Winlogon лезет в сеть

[gxoct]

Winlogon лезет в сеть. Касперский эту активность обрубает, пишет 18.06.2008 16:23:30 Процесс C:\WINDOWS\system32\winlogon.exe (PID: 476): попытка внедрения в другой процесс заблокирована.

[Numb]

На время выполнения скриптов, отключитесь от сети и отключите антивирусный монитор.
Пофиксите с помощью Hijackthis строчки:

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\drivers\services.exe
O2 - BHO: C:\WINDOWS\system32\hdxjd4g.dll - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\djki397g.dll - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)
O2 - BHO: (no name) - {FC5DC8C3-2840-464E-9500-DC59833C7DC2} - C:\WINDOWS\system32\certmg.dll (file missing)
O2 - BHO: Microsoft copyright - {FFFFFFFF-BBBB-4146-86FD-A722E8AB3489} - sockins32.dll (file missing)
O4 - HKUS\S-1-5-18\..\Run: [Hhjg5jfd93dftdf] C:\WINDOWS\TEMP\winlagon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Jnskdfmf9eldfd] C:\WINDOWS\TEMP\csrssc.exe (User 'SYSTEM')
O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing)
O22 - SharedTaskScheduler: Hkjr94jdfdgj - {B5AC49A2-94F2-42BD-F434-2604812C897D} - C:\WINDOWS\system32\hdxjd4g.dll (file missing)
O22 - SharedTaskScheduler: Hjkfj93dffd - {B5AF0562-94F3-42BD-F434-2604812C797D} - C:\WINDOWS\system32\djki397g.dll (file missing)

