avast! находит, но не лечит (AutoIt:Balero-A2 [Wrm])

Printable View

02.09.2009, 19:34
no_war

Вложений: 3

avast! находит, но не лечит (AutoIt:Balero-A2 [Wrm])

Столкнулся с подобным случаем на вашем форуме.
[url]http://virusinfo.info/showthread.php?t=53067[/url]

Антивирус находит различные файлы - экзешники (jyyaoi.exe), инфо об автозапуске (autorun.inf), файлы без расширения (khv), - но вылечить не может (к сожелению, сообщение Аваст'а не запомнил).

Очень надеюсь на вашу помощь, заранее благодарен.

Пост скриптум.
Появившаяся проблема возникла сегодня днем, прежде такого замечено мной не было.
Утром поставил драйвера на звуковую карту (скачал из сети, проверил на вирусы - было чисто). Позже стал настраивать сеть и открыл общий доступ к файлам и папкам. Собственно, тут антивирус и стал находить нечисть (ко второму компу так и не подсоединился - думаю, велика вероятность заражения).
02.09.2009, 20:04
Белый Сокол

[B]Выполните скрипт в AVZ[/B] (AVZ, Меню Файл\Выполнить скрипт. [URL="http://virusinfo.info/showthread.php?t=7239"]Подробнее...[/URL]):
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
QuarantineFile('C:\Documents and Settings\Алексей Владимирович\Local Settings\Temp\ShowLogo.exe','');
QuarantineFile('D:\autorun.inf','');
QuarantineFile('E:\autorun.inf','');
QuarantineFile('E:\jyyaoi.exe','');
QuarantineFile('C:\WINDOWS\system32\Drivers\SIVX32.sys','');
QuarantineFile('C:\Program Files\common files\system\scvhost\dnetc.exe','');
DeleteFile('E:\jyyaoi.exe');
DeleteFile('E:\autorun.inf');
DeleteFile('D:\autorun.inf');
DeleteFile('C:\Documents and Settings\Алексей Владимирович\Local Settings\Temp\ShowLogo.exe');
BC_ImportDeletedList;
ExecuteSysclean;
BC_Activate;
RebootWindows(true);
end.
[/code]
После выполнения скрипта компьютер перезагрузится.

После перезагрузки пришлите попавшие в карантин файлы согласно правилам (для отправки файлов следует воспользоваться ссылкой "[B][COLOR="Red"]Прислать запрошенные файлы[/COLOR][/B]" над первым сообщением темы).

Сделайте новые логи.
02.09.2009, 20:44
no_war

Вложений: 3

Карантин отправил.
02.09.2009, 22:09
thyrex

[QUOTE='no_war;460871']Позже стал настраивать сеть и открыл общий доступ к файлам и папкам.[/QUOTE]Ключевая фраза. Предположительно в локальной сети гуляет [B]Packed.Win32.Klone.bj[/B]

В данных логах ничего подозрительного не увидел
02.09.2009, 23:12
no_war

[B]thyrex[/B], есть возможность его каким-либо образом "найти и обезвредить"?+)
На данный момент общий доступ отключен.

Аваст сейчас вирус не находит, но файлы без разрешения остались.

[size="1"][color="#666686"][B][I]Добавлено через 4 минуты[/I][/B][/color][/size]

[QUOTE=no_war;461290]файлы без разрешения остались.[/QUOTE]
Без расширения, конечно же+)
02.09.2009, 23:21
pig

Надо заражённую машину в сети искать.
02.09.2009, 23:53
no_war

[B]pig[/B], сеть из двух компов, и заражен этот. Другой - ноут, совершенно пустой и совершенно новый.
02.09.2009, 23:59
pig

Тогда CureIt! вам в руки. Или AVPTool. Если зараза есть, она будет найдена.

А интернет у вас как подключён? Вполне возможно, что ваша локальная сеть на самом деле несколько больше, чем две домашние машины.
03.09.2009, 00:09
no_war

[B]pig[/B], в каком смысле - "как"?+) Извините, я не силен в компьютерах, так что поясните, пожалуйста+)
Если вы про Адсл, то именно так+) Сетевыми мониторы не показывают, что идет передача\получение пакетов.

Периодически подключаюсь к областному фтп (отдельное подключение), скачиваю чрез dc-агент. Грубо говоря - фаулообменник. За всем тем, что качаю - внимательно слежу.

