777');
BC_DeleteSvc('d8e1c5ac6ee1be05');
BC_DeleteSvc('d86ce2e02ee5a147');
BC_DeleteSvc('d7c6850c83158669');
BC_DeleteSvc('d74123e8ca6aac11');
BC_DeleteSvc('d5a0822459b4de2e');
BC_DeleteSvc('d3ef6208377ee7f8');
BC_DeleteSvc('d36a00e46195cee0');
BC_DeleteSvc('d24ec0448d9878c4');
BC_DeleteSvc('d1337fa4b584f8b9');
BC_DeleteSvc('d028bd5c5b6ecb19');
BC_DeleteSvc('cefcfe64fde38873');
BC_DeleteSvc('cdf23c1c6319dc43');
BC_DeleteSvc('cc519a58c1f12a37');
BC_DeleteSvc('cc411c007a27d2c5');
BC_DeleteSvc('c7d41980ca75b438');
BC_DeleteSvc('c75f36b48a8cc102');
BC_DeleteSvc('c3fcf67c509cd31f');
BC_DeleteSvc('c377955899b1e94e');
BC_DeleteSvc('c2f234342342febe');
BC_DeleteSvc('c2e1b5dcaa9000a3');
BC_DeleteSvc('c1411418d1baf988');
BC_DeleteSvc('bfa07254761e1495');
BC_DeleteSvc('bd69f114a80f944e');
BC_DeleteSvc('bc4eb0748307af63');
BC_DeleteSvc('babe8d08a7b5225a');
BC_DeleteSvc('b8778d7064d80092');
BC_DeleteSvc('b7f22c4cad87d9d9');
BC_DeleteSvc('b75c4cd078a450cf');
BC_DeleteSvc('b6d6ebac807f19fe');
BC_DeleteSvc('b38529ccd155f5a5');
BC_DeleteSvc('b2ffc8a86be2fc55');
BC_DeleteSvc('b0d9c5c0d9585821');
BC_DeleteSvc('ae92c6289bf4dbd8');
BC_DeleteSvc('ae0d6504d1400080');
BC_DeleteSvc('ab5182a056bd3632');
BC_DeleteSvc('a9a062844573411c');
BC_DeleteSvc('a88521e4ad831170');
BC_DeleteSvc('a6e48020c6de14a5');
BC_DeleteSvc('a5c93f802cc6ecc2');
BC_DeleteSvc('a4adfee030ce741f');
BC_DeleteSvc('a4391c14eed9e9e9');
BC_DeleteSvc('a4289dbc583b7fef');
BC_DeleteSvc('a392be400ae5fcfc');
BC_DeleteSvc('9fbb9b3ce45c1f5a');
BC_DeleteSvc('9ec1574cec2d3274');
BC_DeleteSvc('9eb0d8f45a8aad7a');
BC_DeleteSvc('9ea05a9cc348287f');
BC_DeleteSvc('9c7a57b4ace23cb3');
BC_DeleteSvc('9b5f17148ede24d0');
BC_DeleteSvc('9ad9b5f037690b88');
BC_DeleteSvc('9ac93798b98b8595');
BC_DeleteSvc('99cef3a8a0df59f7');
BC_DeleteSvc('99adf6f89d9badf2');
BC_DeleteSvc('9787f410600c8bbf');
BC_DeleteSvc('96f214941e3f634c');
BC_DeleteSvc('9561f12834a1667b');
BC_DeleteSvc('955172d0ba13fb78');
BC_DeleteSvc('9446b08828b5ed58');
BC_DeleteSvc('93b0d10cc9f77195');
BC_DeleteSvc('932b6fe8028a4525');
BC_DeleteSvc('931af190fc54c832');
BC_DeleteSvc('918ace24a655d7d9');
BC_DeleteSvc('917a4fcc11e75ddf');
BC_DeleteSvc('905f0f2c7d8e85fc');
BC_DeleteSvc('8f544ce4ec373613');
BC_DeleteSvc('8eceebc0250800ab');
BC_DeleteSvc('8e288dec419a25c6');
BC_DeleteSvc('8c87ec28e4452752');
BC_DeleteSvc('8b6cab88c7712e7f');
BC_DeleteSvc('8a516ae82a64c61c');
BC_DeleteSvc('89dc881cea7e952e');
BC_DeleteSvc('89362a480f689fb9');
BC_DeleteSvc('8443c6a4d6fb06bc');
BC_DeleteSvc('8187e44029965c06');
BC_DeleteSvc('8102831cf3bb1245');
BC_DeleteSvc('7fe7427c8fc3c22a');
BC_DeleteSvc('7edc8034226d318a');
BC_DeleteSvc('7ecc01dcab30b38f');
BC_DeleteSvc('7e571f10ebba4cc1');
BC_DeleteSvc('7e46a0b8701fb8df');
BC_DeleteSvc('7dc13f94396921ef');
BC_DeleteSvc('7af4ded8c1215ac5');
BC_DeleteSvc('7a5eff5c1300d03b');
BC_DeleteSvc('79d99e38e43d1aa2');
BC_DeleteSvc('78cedbf07787f772');
BC_DeleteSvc('771dbbd4669dfc1c');
BC_DeleteSvc('76027b347a8674b1');
BC_DeleteSvc('74f7b8ec89281820');
BC_DeleteSvc('734698d0fbcc5fe2');
BC_DeleteSvc('722b58309fd0d7df');
BC_DeleteSvc('71a5f70c6805a90f');
BC_DeleteSvc('707a38148cccae41');
BC_DeleteSvc('6f6f75cc1e773e51');
BC_DeleteSvc('6eea14a8eac22578');
BC_DeleteSvc('6e54352c397f3676');
BC_DeleteSvc('6cc411c00578db35');
BC_DeleteSvc('6cb393689cda4422');
BC_DeleteSvc('6c1db3ece14e953f');
BC_DeleteSvc('6961d1886682cac9');