Программа AVZ - файл - выполнить скрипт - выполните следующий скрипт:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 RegKeyIntParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_Huf74.sys\0000', 'CSConfigFlags', '1');
 QuarantineFile('C:\WINDOWS\system32\certmg.dll','');
 QuarantineFile('C:\WINDOWS\system32\cl.dll','');
 QuarantineFile('C:\WINDOWS\system32\hdxjd4g.dll','');
 QuarantineFile('C:\WINDOWS\system32\drivers\services.exe','');
 QuarantineFile('C:\WINDOWS\system32\djki397g.dll','');
 QuarantineFile('C:\WINDOWS\system32\carpserv.exe','');
 QuarantineFile('C:\Documents and Settings\LocalService\svchost.exe','');
 QuarantineFile('C:\WINDOWS\TEMP\csrssc.exe','');
 QuarantineFile('C:\WINDOWS\TEMP\winlagon.exe','');
 QuarantineFile('C:\WINDOWS\System32\drivers\Winyc25.sys','');
 QuarantineFile('C:\WINDOWS\System32\drivers\Winvb26.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winma54.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winlg85.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winff86.sys','');
 QuarantineFile('C:\WINDOWS\System32\drivers\tcpsr.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\HSF_BSC2.sys','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\HSF_SAMP.sys','');
 QuarantineFile('Rvyj69.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Qog60.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Lli74.sys','');
 QuarantineFile('asc3550p.sys','');
 QuarantineFile('C:\Program Files\Common Files\System\apcsvra.dll','');
 QuarantineFile('C:\WINDOWS\system32\drivers\jkpjjt.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Huf74.sys','');
 QuarantineFile('C:\Documents and Settings\mihail_z\ie_updates3r.exe','');
 QuarantineFile('C:\Program Files\Common Files\System\apcsvra.exe','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\SENTINEL.SYS','');
 QuarantineFile('C:\WINDOWS\system32\Drivers\Huf74.sys','');
 QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
 QuarantineFile('C:\WINDOWS\system32\PRTmate.dll','');
 DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 BC_DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 BC_DeleteFile('C:\WINDOWS\system32\Drivers\Huf74.sys');
 BC_DeleteFile('C:\Program Files\Common Files\System\apcsvra.exe');
 DeleteFile('C:\Documents and Settings\mihail_z\ie_updates3r.exe');
 BC_DeleteFile('C:\Documents and Settings\mihail_z\ie_updates3r.exe');
 DeleteFile('C:\WINDOWS\System32\Drivers\Huf74.sys');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Huf74.sys');
 DeleteFile('C:\WINDOWS\system32\drivers\jkpjjt.sys');
 BC_DeleteFile('C:\WINDOWS\system32\drivers\jkpjjt.sys');
 BC_DeleteFile('C:\Program Files\Common Files\System\apcsvra.dll');
 DeleteFile('asc3550p.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Lli74.sys');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Lli74.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Qog60.sys');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Qog60.sys');
 DeleteFile('Rvyj69.sys');
 DeleteFile('C:\WINDOWS\System32\drivers\tcpsr.sys');
 BC_DeleteFile('C:\WINDOWS\System32\drivers\tcpsr.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winff86.sys');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Winff86.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winlg85.sys');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Winlg85.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winma54.sys');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Winma54.sys');
 DeleteFile('C:\WINDOWS\System32\drivers\Winvb26.sys');
 BC_DeleteFile('C:\WINDOWS\System32\drivers\Winvb26.sys');
 DeleteFile('C:\WINDOWS\System32\drivers\Winyc25.sys');
 BC_DeleteFile('C:\WINDOWS\System32\drivers\Winyc25.sys');
 DeleteFile('C:\WINDOWS\TEMP\winlagon.exe');
 BC_DeleteFile('C:\WINDOWS\TEMP\winlagon.exe');
 DeleteFile('C:\WINDOWS\TEMP\csrssc.exe');
 BC_DeleteFile('C:\WINDOWS\TEMP\csrssc.exe');
 DeleteFile('C:\Documents and Settings\LocalService\svchost.exe');
 BC_DeleteFile('C:\Documents and Settings\LocalService\svchost.exe');
 DeleteFile('C:\WINDOWS\system32\djki397g.dll');
 BC_DeleteFile('C:\WINDOWS\system32\djki397g.dll');
 DeleteFile('C:\WINDOWS\system32\drivers\services.exe');
 BC_DeleteFile('C:\WINDOWS\system32\drivers\services.exe');
 DeleteFile('C:\WINDOWS\system32\hdxjd4g.dll');
 BC_DeleteFile('C:\WINDOWS\system32\hdxjd4g.dll');
 DeleteFile('WinCtrl32.dll');
 DeleteFile('WinNt64.dll');
 DeleteFile('sockins32.dll');
 DeleteFile('C:\WINDOWS\system32\cl.dll');
 BC_DeleteFile('C:\WINDOWS\system32\cl.dll');
 DeleteFile('C:\WINDOWS\system32\certmg.dll');
 BC_DeleteFile('C:\WINDOWS\system32\certmg.dll');
 DelBHO('{FFFFFFFF-BBBB-4146-86FD-A722E8AB3489}');
 DelBHO('{FC5DC8C3-2840-464E-9500-DC59833C7DC2}');
 DelBHO('{B5AF0562-94F3-42BD-F434-2604812C797D}');
 DelBHO('{B5AC49A2-94F2-42BD-F434-2604812C897D}');
 DelBHO('{4965BEDD-37DC-4BB8-A08E-349994231CBD}');
BC_DeleteSVC('Winxf66');
BC_DeleteSVC('Winvb26');
BC_DeleteSVC('Winma54');
BC_DeleteSVC('Winlg85');
BC_DeleteSVC('Winff86');
BC_DeleteSVC('tcpsr');
BC_DeleteSVC('Rvyj69');
BC_DeleteSVC('Qog60');
BC_DeleteSVC('Lli74');
BC_DeleteSVC('asc3550p');
BC_DeleteSVC('apcsvra');
BC_DeleteSVC('aic32p');
BC_DeleteSVC('Huf74');
BC_DeleteSVC('Google Online Services');
BC_DeleteSVC('apcsvra32');
BC_DeleteSVC('CcEvtSvc');
BC_DeleteSVC('FCI');
BC_DeleteSVC('Schedule');
BC_ImportquarantineList;
BC_Activate;
ExecuteSysClean;
executerepair(11);
RebootWindows(true);
end.

Система будет перезагружена. После перезагрузки, карантин AVZ загрузите по ссылке http://virusinfo.info/upload_virus.php?tid=24847 , как написано в прил.3 правил, и повторите логи, начиная с п. 10 правил.