Win32 Agent-VGV (Wrm)

[Jess1990]

Win32 Agent-VGV (Wrm)
Каждый раз при включении компа аваст выдаёт сообщение о вирусе. Не могу ликвидировать.
Помогите, пожалуйста, избавиться.
Заранее благодарна.

[Гриша]

Отключите антивирус и интернет!

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\DOCUME~1\8297~1\LOCALS~1\Temp\loader.exe','');
 DeleteService('Winxh76');
 DeleteService('Winuf32');
 DeleteService('Winsc53');
 DeleteService('Winsc08');
 DeleteService('Winra32');
 DeleteService('Winra18');
 DeleteService('Winpy08');
 DeleteService('Winox43');
 DeleteService('Winlu76');
 DeleteService('Winhq87');
 DeleteService('Wingp43');
 DeleteService('Windm54');
 DeleteService('Winck08');
 DeleteService('Winbi65');
 DeleteService('Winaj76');
 DeleteService('Winaj65');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winxh76.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winuf32.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winsc53.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winsc08.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winra32.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winra18.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winpy08.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winox43.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winlu76.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winhq87.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Wingp43.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Windm54.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winck08.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winbi65.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winaj76.sys','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Winaj65.sys','');
 DeleteService('WZCSVCSysmonLog');
 DeleteService('TrkWksProtectedStorage');
 DeleteService('RasAutodmadmin');
 DeleteService('ProtectedStorageCOMSysApp');
 DeleteService('PolicyAgentNtmsSvc');
 DeleteService('oseRemoteRegistry');
 DeleteService('NVSvcTrkWksProtectedStorage');
 DeleteService('NetlogonRasAuto');
 DeleteService('HTTPFilterEventSystem');
 DeleteService('EventlogThemes');
 DeleteService('DhcpUPSSSDPSRV');
 DeleteService('DhcpUPS');
 DeleteService('CiSvcSchedule');
 DeleteService('BITSBrowser');
 DeleteService('ALGstisvc');
 QuarantineFile('C:\WINDOWS\system32\WinCtrl32.dll','');
 DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winaj65.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winaj76.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winbi65.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winck08.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Windm54.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Wingp43.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winhq87.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winlu76.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winox43.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winpy08.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winra18.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winra32.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winsc08.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winsc53.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winuf32.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winxh76.sys');
 DeleteFile('C:\DOCUME~1\8297~1\LOCALS~1\Temp\loader.exe');
 DeleteFile('WinCtrl32.dll');
 DelWinlogonNotifyByKeyName('WinCtrl32');     
BC_ImportALL;  
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Пришлите карантин по правилам и повторите логи...

[Jess1990]

вкладываю логи. карантин отправила

[Гриша]

Пофиксить

O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\

AVZ, меню "Файл - Выполнить скрипт" -- Скопировать ниже написанный скрипт-- Нажать кнопку "Запустить".

begin
ClearQuarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteService('Winyi21');
 DeleteService('Winnw65');
 DeleteService('WZCSVCSysmonLog');
 DeleteService('TrkWksProtectedStorage');
 DeleteService('RasAutodmadmin');
 DeleteService('ProtectedStorageCOMSysApp');
 DeleteService('PolicyAgentNtmsSvc');
 DeleteService('oseRemoteRegistry');
 DeleteService('NVSvcTrkWksProtectedStorage');
 DeleteService('NetlogonRasAuto');
 DeleteService('MessengerMSDTC');
 DeleteService('HTTPFilterEventSystem');
 DeleteService('EventlogThemesNtLmSsp');
 DeleteService('EventlogThemes');
 DeleteService('DhcpUPSSSDPSRV');
 DeleteService('DhcpUPS');
 DeleteService('CiSvcSchedule');
 DeleteService('BITSBrowser');
 DeleteService('ALGstisvc');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winnw65.sys');
 DeleteFile('C:\WINDOWS\System32\Drivers\Winyi21.sys');
BC_ImportDeletedList;
ExecuteSysClean;
BC_DeleteSvc('Winyi21');
BC_DeleteSvc('Winnw65');
BC_DeleteSvc('WZCSVCSysmonLog');
BC_DeleteSvc('TrkWksProtectedStorage');
BC_DeleteSvc('RasAutodmadmin');
BC_DeleteSvc('ProtectedStorageCOMSysApp');
BC_DeleteSvc('PolicyAgentNtmsSvc');
BC_DeleteSvc('oseRemoteRegistry');
BC_DeleteSvc('NVSvcTrkWksProtectedStorage');
BC_DeleteSvc('NetlogonRasAuto');
BC_DeleteSvc('MessengerMSDTC');
BC_DeleteSvc('HTTPFilterEventSystem');
BC_DeleteSvc('EventlogThemesNtLmSsp');
BC_DeleteSvc('EventlogThemes');
BC_DeleteSvc('DhcpUPSSSDPSRV');
BC_DeleteSvc('DhcpUPS');
BC_DeleteSvc('CiSvcSchedule');
BC_DeleteSvc('BITSBrowser');
BC_DeleteSvc('ALGstisvc');
BC_Activate;
RebootWindows(true);
end.

Повторите логи...

[Jess1990]

готово

[Гриша]

В логах чисто,жалобы есть?

[Jess1990]

Нет. Большое спасибо за помощь)

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 43
• В ходе лечения обнаружены вредоносные программы:
  
  1. c:\\documents and settings\\мария\\local settings\\temp\\loader.exe - Trojan-Downloader.Win32.Mutant.ask (DrWEB: Trojan.DownLoad.2077)
  2. c:\\docume~1\\8297~1\\locals~1\\temp\\loader.exe - Trojan-Downloader.Win32.Mutant.ask (DrWEB: Trojan.DownLoad.2077)
  3. c:\\windows\\system32\\winctrl32.dll - Trojan-Downloader.Win32.Mutant.aub (DrWEB: BackDoor.Bulknet.225)