помогите справиться с новой угрозой Hidden.Object (модификация)

[lomvi]

Как избавиться от этой угрозы помогите, пжалуйста?

При помещении в карантин пишет Возможно заражен: новая угроза Hidden.Object (модификация) C:\WINDOWS:AstInfo 0 б 01.01.2010 20:00:05

Удалить также невозможно, что делать, и насколько это опасно?

 

 

протоколы, вроде б все сделала по инструкциии, и должно быть правильно

virusinfo_syscheck.zip

virusinfo_syscure.zip

hijackthis.log

[Analyzer]

Выполните скрипт AVZ. Меню Файл - Выполнить скрипт, вставляем написаный скрипт - кнопка Запустить.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Documents and Settings\Ìàðèíà\Local Settings\Temp\nsr27.tmp\weemi.exe','');
QuarantineFile('C:\Program Files\Winferno\PC Confidential\PCConfidential.exe','');
QuarantineFile('C:\WINDOWS\system32\linkdel.cmd','');
QuarantineFile('C:\DOCUME~1\85B6~1\LOCALS~1\Temp\NEventMessages.dll','');
QuarantineFile('C:\WINDOWS\system32\Drivers\uphcleanhlp.sys','');
QuarantineFile('C:\WINDOWS\System32\Drivers\dump_iastor.sys','');
DeleteFile('C:\DOCUME~1\85B6~1\LOCALS~1\Temp\NEventMessages.dll');
DeleteFile('C:\Documents and Settings\Ìàðèíà\Local Settings\Temp\nsr27.tmp\weemi.exe');
DelBHO('{1E796980-9CC5-11D1-A83F-00C04FC99D61}');	 
BC_ImportALL;
ExecuteSysClean;
BC_DeleteSvc('Weemi Service');
BC_DeleteSvc('Ati2o');
BC_Activate;
RebootWindows(true);
end.

после выполнения скрипта компьютер перезагрузится.

после перезагрузки выполнить второй скрипт:

begin
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
end.

В результате выполнения скрипта будет сформирован файл карантина quarantine.zip в папки с AVZ, Вышлите полученный quarantine.zip на newvirus@kaspersky.com Результаты ответа, сообщите здесь, в теме.

 

Пофиксить в HijackThis следующие строчки:

R3 - URLSearchHook: (no name) -  - (no file)
O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

 

повторите логи.

[lomvi]

Сообщение от модератора thyrex

Не цитируйте полностью предыдущее сообщение

как понять повторите логи?

[Mark D. Pearlstone]

как понять повторите логи?

Сделать те же отчёты, что вы прикрепляли в первом сообщении.

[lomvi]

а если у меня включается проактивная защита подозрительное действие Suspicious driver installation

Процесс (PID:2916)

мне его разрешить, запретить или добавить в доверенную зону?

Это происходит во время формирования логов в avz!

Изменено 3 января, 2010 пользователем lomvi

[akoK]

lomvi, перед запуском AVZ антивирус должен быть отключен. Иначе передернуться, и положат вам систему.

[lomvi]

lomvi, перед запуском AVZ антивирус должен быть отключен. Иначе передернуться, и положат вам систему.

 

спасибо!попробую

 

 

заново сформировала логи,помимо основных образовался еще архив virusinfo_cure.zip, его не высылаю.

virusinfo_syscheck.zip

virusinfo_syscure.zip

hijackthis.log

[Analyzer]

был ли отправлен карантин то есть файл quarantine.zip на newvirus@kaspersky.com ?

[lomvi]

карантин был отправлен на newvirus@kaspersky.com, сказано, что в файлах вредоносный код не обнаружен.

может нужно еще раз сформировать этот карантин.зип?т.к. когда делала эти скрипты указанные в теме выше, не отключив касперского.

Забыла добавить, что после всех этих действий, эта возможная угроза в карантине в Каспере пишет: Не заражен (ложное срабатывание) C:\WINDOWS:AstInfo 0 б 01.01.2010 20:00:05; но все равно каждый раз при загрузке системы выскакивает как возможная угроза!

Изменено 5 января, 2010 пользователем lomvi

[Analyzer]

Выключите Антивирус.