[size="1"][color="#666686"][B][I]Добавлено через 4 минуты[/I][/B][/color][/size]

[QUOTE=no_war;461327]Сетевыми мониторы не показывают, что идет передача\получение пакетов.[/QUOTE]
В том смысле, что вся передача данных идет только в том случае, если я пользуюсь интернет-ресурсами.

Пост скриптум.
Аваст опять нашел заразу. Увы.
03.09.2009, 00:16
pig

Значит,
[QUOTE=pig;461324]Тогда CureIt! вам в руки. Или AVPTool. Если зараза есть, она будет найдена.[/QUOTE]
03.09.2009, 19:29
no_war

[QUOTE=thyrex;461256]Предположительно в локальной сети гуляет [B]Packed.Win32.Klone.bj[/B][/QUOTE]
Забавно, имеено это и есть+)
Сейчас проверю до конца и буду лечить.

[QUOTE]обнаружено: троянская программа Packed.Win32.Klone.bj[/QUOTE]
Ну и еще червяков несколько. Как все закончится - сделаю логи и выложу.
03.09.2009, 20:11
thyrex

[QUOTE='no_war;461743']Забавно, имеено это и есть+)[/QUOTE]Поищите на какой-нибудь машине активный процесс csr[B]c[/B]s.exe
Он и порождает эти файлы: и те, которые нулевого размера, и автораны, и с беспорядочным именем
03.09.2009, 20:53
no_war

[QUOTE=thyrex;461776]Поищите на какой-нибудь машине активный процесс csr[B]c[/B]s.exe[/QUOTE]
Таскменеджеры не нашли сего "чуда". Так же стандартный поиск на нашел данного экзешника. Возможно, есть альтернативный способ найти? Например, через реестр, или еще как-нибудь+)

Пост скриптум.
Да, знаю, тот еще юзверь. Но все же+)

Пост пост скриптум.
Через ПроцессЭксплорер видны два процесса без подписи разработчика: Interrups (Hardware Interrupts) и DPCs (Deferred Procedure Calls).
На Ваш взгляд, вызывают ли какие-нибудь подозрения?+)
03.09.2009, 23:45
pig

Это системное.
04.09.2009, 01:01
no_war

Вложений: 3

Через АВПТул проверил, заразу удалил.
Думаю, что все равно осталась, так как Аваст периодически находит нечисть. К тому же автораны и нулевые файлы все так же имеются.
04.09.2009, 09:47
thyrex

[B]Packed.Win32.Klone.bj[/B] - это авторанер. Распространяется по расшаренным сетевым ресурсам. Возможно, Вы его подхватываете с областного фтп. Скриптом AVZ у Вас будет отключен автозапуск

Пофиксить в HiJack
[CODE]F3 - REG:win.ini: run= [/CODE]

Выполните скрипт в AVZ
[code]begin
RegKeyIntParamWrite('HKLM','SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer','NoDriveTypeAutoRun', 221);
ExecuteRepair(19);
RebootWindows(true);
end. [/code]Компьютер перезагрузится.
04.09.2009, 11:16
no_war

Вложений: 3

Пофиксил, скрипт выполнил.
04.09.2009, 15:57
no_war

Вложений: 3

И снова, здравствуйте+)

Опять появилась эта же проблема - Аваст ничего сделать не может.
Новые логи прилагаются.
04.09.2009, 18:23
Kuzz

[QUOTE]Внимание !!! База поcледний раз обновлялась 21.08.2009 необходимо обновить базы при помощи автоматического обновления (Файл/Обновление баз)
[/QUOTE]
Базы то обновлять надо!

1.[url=http://virusinfo.info/showthread.php?t=7239]AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".[/url]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('D:\autorun.inf','');
QuarantineFile('D:\umgezn.exe','');
QuarantineFile('E:\Trash','');
QuarantineFile('C:\Program Files\Generic\USB Card Reader Driver v2.3\FlashIcon.exe','');
QuarantineFile('C:\WINDOWS\system32\Drivers\SIVX32.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\filter.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\fixustor.sys','');
QuarantineFile('C:\Program Files\ASTRA32\ASTRA32.sys','');
QuarantineFile('C:\Program Files\common files\system\scvhost\dnetc.exe','');
DeleteFile('D:\umgezn.exe');
DeleteFile('D:\autorun.inf');
SetAVZPMStatus(True);
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]
После выполнения скрипта компьютер перезагрузится.

