Подозрительная активност после отлова Trojan-ов

[storno2001]

Посмитрите логи пожалуйста. CureLt и AVZ наловил кучу
Trojan.Win32.Pincan.ajmg
Trojan.Win32.VB.amax
Trojan.PWS.Multi
Email-Worm.MSIL.Agent
вродебы все по удалялось но осталась активность интернет соединения при полном бездействии со стороны пользователя. Идет постоянный прием и отправка пакето в по 2-4 кб в обе стороны

[polword]

- Выполните скрипт в AVZ

begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(True);
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\10225..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\00748..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\515399..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\463..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\612..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\406..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\588..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\5281914..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\997283..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\3974150..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\740..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\3045..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\034020..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\309..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\243..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\59535..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\2884..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\184523..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\2984329..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\0677794..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\425..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\319..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\1452..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\2779058..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\79589..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\586..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\944814..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\8783..exe','');
 QuarantineFile('C:\Documents and Settings\Papa\Application Data\344306..exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\5468.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\6443.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\940326.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\979.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\689.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\58122.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\1798.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\1251735.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\541170.exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Application Data\774..exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Application Data\968781..exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Application Data\7140108..exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Application Data\47310..exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Application Data\6143590..exe','');
 QuarantineFile('C:\Documents and Settings\Deti\Application Data\870983..exe','');
 DeleteFile('C:\Documents and Settings\Deti\Application Data\870983..exe');
 DeleteFile('C:\Documents and Settings\Deti\Application Data\6143590..exe');
 DeleteFile('C:\Documents and Settings\Deti\Application Data\47310..exe');
 DeleteFile('C:\Documents and Settings\Deti\Application Data\7140108..exe');
 DeleteFile('C:\Documents and Settings\Deti\Application Data\968781..exe');
 DeleteFile('C:\Documents and Settings\Deti\Application Data\774..exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\541170.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\1251735.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\1798.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\58122.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\689.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\979.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\940326.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\6443.exe');
 DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\5468.exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\344306..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\8783..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\944814..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\586..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\79589..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\2779058..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\1452..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\319..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\425..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\0677794..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\2984329..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\184523..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\2884..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\59535..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\43966..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\6577114..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\243..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\309..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\034020..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\3045..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\740..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\3974150..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\997283..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\588..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\406..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\612..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\463..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\515399..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\00748..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\10225..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\157..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\699..exe');
 DeleteFile('C:\Documents and Settings\Papa\Application Data\994..exe');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\506604..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\6443..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\3121..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\940326..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\51074..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\979..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\5629..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\0681193..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\689..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\58122..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\29209..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\5481..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\1798..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\549136..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\1251735..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\541170..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Application Data\75323..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\5481.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\549136.exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\2738889..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\867055..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\1639..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\4197677..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\1617044..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\644114..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\9325..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\3088..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\7105..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\7543938..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\157..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\699..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\994..exe','');
QuarantineFile('C:\Documents and Settings\Papa\Application Data\0169777..exe','');
QuarantineFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe','');
DeleteFile('C:\Documents and Settings\Deti\Application Data\506604..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\6443..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\3121..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\940326..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\51074..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\979..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\5629..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\0681193..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\689..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\58122..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\29209..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\5481..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\1798..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\549136..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\1251735..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\541170..exe');
DeleteFile('C:\Documents and Settings\Deti\Application Data\75323..exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\5481.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\549136.exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\2738889..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\867055..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\1639..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\4197677..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\1617044..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\644114..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\9325..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\3088..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\7105..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\7543938..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\157..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\699..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\994..exe');
DeleteFile('C:\Documents and Settings\Papa\Application Data\0169777..exe');
DeleteFile('C:\Documents and Settings\Deti\Local Settings\temp\75323.exe');
 QuarantineFileF('C:\Documents and Settings\Deti\Local Settings\temp','*.exe', false,'', 0, 0, '','');
 QuarantineFileF('C:\Documents and Settings\Papa\Application Data','*..exe', false,'', 0, 0, '','');
 DeleteFileMask('C:\Documents and Settings\Deti\Local Settings\temp', '*.*', true);
 BC_ImportAll;
 ExecuteSysClean;
 BC_Activate;
 RebootWindows(true);
end.

После перезагрузки:
- выполните такой скрипт

begin
  CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
 end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы
- Сделайте повторные логи по правилам п.2 и 3 раздела Диагностика.(virusinfo_syscheck.zip;hijackthis.log)
- Сделайте лог MBAM

[storno2001]

логи АВЗ прилагаю
логи МВАМ делаются

[storno2001]

лог МВАМ получить не удается, на 10-12 минуте сканирования комп уходит в перезагрузку

[storno2001]

Будьте так любезны, гляньте плиз последние логи.
Запрошеный карантин был прилеплен.
Лог МВАМ так и не удалось получить, на 12 минуте сканирования комп уходит в перезагрузку

[storno2001]

Ура - удалось сделать лог МВАМ
Посмотрите пожалуйста

[storno2001]

наверное все спят

[polword]

1.Профиксите в HijackThis

O20 - Winlogon Notify: reset5e - reset5e.dll (file missing)

2.Выполните скрипт в AVZ

begin
 DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
 QuarantineFile('c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5\0RK4LGLB\56[1].exe ','');
 QuarantineFile('c:\documents and settings\Deti\application data\5468..vexe','');
 QuarantineFile('c:\documents and settings\Papa\application data\195..vexe ','');
 QuarantineFile('c:\documents and settings\Papa\application data\8542816..vexe','');
 DeleteFileMask('c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5', '*.*', true);
 CreateQurantineArchive(GetAVZDirectory+'quarantine.zip'); 
end.

- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы

- удалите в MBAM

Заражённые папки:
c:\RECYCLER\s-1-5-21-0243556031-888888379-781863308-1455 (Worm.AutoRun) -> No action taken.
c:\RECYCLER\s-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> No action taken.

Заражённые файлы:
c:\documents and settings\Papa\application data\195..vexe (Trojan.Agent) -> No action taken.
c:\documents and settings\Papa\application data\8542816..vexe (Trojan.Agent) -> No action taken.
c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5\0RK4LGLB\56[1].exe (Trojan.Dropper) -> No action taken.
c:\documents and settings\Deti\local settings\temporary internet files\Content.IE5\0RK4LGLB\fox[1].gif (Extension.Mismatch) -> No action taken.
c:\documents and settings\Deti\application data\5468..vexe (Trojan.Agent) -> No action taken.
c:\WINDOWS\logfile32.txt (Malware.Trace) -> No action taken.
c:\RECYCLER\s-1-5-21-0243556031-888888379-781863308-1455\Desktop.ini (Worm.AutoRun) -> No action taken.
c:\RECYCLER\s-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> No action taken.

- Сделайте повторный лог MBAM

[storno2001]

какрантин прилепил
Выполнить МВАМ не получается пока - комп при выполнении уходит в перезагрузку.

[polword]

что с проблемами?

[storno2001]

ну активновсть небольшая всетаки осталась, видимо решить это можно будет только радикальной переустановкой Винды. Если получится сделать лог МВАМ, почищу по указаному шаблон. Пока почитистил в руками то что указано в логе МВАМ
что меня больше всего беспокоит - это большое количество процессов svhost.exe 8шт - непонятно чем он занимается ???

[миднайт]

что меня больше всего беспокоит - это большое количество процессов svhost.exe 8шт - непонятно чем он занимается ???

в этом нет ничего плохого.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 2
• Обработано файлов: 40
• В ходе лечения вредоносные программы в карантинах не обнаружены