- Профиксите в HijackThis
Код:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
- Выполните скрипт в AVZ
Код:
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteFileMask(GetAVZDirectory + 'Quarantine', '*.*', true);
QuarantineFile('C:\WINDOWS\system32\47.exe','');
QuarantineFile('c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\winfixer.exe','');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','Microsoft Driver Setup');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run','Microsoft Driver Setup');
DeleteFile('c:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013\winfixer.exe');
DeleteFile('C:\WINDOWS\system32\47.exe');
QuarantineFile('c:\WINDOWS\gjdrive32.exe','');
QuarantineFile('c:\documents and settings\Admin\husj.exe','');
QuarantineFile('c:\documents and settings\Admin\application data\oekx.exe','');
QuarantineFile('c:\documents and settings\Admin\application data\dbvwya2owwj1eyqq2abzdzvsnkwh3la2\csrss.exe','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\1612305.exe ','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\Content.IE5\P78XP2HK\m[1].s','');
QuarantineFile('c:\documents and settings\all users\application data\sectaskman\csisf.exe.q_quarantine_34e8001_q','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\3JJ8WXSZ\nmobi[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\3JJ8WXSZ\x1863[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\0[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\0[2].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\four[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\nmobi[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\ww[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\four[2].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\four[3].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\r[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\x1863[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\Xfour[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\0[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\0[3].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\fifa[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\nmobi[1].exe','');
QuarantineFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\pcxd[1].exe','');
QuarantineFile('c:\RECYCLER\s-1-5-21-2426742623-8496829266-697641802-9263\csisf.exe','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\2637528.exe','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\3534920.exe','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\3737134.exe','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\4428729.exe','');
QuarantineFile('c:\documents and settings\Admin\local settings\temporary internet files\5919992.exe','');
QuarantineFile('c:\Temp\explorer.exe','');
DeleteFile('c:\WINDOWS\gjdrive32.exe');
DeleteFile('c:\documents and settings\Admin\husj.exe');
DeleteFile('c:\documents and settings\Admin\application data\oekx.exe');
DeleteFile('c:\documents and settings\Admin\application data\dbvwya2owwj1eyqq2abzdzvsnkwh3la2\csrss.exe');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\1612305.exe ');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\Content.IE5\P78XP2HK\m[1].s');
DeleteFile('c:\documents and settings\all users\application data\sectaskman\csisf.exe.q_quarantine_34e8001_q');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\3JJ8WXSZ\nmobi[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\3JJ8WXSZ\x1863[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\0[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\0[2].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\four[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\nmobi[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\ww[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\four[2].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\four[3].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\r[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\x1863[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\Xfour[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\0[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\0[3].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\fifa[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\nmobi[1].exe');
DeleteFile('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\pcxd[1].exe');
DeleteFile('c:\RECYCLER\s-1-5-21-2426742623-8496829266-697641802-9263\csisf.exe');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\2637528.exe');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\3534920.exe');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\3737134.exe');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\4428729.exe');
DeleteFile('c:\documents and settings\Admin\local settings\temporary internet files\5919992.exe');
DeleteFileMask('c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5', '*.*', true);
DeleteFile('c:\Temp\explorer.exe');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman ');
DeleteFileMask('c:\documents and settings\Admin\local settings\temporary internet files', '*.*', true);
BC_ImportAll;
ExecuteSysClean;
ExecuteRepair(11);
BC_Activate;
RebootWindows(true);
end.
После перезагрузки:
- выполните такой скрипт
Код:
begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.
- Файл quarantine.zip из папки AVZ загрузите по ссылке Прислать запрошенный карантин вверху темы
- удалите в MBAM оставшееся из этого
Код:
Заражённые ключи в реестре:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken.
Заражённые параметры в реестре:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup (Trojan.Agent) -> Value: Microsoft Driver Setup -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup (Trojan.Agent) -> Value: Microsoft Driver Setup -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> Value: bk -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman (Trojan.Agent) -> Value: Taskman -> No action taken.
Заражённые файлы:
c:\WINDOWS\gjdrive32.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\husj.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\oekx.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\application data\dbvwya2owwj1eyqq2abzdzvsnkwh3la2\csrss.exe (Spyware.Passwords) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\1612305.exe (Worm.Aurorun) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\Content.IE5\P78XP2HK\m[1].s (Trojan.Agent) -> No action taken.
c:\documents and settings\all users\application data\sectaskman\csisf.exe.q_quarantine_34e8001_q (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\3JJ8WXSZ\nmobi[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\3JJ8WXSZ\x1863[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\0[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\0[2].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\four[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\nmobi[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\8V00JYYR\ww[1].exe (Trojan.Dropper) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\four[2].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\four[3].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\r[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\x1863[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\M2E0SNY1\Xfour[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\0[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\0[3].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\fifa[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\nmobi[1].exe (Trojan.Agent) -> No action taken.
c:\documents and settings\networkservice\local settings\temporary internet files\Content.IE5\PDBJNDL0\pcxd[1].exe (Trojan.Agent) -> No action taken.
c:\RECYCLER\s-1-5-21-2426742623-8496829266-697641802-9263\csisf.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\hosts (Trojan.Agent) -> No action taken.
c:\WINDOWS\system32\umdmgr.log (IRCBot.Trace) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\2637528.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\3534920.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\3737134.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\4428729.exe (Trojan.Agent) -> No action taken.
c:\documents and settings\Admin\local settings\temporary internet files\5919992.exe (Trojan.Agent) -> No action taken.
c:\WINDOWS\hosts (Trojan.Agent) -> No action taken.
c:\WINDOWS\logfile32.txt (Malware.Trace) -> No action taken.
c:\Temp\explorer.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
- Сделайте повторные логи по правилам п.2 и 3 раздела Диагностика.(virusinfo_syscheck.zip;hijackthis.log)
- Сделайте лог MBAM