Прислать карантин согласно [b]приложения 3 [url=http://virusinfo.info/showthread.php?t=1235]правил [/url][/b].
Загружать по красной ссылке вверху этой темы [B][COLOR="Red"]"Прислать запрошенный карантин"[/COLOR][/B]

2.Повторить логи
04.09.2009, 21:19
no_war

Вложений: 3

На всякий случай почистил с КьюрИт.

Вот логи после этой чистки.

Сейчас выполню скрипты и выложу новые логи.
04.09.2009, 22:30
no_war

Вложений: 3

Все сделал - карантин отправлен, логи выложены.

Какие будут дальнейшие инструкции?+)
04.09.2009, 23:29
thyrex

Выполните скрипт в AVZ
[code]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFile('E:\igsugg.exe');
DeleteFile('E:\autorun.inf');
ExecuteSysClean;
RebootWindows(true);
end. [/code]Компьютер перезагрузится.

[B]Обновите базы AVZ[/B]
Сделайте новые логи
05.09.2009, 00:56
no_war

Вложений: 3

[QUOTE=thyrex;462406][B]Обновите базы AVZ[/B][/QUOTE]
Обновил, как только Вы сказали - в первый же раз+)
05.09.2009, 14:17
no_war

Собсна, вот вся выписка из журнала Аваста - со момента, как появился вирус, и по сей день.
Не знаю, пригодится ли, но все же.
[QUOTE]02.09.2009 15:14:17 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\ykthrx.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:18:36 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\ykthrx.exe\AutoIt.script" file.
02.09.2009 15:19:12 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\ykthrx.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:19:16 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\ykthrx.exe\AutoIt.script" file.
02.09.2009 15:20:30 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\xtmwjy.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:20:34 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\xtmwjy.exe\AutoIt.script" file.
02.09.2009 15:20:41 SYSTEM 1680 Sign of "BV:AutoRun-W" has been found in "D:\autorun.inf" file.
02.09.2009 15:21:04 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\xtmwjy.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:21:39 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\xtmwjy.exe\AutoIt.script" file.
02.09.2009 15:22:07 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\xtmwjy.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:22:23 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\xtmwjy.exe\AutoIt.script" file.
02.09.2009 15:22:27 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\mwqeej.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:22:30 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\mwqeej.exe\AutoIt.script" file.
02.09.2009 15:24:17 SYSTEM 1680 Sign of "BV:AutoRun-W" has been found in "C:\autorun.inf" file.
02.09.2009 15:24:32 SYSTEM 1680 Sign of "Win32:Agent-AEEP [Trj]" has been found in "C:\tdfxaj.exe" file.
02.09.2009 15:24:57 SYSTEM 1680 Sign of "BV:AutoRun-W" has been found in "D:\autorun.inf" file.
02.09.2009 15:25:10 SYSTEM 1680 Sign of "Win32:Agent-AEEP [Trj]" has been found in "D:\tdfxaj.exe" file.
02.09.2009 15:25:16 SYSTEM 1680 Sign of "BV:AutoRun-W" has been found in "E:\autorun.inf" file.
02.09.2009 15:25:40 SYSTEM 1680 Sign of "Win32:Agent-AEEP [Trj]" has been found in "C:\Documents and Settings\All Users\Документы\tdfxaj.exe" file.
02.09.2009 15:35:21 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\blyyqx.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:37:21 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\blyyqx.exe\AutoIt.script" file.
02.09.2009 15:37:37 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\blyyqx.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:37:37 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\blyyqx.exe\AutoIt.script" file.
02.09.2009 15:37:54 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\blyyqx.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:38:00 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\blyyqx.exe\AutoIt.script" file.
02.09.2009 15:38:16 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\blyyqx.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 15:38:54 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\blyyqx.exe\AutoIt.script" file.
02.09.2009 17:29:35 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\ufbjbc.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 17:29:40 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\ufbjbc.exe\AutoIt.script" file.
02.09.2009 17:29:59 SYSTEM 1684 Sign of "BV:AutoRun-W" has been found in "D:\autorun.inf" file.
02.09.2009 17:30:15 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\ufbjbc.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 17:30:21 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\ufbjbc.exe\AutoIt.script" file.
02.09.2009 17:30:40 SYSTEM 1684 Sign of "BV:AutoRun-W" has been found in "E:\autorun.inf" file.
02.09.2009 17:30:53 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\ufbjbc.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 17:31:23 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\ufbjbc.exe\AutoIt.script" file.
02.09.2009 17:32:26 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\ufbjbc.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 17:36:56 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\ufbjbc.exe\AutoIt.script" file.
02.09.2009 18:08:11 SYSTEM 1684 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\cwehtv.exe" file.
02.09.2009 18:08:33 SYSTEM 1684 Sign of "Win32:Trojan-gen {Other}" has been found in "D:\cwehtv.exe" file.
02.09.2009 18:08:48 SYSTEM 1684 Sign of "Win32:Trojan-gen {Other}" has been found in "E:\cwehtv.exe" file.
02.09.2009 18:09:07 SYSTEM 1684 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Documents and Settings\All Users\Документы\cwehtv.exe" file.
