rundll32.exe достал

[polword]

1. удалите в MBAM

Зараженные ключи в реестре:
HKEY_CLASSES_ROOT\clinker.clinkerbho (Trojan.BHO) -> No action taken.

2. Профиксите в HijackThis как "профиксить в HiJackThis"

O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

3.- скачайте новую версию AVZ - 4.34
- обновите базы AVZ
- Переделайте логи virusinfo_syscure.zip и virusinfo_syscheck.zip

[tu-104]

3.- скачайте новую версию AVZ - 4.34
- обновите базы AVZ
- Переделайте логи virusinfo_syscure.zip и virusinfo_syscheck.zip

они ею и сделаны.
спасибо, сейчас все проделаю

[tu-104]

логи

[tu-104]

а может быть просто винда за собой не чистит?

[tu-104]

актуально...

[AndreyKa]

Установите надежные пароли на учетные записи пользователей с правами администратора.

[tu-104]

О! на встроенной учетке "администратор" неизвестно какой пароль был...
остальные вроде норм.

не помогло.

[AndreyKa]

Отключите службу Удаленный реестр.

[tu-104]

отключена уже. запуск: вручную

[tu-104]

теперь стартуют ровно раз в час 12:00, 13:00, 14:00... по 3-4 штуки разом. может на это кто что подскажет.
строка запуска rundll32.exe zfyspqu.u,jazgtw
rundll32.exe zfyspqu.u,gudlpvdh
rundll32.exe zfyspqu.u,ddvpxa
rundll32.exe zfyspqu.u,yhcrfavg

[polword]

- Выполните скрипт в AVZ

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
 QuarantineFile('D:\WINDOWS\system32\zfyspqu.u','');
 BC_ImportAll;
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы


- Поставте все последние обновления системы Windows - тут
- Скачайте такую утилиу и провертесь ей

[tu-104]

Файл сохранён как 100727_142209_quarantine_4c4eb3511f760.zip
Размер файла 590
MD5 86fc9de58f15e07c7fe41715141c3d6f

C:\>KK.exe
Net-Worm.Win32.Kido removing tool, Kaspersky Lab 2010
version 3.4.14 Mar 19 2010 10:17:17
scanning jobs ...
Infected job (JobFile D:\WINDOWS\Tasks\At1.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At10.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At11.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At12.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At13.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At14.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At15.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At16.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At17.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At18.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At19.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At2.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At20.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At21.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At22.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At23.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At24.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At25.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At26.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At27.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At28.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At29.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At3.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At30.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At31.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At32.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At33.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At34.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At35.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At36.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At37.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At4.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At5.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At6.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At7.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At8.job) was deleted
Infected job (JobFile D:\WINDOWS\Tasks\At9.job) was deleted

scanning processes ...

scanning threads ...

scanning modules in svchost.exe...
scanning modules in services.exe...
scanning modules in explorer.exe...

scanning D:\WINDOWS\system32 ...
scanning D:\Program Files\Internet Explorer\ ...
scanning D:\Program Files\Movie Maker\ ...
scanning D:\Program Files\Windows Media Player\ ...
scanning D:\Program Files\Windows NT\ ...
scanning D:\Documents and Settings\Владислав\Application Data ...
scanning d:\temp\ ...
scanning Flash drives ...

completed
Infected jobs: 37
Infected files: 0
Infected threads: 0
Spliced functions: 0
Cured files: 0
Fixed registry keys: 0

[tu-104]

пока все стабильно...

[AndreyKa]

Состояние стабильно тяжёлое, как говорят врачи, или же всё хорошо?

[tu-104]

все гут. до обеда ни одного рундлл32. Спасибо всем.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 2
• Обработано файлов: 4
• В ходе лечения обнаружены вредоносные программы:
  
  1. d:\windows\system32\msconftb.sys - Trojan-Clicker.Win32.Agent.yo