 

Выполните скрипт в AVZ. Меню Файл - Выполнить скрипт, вставляем написаный ниже скрипт - кнопка Запустить.

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
DeleteService('Ati2o');
DeleteService('Weemi Service');
DeleteFile('C:\WINDOWS\Ati2eo.exe');
DeleteFile('C:\Documents and Settings\All Users\Application Data\Weemi\weemi123.exe');
DeleteFile('C:\Documents and Settings\Марина\Local Settings\Temp\nsr27.tmp\weemi.exe');
BC_ImportALL;
ExecuteSysClean;
BC_DeleteSvc('Weemi Service');
BC_DeleteSvc('Ati2o');
BC_Activate;
RebootWindows(true);
end.

после выполнения скрипта компьютер перезагрузится.

после перезагрузки Скачайте Malwarebytes' Anti-Malware, установите, обновите базы, выберите "Perform Full Scan", нажмите "Scan", после сканирования - Ok - Show Results (показать результаты) - нажмите "Remove Selected" (удалить выделенные). Откройте лог и скопируйте в сообщение.

 

Перегрузитесь.

 

появляется ли сообщения при загрузки о Hidden.Object ?

[lomvi]

Hidden.object появляется при загрузке все равно

 

Лог МВАМ:

 

Malwarebytes' Anti-Malware 1.43

Версия базы данных: 3499

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

 

06.01.2010 11:19:05

mbam-log-2010-01-06 (11-19-05).txt

 

Тип проверки: Полная (C:\|D:\|)

Проверено объектов: 279895

Прошло времени: 55 minute(s), 52 second(s)

 

Заражено процессов в памяти: 0

Заражено модулей в памяти: 0

Заражено ключей реестра: 121

Заражено значений реестра: 0

Заражено параметров реестра: 1

Заражено папок: 9

Заражено файлов: 19

 

Заражено процессов в памяти:

(Вредоносные программы не обнаружены)

 

Заражено модулей в памяти:

(Вредоносные программы не обнаружены)

 

Заражено ключей реестра:

HKEY_CLASSES_ROOT\steadway.ffvalidator (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.ffvalidator.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.steadway (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.steadway.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.stwband (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.stwband.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.stwdialogs (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.stwdialogs.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.context (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.context.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.filterdebugger (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.filterdebugger.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.match (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.match.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.regexp (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.regexp.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwaycookie (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwaycookie.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayfilterrate (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayfilterrate.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayrequest (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayrequest.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayserver (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayserver.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwaysiterate (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwaysiterate.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.urlscriptlet (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.urlscriptlet.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{0056d2fb-9ec3-4eb9-8474-f06d69999dc5} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{01690012-9fbf-4422-b830-bc1eee946333} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{03c39a03-bdb6-4539-9a35-b8513576a8b4} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{0a3c7fd8-4a49-4e13-8f2b-d406c2b28667} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{10bde295-fafd-4863-90bf-b9890bde7077} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{128304dd-33b4-4f05-87da-df5e4938a82f} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{1b55f2e0-7c78-4cfd-ac87-e3728d2b14f9} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{1f0fa04a-0f04-4816-9be4-879394959f58} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{2023b80e-f876-4a78-bd4c-e6a2c7409380} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{35ad961f-f78d-4ef3-a72c-6ed6f0cf6a05} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{377f63dc-5663-4237-b9ac-4f0376ce92da} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{37a13acb-e3f4-4884-b4e9-3cf666692bb0} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{3885f585-7ae7-4f51-909c-6d4c15d2d7f9} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{3b80c849-1aeb-4553-9b37-a836aca92261} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{3e069fee-b94a-45d8-bf98-601470907e9e} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4483dae8-fefe-4a47-a2eb-d731e97a6f7d} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4521f436-558c-4f50-a2c1-055e73303931} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{472683bd-3ac3-4838-a12c-a28605d49874} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4c541bc9-7f2e-4d62-b396-6103116160e1} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{54f837ad-296f-4712-b918-d43335065ad0} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{55ab60a6-9115-4d30-8d61-284c2f2c9a26} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{5c3df6a7-f37f-44ec-b281-ca2d6d44d571} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{5e62facd-c790-4469-bd18-9e7bc55e6bac} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{619b2395-64e3-420c-a042-2f5f58dbe978} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{6549d8ac-47c7-46f8-875a-a90cee9d56d3} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{6aa0c658-5ee1-40cb-acc5-38c26aad4338} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{6d080d60-e53d-4375-84bb-5ee6007d0280} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{6ff56a16-e7f4-48d6-bbb5-496f4c73eddc} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{7c0972b6-be67-48ae-9c47-5c8a1f49c23f} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{7fc23e0d-13c2-4a69-9d1e-cc10e18e430e} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{7fddc940-7f5f-432e-be39-4446da142d50} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{81fea687-c096-461c-92aa-46a36d2c62de} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{82fe73c6-54b5-429d-91f0-0e596f7d2d31} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{86112591-8606-4331-8072-0f314f2155bc} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{8908dcdc-4f2c-48f5-bd83-c36fd90225a0} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{8e868b66-d540-4f46-9fb2-69e4c060a999} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{955d008b-ff96-4f89-bc62-1e2881955169} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{96c70546-dec9-4ca0-aab0-d940b24d1910} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{976e7209-cea6-48b6-9bc5-a31f6d037028} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{9a831198-a605-48b4-844d-13a009a9ea1c} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{9c290ef4-303e-4837-b30a-ed4cb0dc5219} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{ae54f9eb-3744-4c97-b38b-fe5f866479fc} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{b2c71b91-7ca7-4fd2-9138-8041178aab11} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{b3441f24-2612-450d-b87f-5a220663b0d8} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{bbf66ae7-e6bb-4b8e-accb-12862b6a5d0b} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{bca82348-c45b-4196-90ff-d0edd7d3357d} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{c9848473-0fe9-41f8-9380-9fd424d65c92} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{d3a50e7c-4c24-4466-9f4e-841dd756f186} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{dce84820-41f1-46c3-b6cc-353c5cd146a9} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e0cd2020-cfaf-4f6a-b461-fcbb21094b5e} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e23aa269-f610-47c1-b5f2-038dba096441} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e4a2c5d9-f682-461d-bd38-b4a65e835604} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e57abe81-f539-48ac-a77d-4c25c304cac3} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e5cc1b55-7bdb-4be6-b3f2-6de6ea73eb33} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{e6a1cd76-54d6-4534-8eab-9febe3e19e8f} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{eb953b20-9f91-4a11-b325-ee5d7079f68d} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{ef9e7d52-7625-4a4b-af85-eb7b494bff0c} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f4b80c8d-77d0-4f05-bc55-d47b62407e91} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f4f2d962-cb6f-4e41-8103-4c2d17ea97ad} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f57c31c9-2b3b-4649-a975-bbc0d975e0f1} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{f81a895f-3184-416a-8fa0-d26818d1ad0f} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{fc1f2577-977b-4b32-b42d-e1ff7a579ced} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{10a2afe5-a6c3-46a9-a3e9-dfbe934afcbb} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{17249f79-bbd0-470a-9bc5-8cfd2d5046d0} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{2a3f6f50-9a92-4553-9016-729d1e1a00ab} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{54e20e87-e6a4-4b47-a996-653752829354} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{55a577b1-ad9f-4530-ad1e-463b2c4cd162} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{5e1b5a0f-cf08-4195-ab70-209572915923} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{84185ea0-0b56-407f-bbc9-3d1f12fe6eab} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{9cdfe9f3-4d2b-4771-b6c2-c7569226939b} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{bcfb7668-312a-4149-83ac-4e7fe71ca44c} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{c06ce8fc-50d9-414a-a318-c90e2fcdbeb6} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{cc29517f-d259-4ab6-912a-99678740fd00} (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{7f6edb84-901b-4309-a2f6-0058f38c4cc4} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{a1c7a1e6-6a3c-4d6f-a376-81c4bea13a62} (Adware.TMAAgent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\tmagent (Adware.TMAgent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\tmasrv.exe (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.ieadapter (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\steadway.ieadapter.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayerror (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayerror.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayreport (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\tmagent.steadwayreport.1 (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Target Marketing Agency (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\TMAgency (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Target Marketing Agency (Adware.TMAagent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Weemi (Adware.Weemi) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_WEEMI_SERVICE (Adware.Weemi) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\cs1.5 (Malware.Trace) -> Quarantined and deleted successfully.