02.09.2009 18:10:23 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:10:26 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:10:44 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:10:46 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:10:50 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:10:52 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:11:05 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:11:07 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:11:11 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:11:13 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:11:34 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:11:37 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:30:05 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Downloads\Архивы\CMI8738_WDM_0639XP\CMUNINST.EXE" file.
02.09.2009 18:30:27 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Downloads\Архивы\CMI8738_WDM_0639XP\MIXER.EXE" file.
02.09.2009 18:30:38 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Downloads\Архивы\CMI8738_WDM_0639XP\Setup.exe" file.
02.09.2009 18:30:41 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Downloads\Программы\dmaster[2].exe" file.
02.09.2009 18:30:47 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\daemon347.exe" file.
02.09.2009 18:31:02 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\eauninstall.exe" file.
02.09.2009 18:31:08 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\launcher.exe" file.
02.09.2009 18:31:12 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\nfsrun.exe" file.
02.09.2009 18:31:16 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\safemode_inst.exe" file.
02.09.2009 18:31:20 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\sd4hide.exe" file.
02.09.2009 18:31:23 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\shell_inst.exe" file.
02.09.2009 18:31:28 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\speed.exe" file.
02.09.2009 18:31:31 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\Support\EasyInfo.exe" file.
02.09.2009 18:31:37 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\Need For Speed\Most Wanted\Support\EReg.exe" file.
02.09.2009 18:35:58 SYSTEM 1684 Sign of "Win32:Tenga" has been found in "C:\Games\TimeZero\unins000.exe" file.
02.09.2009 18:36:59 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:37:03 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 18:56:00 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:56:26 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\AutoIt.script" file.
02.09.2009 18:56:30 SYSTEM 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 18:56:32 SYSTEM 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\AutoIt.script" file.
02.09.2009 19:29:52 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\jyyaoi.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 19:29:59 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\jyyaoi.exe\AutoIt.script" file.
02.09.2009 23:24:59 SYSTEM 1488 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\guorgs.exe\>>>AUTOIT SCRIPT<<<" file.
02.09.2009 23:25:06 SYSTEM 1488 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\guorgs.exe\AutoIt.script" file.
03.09.2009 10:38:31 SYSTEM 1488 Sign of "BV:AutoRun-G [Wrm]" has been found in "J:\Autorun.inf" file.
03.09.2009 17:49:19 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "D:\autorun.inf" file.
03.09.2009 18:07:46 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00002.dta" file.
03.09.2009 18:07:56 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00003.dta" file.
03.09.2009 18:07:58 SYSTEM 1488 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\>>>AUTOIT SCRIPT<<<" file.
03.09.2009 18:08:01 SYSTEM 1488 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\AutoIt.script" file.
03.09.2009 19:21:49 SYSTEM 1488 Sign of "Win32:Agent-AEEP [Trj]" has been found in "C:\Documents and Settings\All Users\Документы\rqxppc.exe" file.
03.09.2009 19:26:36 SYSTEM 1488 Sign of "Win32:Agent-AEEP [Trj]" has been found in "C:\Documents and Settings\All Users\Документы\rqxppc.exe" file.
03.09.2009 21:03:37 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00002.dta" file.
03.09.2009 21:03:45 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00003.dta" file.
03.09.2009 21:03:47 SYSTEM 1488 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\>>>AUTOIT SCRIPT<<<" file.
03.09.2009 21:03:48 SYSTEM 1488 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Downloads\avz4\Quarantine\2009-09-02\avz00004.dta\AutoIt.script" file.
03.09.2009 22:25:05 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "D:\autorun.inf" file.
03.09.2009 23:55:52 SYSTEM 1488 Sign of "HTML:Iframe-inf" has been found in "http://l2stat.cn/ip/\{gzip}" file.
04.09.2009 0:06:49 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00002.dta" file.
04.09.2009 0:07:03 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00002.dta" file.
04.09.2009 0:07:09 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00003.dta" file.
04.09.2009 0:07:13 SYSTEM 1488 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00003.dta" file.
04.09.2009 0:07:15 SYSTEM 1488 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00004.dta\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 0:07:17 SYSTEM 1488 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00004.dta\AutoIt.script" file.
04.09.2009 0:07:21 SYSTEM 1488 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00004.dta\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 0:07:22 SYSTEM 1488 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\downloads\avz4\quarantine\2009-09-02\avz00004.dta\AutoIt.script" file.
04.09.2009 0:21:06 SYSTEM 1652 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
04.09.2009 0:32:58 SYSTEM 1652 Sign of "BV:AutoRun-AA [Wrm]" has been found in "D:\autorun.inf" file.
04.09.2009 0:38:22 SYSTEM 1652 Sign of "Win32:Spyware-gen [Trj]" has been found in "C:\DOCUME~1\E113~1\LOCALS~1\Temp\avz_1156_1.tmp" file.
04.09.2009 0:53:10 Алексей Владимирович 1640 Sign of "Win32:Spyware-gen [Trj]" has been found in "C:\DOCUME~1\E113~1\LOCALS~1\Temp\avz_852_1.tmp" file.
04.09.2009 1:00:56 Алексей Владимирович 1640 Sign of "Win32:Agent-AEEP [Trj]" has been found in "C:\Documents and Settings\All Users\Документы\rqxppc.exe" file.
