HijackThis
ZAO "Delovaja set" Internet provider, 902,17 Curupa str.,Ufa Russia - ?:R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://lasupporte.com/SCtk23j/lagon.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 46.4.7.198:3128 O1 - Hosts: 37.10.117.75 mc.yandex.ru admulti.com counter.rambler.ru www.google-analytics.com counter.spylog.com O1 - Hosts: 37.10.117.74 wap.odnoklassniki.ru vk.com www.odnoklassniki.ru m.vk.com odnoklassniki.ru my.mail.ru O2 - BHO: (no name) - {C93F72A2-2162-4BBA-A07A-F13663C297A6} - (no file) O3 - Toolbar: (no name) - {09900DE8-1DCA-443F-9243-26FF581438AF} - (no file) O3 - Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - (no file) O3 - Toolbar: (no name) - {91397D20-1446-11D4-8AF4-0040CA1127B6} - (no file) O17 - HKLM\System\CCS\Services\Tcpip\..\{0F40410B-4E2F-445F-B433-4E2C5F17CF06}: NameServer = 127.0.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{56DF43B2-3667-40B7-BBFD-140523FED6CD}: NameServer = 127.0.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{966FE049-43AF-4E5C-ABA7-804EB3F731B4}: NameServer = 127.0.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{C48A6562-31D7-4BF0-97C0-5A9658231E09}: NameServer = 127.0.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{FDAA498D-3C9D-4518-BFBA-1544A970FBE9}: NameServer = 127.0.0.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F40410B-4E2F-445F-B433-4E2C5F17CF06}: NameServer = 127.0.0.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{0F40410B-4E2F-445F-B433-4E2C5F17CF06}: NameServer = 127.0.0.1 O20 - Winlogon Notify: kdcfrea - Invalid registry found
, .
- RSIT.
- .
MBAM ?
.:C:\Windows\tasks\At1.job
- ?:D:\Games\proxy\pcapui.exe
- /.
-
-
.:begin if not IsWOW64 then begin SearchRootkit(true, true); SetAVZGuardStatus(True); end; QuarantineFile('D:\Games\proxy\pcapui.exe',''); QuarantineFile('C:\Users\Zuzu\AppData\Roaming\131.exe',''); DeleteFileMask('C:\DOCUME~1\Nastena\LOCALS~1\Temp\','*',true ,' '); DeleteFile('C:\Users\Zuzu\AppData\Roaming\131.exe'); QuarantineFileF('C:\ProgramData\hotfPE7Xe3k','*', true,'',0 ,0); DeleteFileMask('C:\ProgramData\hotfPE7Xe3k', '*', true); DeleteDirectory('C:\ProgramData\hotfPE7Xe3k',' '); RegKeyParamDel('HKEY_LOCAL_MACHINE','system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list','C:\Users\Zuzu\AppData\Roaming\131.exe'); BC_ImportALL; ExecuteSysClean; ExecuteRepair(2); ExecuteRepair(3); ExecuteRepair(4); BC_Activate; RebootWindows(true); end.
:
- :
quarantine.zip AVZ " " .:begin CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); end.
- RSIT + MBAM
("* *.JHB\YA|6F <
s *! * c m d . e x e " / c a t t r i b - H C : \ W i n d o w s \ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s & & c o p y C : \ T E M P \ 7 7 4 0 2 5 4 a q C : \ W i n d o w s \ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s / Y & & a t t r i b + H C : \ W i n d o w s \ s y s t e m 3 2 \ d r i v e r s \ e t c \ h o s t s " A8AB5<0 !>AB02;5=> N e t S c h e d u l e J o b A d d . 0 * "_] a;@"zMa$J2FǘlXw+Qͤ&/~zdq"-"F)
info.txt
log.txt
=)
- - - - - -
!
AVZ ( )
.:begin ShowMessage('! AVZ .' + #13#10 + ' .'); ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true); if not IsWOW64 then begin SearchRootkit(true, true); SetAVZGuardStatus(True); end; DeleteFile('C:\Windows\tasks\At1.job'); ExecuteSysClean; ExecuteRepair(13); RebootWindows(true); end.
Malwarebytes' Anti-Malware , , , "Perform Full Scan" (" "), "Scan" (""), - Ok - Show Results (" ") - .Qaqtus Maklay
, :
mbam-log-[data] (time).txt, : mbam-log-2012-11-09 (07-32-51).txt:%appdata%\Malwarebytes\Malwarebytes' Anti-Malware\Logs
MBAM , . MBAM.
=)
?
+ ScanVuln.txt. AVZ. - avz_log.txt.
avz_log.txt ( ).
.
, .
:
- : 1
- : 2
- :
- c:\\programdata\\hotfpe7xe3k\\klpclst.dat - Trojan.Script.Carberp.a ( DrWEB: Trojan.Carberp.30, BitDefender: Trojan.Downloader.Carberp.BR, AVAST4: Other:Malware-gen [Trj] )
- c:\\users\\zuzu\\appdata\\roaming\\131.exe - Trojan.Win32.TDSS.ismk ( DrWEB: Trojan.DownLoader6.34751, BitDefender: Gen:Variant.Symmi.244, AVAST4: Win32:Downloader-QZN [Trj] )
