В WinNt32 троян

[ivashkaxx]

В WinNt32.dll нод32 находит трояна, после удаления и перезагрузки он появляется снова, пожалуйста помогите!

[Numb]

На время выполнения скриптов, отключитесь от сети и отключите антивирусный монитор.
Пофиксите с помощью Hijackthis строчку:

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\ivan\qbn.exe \s

Программа AVZ - файл - выполнить скрипт - выполните следующий скрипт:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
RegKeyIntParamWrite('HKLM', 'SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_Iqx20\0000', 'CSConfigFlags', '1');
 QuarantineFile('C:\Documents and Settings\ivan\qbn.exe \s',''); 
 QuarantineFile('C:\Documents and Settings\ivan\qbn.exe','');
 QuarantineFile('C:\WINDOWS\system32\WinNt32.dll','');
 QuarantineFile('C:\WINDOWS\System32\drivers\tcpsr.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Nuc64.sys','');
 BC_DeleteFile('C:\WINDOWS\System32\Drivers\Nuc64.sys');
 BC_DeleteFile('C:\WINDOWS\System32\drivers\tcpsr.sys');
 DeleteFile('C:\Documents and Settings\ivan\qbn.exe \s');
 BC_DeleteFile('C:\Documents and Settings\ivan\qbn.exe \s');
 DeleteFile('C:\Documents and Settings\ivan\qbn.exe');
 BC_DeleteFile('C:\Documents and Settings\ivan\qbn.exe');
 DeleteFile('C:\WINDOWS\system32\WinNt32.dll');
 BC_DeleteFile('C:\WINDOWS\system32\WinNt32.dll');
 BC_DeleteSvc('tcpsr');
 BC_DeleteSvc('Nuc64');
 BC_DeleteSvc('Iqx20');
BC_ImportquarantineList;
BC_Activate;
ExecuteSysClean;
RebootWindows(true);
end.

После перезагрузки, карантин AVZ загрузите по ссылке http://virusinfo.info/upload_virus.php?tid=26826 , как написано в прил.3 правил, и повторите логи, начиная с п. 10 правил.

[ivashkaxx]

все сделал

[Numb]

В карантине пришли только файлы из папки восстановления системы - модификации BackDoor.Bulknet (по классификации Dr.Web) Судя по логам, активные зловреды были-таки удалены - я не вижу ничего подозрительного больше. Почистите временные файлы, как написано здесь - http://virusinfo.info/showthread.php?t=10025 . Какие-нибудь симптомы заражения остались?

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 88
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008443.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  2. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008471.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.18
  3. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008518.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  4. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008522.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.18
  5. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008527.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  6. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008531.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.18
  7. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008687.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  8. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008697.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  9. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008710.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  10. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008718.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.18
  11. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0008721.dll - Trojan-Downloader.Win32.Mutant.yq (DrWEB: BackDoor.Bulknet.203)
  12. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009721.dll - Trojan-Downloader.Win32.Mutant.zr (DrWEB: BackDoor.Bulknet.206)
  13. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009733.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.206)
  14. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009736.dll - Trojan-Downloader.Win32.Mutant.zr (DrWEB: BackDoor.Bulknet.206)
  15. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009741.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.206)
  16. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009749.dll - Trojan-Downloader.Win32.Mutant.zr (DrWEB: BackDoor.Bulknet.206)
  17. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009754.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  18. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009767.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  19. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009773.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  20. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009782.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  21. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp14\\a0009789.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  22. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0009809.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  23. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010809.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  24. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010815.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  25. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010825.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  26. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010840.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  27. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010846.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  28. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010853.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  29. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010863.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  30. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010866.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  31. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010872.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  32. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010892.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  33. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010904.sys - Trojan-Downloader.Win32.Mutant.aim (DrWEB: BackDoor.Bulknet.207)
  34. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0010908.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  35. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0013949.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  36. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0013962.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  37. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0013975.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  38. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0015017.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  39. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0016017.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  40. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0016029.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  41. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0017051.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  42. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0017074.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  43. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0018074.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  44. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019241.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  45. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019296.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  46. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019346.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  47. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019358.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  48. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019370.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  49. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019395.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  50. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019420.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  51. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019432.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  52. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019444.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  53. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019454.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  54. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0019466.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  55. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0020478.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  56. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0020490.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  57. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0022490.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  58. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0022500.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  59. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0022512.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  60. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0022522.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  61. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0022541.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  62. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0023558.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  63. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0023572.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  64. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0024572.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  65. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0024586.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  66. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0025651.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  67. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0025665.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  68. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0026665.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  69. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0027690.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  70. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0028711.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  71. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0028745.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  72. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0029758.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  73. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0029780.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  74. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0032858.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  75. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0032870.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  76. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp15\\a0032919.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  77. c:\\system volume information\\_restore{1df8c204-9a01-42fb-b034-258823cd40b8}\\rp16\\a0033136.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)
  78. c:\\windows\\system32\\winnt32.dll - Trojan-Downloader.Win32.Mutant.aae (DrWEB: BackDoor.Bulknet.206)