BC_DeleteSvc('67b0b16c55aaf5cb');
BC_DeleteSvc('66100fa832e56a50');
BC_DeleteSvc('659b2cdc72fedd6a');
BC_DeleteSvc('647fec3c18f6248f');
BC_DeleteSvc('63ea0cc0653ada1c');
BC_DeleteSvc('6364ab9c3cce0c2c');
BC_DeleteSvc('62cecc200a3dadb9');
BC_DeleteSvc('6238eca44874c326');
BC_DeleteSvc('611dac046303329b');
BC_DeleteSvc('60a8c938a38b47c5');
BC_DeleteSvc('6012e9bc94a5a4fa');
BC_DeleteSvc('5f8d88985f788fe2');
BC_DeleteSvc('5ee72ac43b6ab2dd');
BC_DeleteSvc('5e7247f8787ca70f');
BC_DeleteSvc('5e61c9a0e1de2c2c');
BC_DeleteSvc('5d4689009dd65449');
BC_DeleteSvc('5b2086182f58f076');
BC_DeleteSvc('5a8aa69c1cab8f4b');
BC_DeleteSvc('58ea04d8e757ff3f');
BC_DeleteSvc('5738e4bcf45de7d1');
BC_DeleteSvc('56c401f0345694fc');
BC_DeleteSvc('56b38398bf28eef9');
BC_DeleteSvc('55a8c1502b5e9b19');
BC_DeleteSvc('5502637c8e6c979b');
BC_DeleteSvc('54081f8cb6bca335');
BC_DeleteSvc('53724010e36f0a52');
BC_DeleteSvc('52dc6094d1ddac5f');
BC_DeleteSvc('51d19e4c40ac007f');
BC_DeleteSvc('51c11ff4f9c9857c');
BC_DeleteSvc('513bbed0b37cba6c');
BC_DeleteSvc('50b65dac6ca0305c');
BC_DeleteSvc('50a5df54e5aebd11');
BC_DeleteSvc('4f15bbe8c12fddc8');
BC_DeleteSvc('4f053d907b8c4b26');
BC_DeleteSvc('4e7fdc6c32d89326');
BC_DeleteSvc('4d541d7455b742e8');
BC_DeleteSvc('4bc3fa08b00645df');
BC_DeleteSvc('4b2e1a8ce6e6e20c');
BC_DeleteSvc('48f7994ca8f78556');
BC_DeleteSvc('487238286122ec66');
BC_DeleteSvc('47ecd704dbb1d665');
BC_DeleteSvc('46d19664ffa55f9a');
BC_DeleteSvc('46c1180c7616e598');
BC_DeleteSvc('464c3540b6885032');
BC_DeleteSvc('45207648ce4b268c');
BC_DeleteSvc('449b152487b44fdc');
BC_DeleteSvc('440535a8f5752ee9');
BC_DeleteSvc('3e9def3843d50a7f');
BC_DeleteSvc('3e7cf2885490007a');
BC_DeleteSvc('3df791641fc4df62');
BC_DeleteSvc('3cdc50c4fbfb0646');
BC_DeleteSvc('3bd18e7c49257536');
BC_DeleteSvc('3b3baf009d06f5d3');
BC_DeleteSvc('39052dc05167f58d');
BC_DeleteSvc('387fcc9c1ab8c2dd');
BC_DeleteSvc('3412ca1c8a980048');
BC_DeleteSvc('31dc48dc4491a3b2');
BC_DeleteSvc('31676610851ed6dc');
BC_DeleteSvc('2fb645f4b81addc6');
BC_DeleteSvc('2e9b05548502959b');
BC_DeleteSvc('2e15a4305cf74eb3');
BC_DeleteSvc('2bcea4989f1be40a');
BC_DeleteSvc('2b4943745426fe72');
BC_DeleteSvc('2ac3e250ecedf769');
BC_DeleteSvc('2a3e812cbb80ef61');
BC_DeleteSvc('2a2e02d4313f7617');
BC_DeleteSvc('29a8a1b0c8e00046');
BC_DeleteSvc('24c6bc64bf15320c');
BC_DeleteSvc('24b63e0c3447b512');
BC_DeleteSvc('2430dce8cd1abdb9');
BC_DeleteSvc('21647c2cc31e2c78');
BC_DeleteSvc('20df1b0885f31a40');
BC_DeleteSvc('20493b8cb811d59d');
BC_DeleteSvc('1e33b6fc9de1fddc');
BC_DeleteSvc('1d9dd780ce837ae9');
BC_DeleteSvc('1d8d592839f58ad7');
BC_DeleteSvc('1c72188811c078f4');
BC_DeleteSvc('1becb764de9573eb');
BC_DeleteSvc('1ad176c4ba89c3c8');
BC_DeleteSvc('19b63624908513ad');
BC_DeleteSvc('1930d5005eb25d5d');
BC_DeleteSvc('1559b1fcbd053e3b');
BC_DeleteSvc('143e715c9230a698');
BC_DeleteSvc('13a891e0c0efb5ed');
BC_DeleteSvc('117210a09af91627');
BC_DeleteSvc('0fd16edc2a401804');
BC_DeleteSvc('0f4c0db8e3afee53');
BC_DeleteSvc('0e30cd18cf876670');
BC_DeleteSvc('0d260ad0315d4a80');
BC_DeleteSvc('094ee7cc9f2cd3f6');
BC_DeleteSvc('093e697416295dc4');
BC_DeleteSvc('044c05d0595cc867');
BC_DeleteSvc('03b62654892fa114');
BC_DeleteSvc('03414388c8b61c56');
BC_DeleteSvc('00fa43f008ab5b9e');
BC_DeleteSvc('0074e2ccbf866ccd');
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/code]
Логи повторите.
P.S. У меня пальцы отсохли... :)
11.01.2009, 18:34
KOT_DOG