 

Заражено значений реестра:

(Вредоносные программы не обнаружены)

 

Заражено параметров реестра:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

 

Заражено папок:

C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0851 (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\chrome (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\components (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency\TMAgent (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency\TMAgent\update (Adware.TMAagent) -> Quarantined and deleted successfully.

 

Заражено файлов:

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\tmasrv.exe (Adware.TMAAgent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Temp\nsr27.tmp\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Мои документы\Файлы Mail.Ru Агента\marishka-febr84@mail.ru\andrusha_sar@mail.ru\Фтучка.exe (Trojan.Buzus) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\Uninstaller.exe (Adware.TMAgent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\i\A030.exe (Malware.Packer) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-0243336031-4052116379-881863308-0851\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\aupdate.exe (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\license.txt (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\chrome.manifest (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\install.rdf (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\chrome\tmagent.jar (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\components\fftma.dll (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\components\nsIAdHandler.xpt (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Program Files\Common Files\Target Marketing Agency\TMAgent\extension\components\nsISteadway.xpt (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency\TMAgent\data.bin (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency\TMAgent\params.bin (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency\TMAgent\tmagent.bin (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Марина\Local Settings\Application Data\Target Marketing Agency\TMAgent\update\updateInfo.xml (Adware.TMAagent) -> Quarantined and deleted successfully.

C:\WINDOWS\hosts (Trojan.Agent) -> Quarantined and deleted successfully.

 

Изменено 6 января, 2010 пользователем thyrex

[ТроПа]

Cкачайте Gmer. Запустите программу. После автоматической экспресс-проверки, отметьте галочкой все жесткие диски и нажмите на кнопку Scan. После окончания проверки сохраните его лог (нажмите на кнопку Save) под каким хотите именем, например Gmer.log

 

Скачайте ComboFix здесь или здесь и сохраните на рабочий стол.

 

1. Внимание! Обязательно закройте все браузеры, временно выключите антивирус, firewall и другое защитное программное обеспечение. Не запускайте других программ во время работы Combofix. Combofix может отключить интернет через некоторое время после запуска, не переподключайте интернет пока Combofix не завершит работу. Если интернет не появился после окончания работы Combofix, перезагрузите компьютер. Во время работы Combofix не нажимайте кнопки мыши, это может стать причиной зависания Combofix.

2. Запустите combofix.exe, когда процесс завершится лог сохраниться в файл C:\ComboFix.txt

 

Прим: В случае, если ComboFix не запускается, переименуйте combofix.exe в combo-fix.exe

 

ComboFix. Руководство по применению.

прикрепите к сообщению логи ComboFix и Gmer.

[lomvi]

при запуске gmer. у меня выскакивает ошибка Microsoft и приложение закрывается без проверки

[snifer67]

при запуске gmer. у меня выскакивает ошибка Microsoft и приложение закрывается без проверки

Выгрузите защитное ПО, эмуляторы дисков.

[Nikolay Lazarenko]

а если у меня включается проактивная защита подозрительное действие Suspicious driver installation

Процесс (PID:2916)

мне его разрешить, запретить или добавить в доверенную зону?

Это происходит во время формирования логов в avz!

 

Пожалуйста,внимательно читайте правила раздела.При выполнении действий с avz,нужно выключать КАВ/КИС,т.к. происходит искажение логов и увеличение времени процедур скриптов и сканирования.Внимательное чтение правил раздела избавляет от массы проблем и вопросов.Если вы всё-таки не отключаете антивирус,чтобы не исказить результаты сделайте следующее-настройте проактивную защиту так,как описано в скриншоте и после этого используя avz нажимайте действие разрешить при выводе уведомлений.Пункт который нужно выполнить выделен в скрине красным цветом(нужно снять галочку,как сделано в скрине),всё остальное трогать нельзя.