04.09.2009 15:28:15 SYSTEM 1836 Sign of "BV:AutoRun-W" has been found in "C:\autorun.inf" file.
04.09.2009 15:29:12 SYSTEM 1836 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\umgezn.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 15:29:17 SYSTEM 1836 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\umgezn.exe\AutoIt.script" file.
04.09.2009 15:29:25 SYSTEM 1836 Sign of "BV:AutoRun-W" has been found in "D:\autorun.inf" file.
04.09.2009 15:53:51 SYSTEM 1680 Sign of "BV:AutoRun-W" has been found in "D:\autorun.inf" file.
04.09.2009 15:58:29 SYSTEM 1680 Sign of "BV:AutoRun-AA [Wrm]" has been found in "C:\autorun.inf" file.
04.09.2009 15:58:47 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\pktsdr.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 15:58:51 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\pktsdr.exe\AutoIt.script" file.
04.09.2009 15:58:57 SYSTEM 1680 Sign of "BV:AutoRun-AA [Wrm]" has been found in "D:\autorun.inf" file.
04.09.2009 15:59:13 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\pktsdr.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 15:59:16 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\pktsdr.exe\AutoIt.script" file.
04.09.2009 15:59:18 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\pktsdr.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 15:59:21 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\pktsdr.exe\AutoIt.script" file.
04.09.2009 15:59:29 SYSTEM 1680 Sign of "BV:AutoRun-AA [Wrm]" has been found in "E:\autorun.inf" file.
04.09.2009 15:59:44 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\pktsdr.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 15:59:52 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\pktsdr.exe\AutoIt.script" file.
04.09.2009 16:00:09 SYSTEM 1680 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\pktsdr.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 16:00:13 SYSTEM 1680 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\pktsdr.exe\AutoIt.script" file.
04.09.2009 21:22:34 SYSTEM 1828 Sign of "BV:AutoRun-W" has been found in "C:\autorun.inf" file.
04.09.2009 21:23:00 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:24:21 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\igsugg.exe\AutoIt.script" file.
04.09.2009 21:24:28 SYSTEM 1828 Sign of "BV:AutoRun-W" has been found in "D:\autorun.inf" file.
04.09.2009 21:24:40 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:24:43 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\igsugg.exe\AutoIt.script" file.
04.09.2009 21:24:46 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:24:57 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\igsugg.exe\AutoIt.script" file.
04.09.2009 21:25:00 SYSTEM 1828 Sign of "BV:AutoRun-W" has been found in "E:\autorun.inf" file.
04.09.2009 21:25:11 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:25:13 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\igsugg.exe\AutoIt.script" file.
04.09.2009 21:25:16 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:25:17 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\igsugg.exe\AutoIt.script" file.
04.09.2009 21:25:32 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:25:36 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\AutoIt.script" file.
04.09.2009 21:25:38 SYSTEM 1828 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 21:25:40 SYSTEM 1828 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\AutoIt.script" file.
04.09.2009 22:19:05 SYSTEM 1688 Sign of "BV:AutoRun-W" has been found in "E:\autorun.inf" file.
04.09.2009 22:21:46 SYSTEM 1688 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 22:21:56 SYSTEM 1688 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\AutoIt.script" file.
04.09.2009 22:23:29 SYSTEM 1688 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 22:23:33 SYSTEM 1688 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\AutoIt.script" file.
04.09.2009 22:24:36 SYSTEM 1688 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 22:24:38 SYSTEM 1688 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\igsugg.exe\AutoIt.script" file.
04.09.2009 22:24:55 SYSTEM 1688 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "E:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 22:24:57 SYSTEM 1688 Sign of "AutoIt:Balero-A [Wrm]" has been found in "E:\igsugg.exe\AutoIt.script" file.
04.09.2009 22:25:20 SYSTEM 1688 Sign of "Win32:Spyware-gen [Trj]" has been found in "C:\DOCUME~1\E113~1\LOCALS~1\Temp\avz_556_1.tmp" file.
04.09.2009 23:36:15 SYSTEM 1688 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\khefrc.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 23:36:19 SYSTEM 1688 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\khefrc.exe\AutoIt.script" file.
04.09.2009 23:36:23 SYSTEM 1688 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\khefrc.exe\>>>AUTOIT SCRIPT<<<" file.
04.09.2009 23:36:25 SYSTEM 1688 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\khefrc.exe\AutoIt.script" file.
05.09.2009 0:52:09 Алексей Владимирович 1684 Sign of "Win32:Spyware-gen [Trj]" has been found in "C:\DOCUME~1\E113~1\LOCALS~1\Temp\avz_1784_1.tmp" file.
05.09.2009 14:13:03 Алексей Владимирович 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\khefrc.exe\>>>AUTOIT SCRIPT<<<" file.
05.09.2009 14:13:07 Алексей Владимирович 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\khefrc.exe\AutoIt.script" file.
05.09.2009 14:13:08 Алексей Владимирович 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
05.09.2009 14:13:09 Алексей Владимирович 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "C:\Documents and Settings\All Users\Документы\igsugg.exe\AutoIt.script" file.
05.09.2009 14:13:23 Алексей Владимирович 1684 Sign of "AutoIt:Balero-A2 [Wrm]" has been found in "D:\igsugg.exe\>>>AUTOIT SCRIPT<<<" file.
05.09.2009 14:13:24 Алексей Владимирович 1684 Sign of "AutoIt:Balero-A [Wrm]" has been found in "D:\igsugg.exe\AutoIt.script" file. [/QUOTE]
06.09.2009, 11:13
no_war