Вложений: 3

Ребят спасибо большое что возитесь вообще=) я фигею сколько скриптов=) научится бы самому лечить было бы круто=) выкладываю логи повторно...
11.01.2009, 20:22
Гриша

[URL="http://virusinfo.info/showthread.php?t=7239"]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/URL]

[CODE]begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('upperdev');
QuarantineFile('C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys','');
DeleteFile('C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys');
BC_ImportALL;
ExecuteSysClean;
BC_DeleteSvc('upperdev');
BC_Activate;
RebootWindows(true);
end.[/CODE]

Пришлите карантин по правилам и повторите пункт 2 диагностики...
11.01.2009, 23:11
KOT_DOG

Вложений: 1

карантин послал. лог по пункту 2 диагностики прилагаю.
12.01.2009, 09:39
light59

Ничего подозрительного не вижу.
Жалобы есть?
12.01.2009, 17:58
KOT_DOG

проверил касперским систему. находит вот что :удалено: вирус Worm.Win32.AutoTDSS.jr Файл: C:\Documents and Settings\Admin\Application Data\The Bat!\Yandex\Sent\MESSAGES.TBB
удалено: вирус Worm.Win32.AutoTDSS.dx Файл: C:\Documents and Settings\Admin\Application Data\The Bat!\Yandex\Sent\MESSAGES.TBB

и еще постоянно появляется это
удалено: рекламная программа not-a-virus:AdWare.Win32.Agent.ivf Файл: C:\WINDOWS\system32\msqpdxctnmesoq.dll
22.02.2009, 09:56
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]2[/B][*]Обработано файлов: [B]12[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\\windows\\system32\\drivers\\msqpdxfnvenpkj.sys - [B]Rootkit.Win32.TDSS.dio[/B] (DrWEB: BackDoor.Tdss.43)[/LIST][/LIST]