Самовосстанавливающийся вирус на флешке [Trojan.Win32.Agent.idvp ]

[nurik312]

Здравствуйте!

На флешке постоянно появляется папка со странным названием, где внутри лежит exe файл. Если удалить папку, она появится снова при следующем подключении флешки.

Вот ссылка на скан exe файла внутри этой папки: https://virustotal.com/ru/file/1ec36...5bc0/analysis/

Логи приложены.

Заранее спасибо за помощь!

[Info_bot]

Уважаемый(ая) nurik312, спасибо за обращение на наш форум!

Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

Информация

Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.

Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

[nurik312]

лог

[Vvvyg]

Выполните скрипт в AVZ:

begin
 ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 TerminateProcessByName('d:\program files\uncheckit\uncheckitsvc.exe');
 StopService('UncheckitSvc');
 QuarantineFile('c:\programdata\microsoft\blend\14.0\1033\resourcecacher.dll', '');
 QuarantineFile('C:\windows\system32\svchost.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\curlpp.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\feedback.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\iddmgr.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\idesk.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\idskdllpatch64.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\ipcdl.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\ipcproxy.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafe.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeadfv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeadless.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafebs.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafebugreport.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafecheckengine.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafechlp.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeclc.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeclcv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeclean.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafedisp.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeenginedisp.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafekrnlboot.sys', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafekrnlcall.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafekrnlmoncall.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafekrnlshell.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemadwc.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafembp.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemclv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemgc.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemon.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemoptv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemsmv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafemvsv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafenpf.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafesmgr.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafesopt.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafesptv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafesv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafetbv.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafethlp.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafetray.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafeupbiz.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isafevirusscanner.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\istart.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isvc.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\isvc2.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\itpstartupassist.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\libpng.dll', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\uninstall.exe', '');
 QuarantineFile('D:\Program Files\elex-tech\yac\yaccleaner.exe', '');
 QuarantineFile('D:\Program Files\Fresh Outlook\bin\utilFreshOutlook.exe', '');
 QuarantineFile('D:\Program Files\Fresh Outlook\updateFreshOutlook.exe', '');
 QuarantineFile('D:\Program Files\IObit\IObit Unlocker\IObitUnlockerExtension.dll', '');
 QuarantineFile('D:\Program Files\IObit\IObit', '');
 QuarantineFile('d:\program files\uncheckit\uncheckitsvc.exe', '');
 QuarantineFile('D:\Program Files\winzipper\winziper.exe', '');
 QuarantineFile('D:\Program Files\winzipper\zlib1.dll', '');
 QuarantineFile('d:\programdata\{AA5A3B4B-5EA8-41B5-B4E6-C52062A8BB07}\07e5ebd4.exe', '');
 QuarantineFile('D:\Users\_\AppData\Local\CWASRE\Snare.dll', '');
 QuarantineFile('D:\Users\_\AppData\Local\snare\Snare.dll', '');
 QuarantineFile('D:\Users\_\AppData\Local\terana\terana.dll', '');
 QuarantineFile('d:\users\_\appdata\roaming\{631a242d-3127-8bd1-9183-f013ee363fd5}\cea5f4b2.exe', '');
 QuarantineFile('D:\Users\_\AppData\Roaming\Skype\cssrss.exe', '');
 QuarantineFile('D:\Users\_\appdata\roaming\vopackage\vopackage.exe', '');
 QuarantineFile('D:\Users\_\AppData\Roaming\VOPackage\VOsrv.exe', '');
 QuarantineFile('D:\Users\_\AppData\Roaming\WINSNARE\WinSnare.dll', '');
 DeleteFile('c:\programdata\microsoft\blend\14.0\1033\resourcecacher.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\curlpp.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\feedback.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\iddmgr.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\idesk.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\idskdllpatch64.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\ipcdl.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\ipcproxy.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafe.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeadfv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeadless.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafebs.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafebugreport.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafecheckengine.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafechlp.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeclc.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeclcv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeclean.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafedisp.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeenginedisp.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafekrnlboot.sys', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafekrnlcall.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafekrnlmoncall.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafekrnlshell.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemadwc.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafembp.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemclv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemgc.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemon.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemoptv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemsmv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafemvsv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafenpf.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafesmgr.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafesopt.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafesptv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafesv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafetbv.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafethlp.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafetray.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafeupbiz.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isafevirusscanner.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\istart.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isvc.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\isvc2.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\itpstartupassist.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\libpng.dll', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\uninstall.exe', '32');
 DeleteFile('D:\Program Files\elex-tech\yac\yaccleaner.exe', '32');
 DeleteFile('D:\Program Files\Fresh Outlook\bin\utilFreshOutlook.exe', '32');
 DeleteFile('D:\Program Files\Fresh Outlook\updateFreshOutlook.exe', '32');
 DeleteFile('d:\program files\uncheckit\uncheckitsvc.exe', '32');
 DeleteFile('D:\Program Files\winzipper\winziper.exe', '32');
 DeleteFile('D:\Program Files\winzipper\zlib1.dll', '32');
 DeleteFile('d:\programdata\{AA5A3B4B-5EA8-41B5-B4E6-C52062A8BB07}\07e5ebd4.exe', '32');
 DeleteFile('D:\Users\_\AppData\Local\CWASRE\Snare.dll', '32');
 DeleteFile('D:\Users\_\AppData\Local\snare\Snare.dll', '32');
 DeleteFile('D:\Users\_\AppData\Local\terana\terana.dll', '32');
 DeleteFile('d:\users\_\appdata\roaming\{631a242d-3127-8bd1-9183-f013ee363fd5}\cea5f4b2.exe', '32');
 DeleteFile('D:\Users\_\AppData\Roaming\Skype\cssrss.exe', '32');
 DeleteFile('D:\Users\_\appdata\roaming\vopackage\vopackage.exe', '32');
 DeleteFile('D:\Users\_\AppData\Roaming\VOPackage\VOsrv.exe', '32');
 DeleteFile('D:\Users\_\AppData\Roaming\WINSNARE\WinSnare.dll', '32');
 ExecuteFile('schtasks.exe', '/delete /TN "{364A137B-7698-DDA5-B4E6-C52062A8BB07}" /F', 0, 15000, true);
 ExecuteFile('schtasks.exe', '/delete /TN "{FF0A0C1D-1917-17C1-9183-F013EE363FD5}" /F', 0, 15000, true);
 DeleteService('BIT');
 DeleteService('CWASRE');
 DeleteService('Kitty');
 DeleteService('servervo');
 DeleteService('snare');
 DeleteService('terana');
 DeleteService('UncheckitSvc');
 DeleteService('Update Fresh Outlook');
 DeleteService('Util Fresh Outlook');
 DeleteService('WinSAPSvc');
 DeleteService('WINSNARE');
 DeleteFileMask('d:\program files\elex-tech', '*', true);
 DeleteFileMask('d:\program files\fresh outlook', '*', true);
 DeleteFileMask('d:\program files\uncheckit', '*', true);
 DeleteFileMask('d:\program files\winzipper', '*', true);
 DeleteFileMask('d:\programdata\{aa5a3b4b-5ea8-41b5-b4e6-c52062a8bb07}', '*', true);
 DeleteFileMask('d:\users\_\appdata\local\cwasre', '*', true);
 DeleteFileMask('d:\users\_\appdata\local\snare', '*', true);
 DeleteFileMask('d:\users\_\appdata\local\terana', '*', true);
 DeleteFileMask('d:\users\_\appdata\roaming\{631a242d-3127-8bd1-9183-f013ee363fd5}', '*', true);
 DeleteFileMask('d:\users\_\appdata\roaming\vopackage', '*', true);
 DeleteFileMask('d:\users\_\appdata\roaming\winsnare', '*', true);
 DeleteDirectory('d:\program files\elex-tech');
 DeleteDirectory('d:\program files\fresh outlook');
 DeleteDirectory('d:\program files\uncheckit');
 DeleteDirectory('d:\program files\winzipper');
 DeleteDirectory('d:\programdata\{aa5a3b4b-5ea8-41b5-b4e6-c52062a8bb07}');
 DeleteDirectory('d:\users\_\appdata\local\cwasre');
 DeleteDirectory('d:\users\_\appdata\local\snare');
 DeleteDirectory('d:\users\_\appdata\local\terana');
 DeleteDirectory('d:\users\_\appdata\roaming\{631a242d-3127-8bd1-9183-f013ee363fd5}');
 DeleteDirectory('d:\users\_\appdata\roaming\vopackage');
 DeleteDirectory('d:\users\_\appdata\roaming\winsnare');
 DelCLSID('{410BF280-86EF-4E0F-8279-EC5848546AD3}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved', '{410BF280-86EF-4E0F-8279-EC5848546AD3}');
 RegKeyParamDel('HKEY_LOCAL_MACHINE', 'SYSTEM\CurrentControlSet\Services\MCSvc\Parameters', 'ServiceDll');
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1001', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1004', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1201', 3);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '1804', 1);
 RegKeyIntParamWrite('HKCU', 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\', '2201', 3);
BC_ImportALL;
ExecuteSysClean;
 ExecuteWizard('SCU', 2, 2, true);
BC_Activate;
RebootWindows(true);
end.

Компьютер перезагрузится.

Выполните в AVZ скрипт:

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

В папке с AVZ появится архив карантина quarantine.zip, отправьте этот файл по ссылке "Прислать запрошенный карантин" над над первым сообщением в теме.

Сделайте новый лог Autologger, Ok после запуска нажимайте с зажатой клавишей Shift.

Сделайте лог Malwarebytes AdwCleaner.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 6
• В ходе лечения вредоносные программы в карантинах не обнаружены