Господа хэлперы, вы про меня не забыли?+)

Буду дома - сделаю новые логи с зараженной машины.
23.09.2009, 21:29
no_war

Вложений: 1

Доброго времени суток+)
Извините, что так долго не было - проблемы с инетом.
Так же прошу прощения за лог антивируса прямо в теме. Знаю, не просили, но я, так сказать, отчаялся уже+)

Снес avast!, поставил КIS, почистил с ним комп.
Удалил dc-менеджер.

На данный момент не вижу вирусной активности.
Пожалуйста, если вас не затруднит, поглядите логи.
24.09.2009, 02:03
AndreyKa

Чисто.
25.09.2009, 02:03
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]2[/B][*]Обработано файлов: [B]12[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\program files\common files\system\scvhost\dnetc.exe - [B]not-a-virus:NetTool.Win32.Calc-DNet.a[/B] ( DrWEB: Program.DNetClient, BitDefender: Spyware.Calc.Dnet.A )[*] d:\autorun.inf - [B]Worm.Win32.AutoRun.gra[/B] ( BitDefender: Trojan.AutorunINF.Gen, AVAST4: BV:AutoRun-AA [Wrm] )[*] d:\autorun.inf - [B]Trojan.Win32.AutoRun.bi[/B] ( BitDefender: Trojan.AutorunINF.Gen, AVAST4: BV:AutoRun-W )[*] e:\autorun.inf - [B]Worm.Win32.AutoRun.gra[/B] ( BitDefender: Trojan.AutorunINF.Gen, AVAST4: BV:AutoRun-AA [Wrm] )[*] e:\jyyaoi.exe - [B]Packed.Win32.Klone.bj[/B] ( DrWEB: archive: archive: Win32.HLLW.Autoruner.based )[/LIST][/LIST]