wigon.ck

**wladkh** · 09.09.2008, 19:45

Добрый день.
Nod32 определяет вирус, но не лечит.
Что делать?
Заранее спасибо.

Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

**V_Bond** · 09.09.2008, 19:59

выполните скрипт ...

Код:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('H:\Program Files\Microsoft Common\wuauclt.exe','');
 QuarantineFile('H:\WINDOWS\system32\winsys2.exe','');
 DeleteService('Winyy60');
 DeleteService('Winyx14');
 DeleteService('Winxj82');
 DeleteService('Winut71');
 DeleteService('Winuf25');
 DeleteService('Winss47');
 DeleteService('Winsr77');
 DeleteService('Winsr60');
 DeleteService('Winsf00');
 DeleteService('Winrp88');
 DeleteService('Winrg73');
 DeleteService('Winrf82');
 DeleteService('Winon41');
 DeleteService('Winml03');
 DeleteService('Winlw03');
 DeleteService('Winkv33');
 DeleteService('Winin36');
 DeleteService('Winig58');
 DeleteService('Winhg60');
 DeleteService('Wingr14');
 DeleteService('Windc71');
 DeleteService('Winbn17');
 DeleteService('Winbk36');
 DeleteService('Winay82');
 DeleteService('wuauservBrowser');
 DeleteService('WmiApSrvWZCSVC');
 DeleteService('WmdmPmSNBrowserSSDPSRV');
 DeleteService('WmdmPmSNBrowser');
 DeleteService('winmgmtNetman');
 DeleteService('VSSstisvc');
 DeleteService('upnphostVSS');
 DeleteService('TrkWksnSvcLogRemoteAccess');
 DeleteService('TrkWksnSvcLog');
 DeleteService('SwPrvTrkWks');
 DeleteService('ShellHWDetectionSwPrvTrkWks');
 DeleteService('ScheduleBITSWmdmPmSNBrowser');
 DeleteService('ScheduleBITS');
 DeleteService('rpcapdW32Time');
 DeleteService('RasManRDSessMgr');
 DeleteService('NtmsSvc Intelligent Application Manager (IAM)');
 DeleteService('nSvcLogsrservice');
 DeleteService('NOD32krnPlugPlayNetDDE');
 DeleteService('NOD32krnPlugPlay');
 DeleteService('MSDTCSpooler');
 DeleteService('BrowserUPS Intelligent Application Manager (IAM)');
 DeleteService('BrowserUPS');
 DeleteService('BITSFastUserSwitchingCompatibility');
 DeleteService('AudioSrvImapiService');
 DeleteService('AudioSrvAlerterSCardSvr');
 DeleteService('AudioSrvAlerter');
 QuarantineFile('srv.exe','');
 QuarantineFile('H:\WINDOWS\system32\WinCtrl32.dll','');
 TerminateProcessByName('h:\docume~1\_296e8~1\locals~1\temp\loader.exe');
 QuarantineFile('h:\docume~1\_296e8~1\locals~1\temp\loader.exe','');
 TerminateProcessByName('h:\windows\system32\braviax.exe');
 QuarantineFile('h:\windows\system32\braviax.exe','');
 DeleteFile('h:\windows\system32\braviax.exe');
 DeleteFile('h:\docume~1\_296e8~1\locals~1\temp\loader.exe');
 DeleteFile('H:\Program Files\Internet Explorer\SETUPAPI.dll');
 DeleteFile('H:\WINDOWS\system32\WinCtrl32.dll');
 DeleteFile('srv.exe');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winay82.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winbk36.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winbn17.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Windc71.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Wingr14.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winhg60.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winig58.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winin36.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winkv33.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winlw03.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winml03.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winon41.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winqq60.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winrf82.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winrg73.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winrp88.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winsf00.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winsr77.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winss47.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winuf25.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winut71.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winwi03.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winxj82.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winyx14.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winyy60.sys');
 DeleteFile('H:\WINDOWS\system32\winsys2.exe');
 DeleteFile('H:\Program Files\Microsoft Common\wuauclt.exe');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteRepair(9);
BC_Activate;
RebootWindows(true);
end.

пришлите карантин согласно приложения 3 правил ....
повторите логи ...

**wladkh** · 10.09.2008, 17:32

Спасибо.
Похоже, что враг побежден.

**V_Bond** · 10.09.2008, 17:39

выполните скрипт ...

Код:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteService('Winyx71');
 DeleteService('Winth74');
 DeleteService('Wintg71');
 DeleteService('Winsr60');
 DeleteService('Winre17');
 DeleteService('Winqc03');
 DeleteService('Winpo14');
 DeleteService('Winpc36');
 DeleteService('Winoo25');
 DeleteService('Winny58');
 DeleteService('Winkv30');
 DeleteService('Winjv44');
 DeleteService('Winit63');
 DeleteService('Wined82');
 DeleteService('Windc88');
 DeleteService('Winco82');
 DeleteService('Wincb63');
 DeleteService('Winca41');
 DeleteService('Winba25');
 DeleteService('Winap60');
 DeleteService('Winam60');
 DeleteService('Winam43');
 DeleteService('NtLmSspBrowser');
 DeleteFile('srv.exe');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winam43.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winam60.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winap60.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winba25.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winca41.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winco82.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Windc88.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Wined82.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winit63.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winjv44.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winkv30.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winny58.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winoo25.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winpc36.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winpo14.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winqc03.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winre17.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winsr60.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Wintg71.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winth74.sys');
 DeleteFile('H:\WINDOWS\System32\Drivers\Winyx71.sys');
 DeleteFile('WinCtrl32.dll');
 DeleteFileMask('%Tmp%', '*.*', true);
 DeleteFileMask('H:\Documents and Settings\Владелец\Local Settings\Temporary Internet Files\Content.IE5\', '*.*', true);
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

повторите логи ...

**CyberHelper** · 22.02.2009, 07:51

Статистика проведенного лечения:

Получено карантинов: 1
Обработано файлов: 4
В ходе лечения обнаружены вредоносные программы:
1. h:\\program files\\microsoft common\\wuauclt.exe - Trojan-Mailfinder.Win32.Agent.sk (DrWEB: Win32.HLLW.Autoruner.2634)
2. h:\\windows\\system32\\braviax.exe - Hoax.Win32.Bravia.ir (DrWEB: Trojan.Packed.612)
3. h:\\windows\\system32\\winctrl32.dll - Trojan-Downloader.Win32.Mutant.bgt (DrWEB: BackDoor.Bulknet.23

wigon.ck (заявка № 29875)

Опции темы

wigon.ck

Итог лечения

Похожие темы

Помогите, подцепил Win32/Wigon.IH, Win32/Wigon.HZ, Win32/Wigon.IH, Win32/SpyDelf.NOL и т.д. [not-a-virus:Monitor.Win32.KGBSpy.cg, Trojan-Downloader.Win32.Agent.bbuv ]

Wigon.CK + Wigon.FJ + Nuwar.CX

WIGON, WIGON.S, WIGON.0 - проблема с ними

Wigon.BK, PSW.OnLineGames.NLI, Wigon.BJ

NOD32 бессилен против троянов Win32/Wigon.Z, Wigon.X и Win32/Rootkit.Agent.DP

Ваши права в разделе