Проблема с baidu

[Krankh_A]

Здравствуйте. Один из клиентов поймал на машину китайца baidu. С клиентом работаю удаленно, с правами админа все в порядке. Прилагаю логи автологгера, и, на всякий случай лог AdwCleaner.

CollectionLog-2014.12.04-18.31.zip

AdwCleanerR0.txt

[thyrex]

Выполните скрипт в AVZ

begin

BC_DeleteFile('c:\program files (x86)\common files\baidu\baiduhips\1.1.0.733\baiduhips.exe');

 BC_DeleteFile('c:\program files (x86)\baidu\baidusd\1.8.0.1255\baidusdsvc.exe');

 BC_DeleteFile('c:\program files (x86)\baidu\baidusd\1.8.0.1255\baidusdtray.exe');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BaiduSdUProxy64.exe');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDKitUtils.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMAVCached.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMAVEng.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDMPerfMon.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\BDUDiskGuard.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\bduf.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\bdmantivirus\TrustAndIso.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BDMAVE.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BDMLog.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\DriverManager.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\FileMon.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\HIPSClient.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\plugins\bdkvrtpplugins\PrivacyProtect.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\Plugins\bdkvtrayplugins\BDDownLoadProtectPlugin.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\Plugins\bdkvtrayplugins\BDKVRmvDevPlugin.dll');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\Plugins\bdkvtrayplugins\BDKVTrayTipsPlugin.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\ad.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BaiduHipsBusiness.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BaiduHipsCore.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BaiduPrevUIn.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDConfig.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDLogicUtils.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\bdmantivirus\BDKitUtils.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMAVCached.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMAVEng.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMBase.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMFrameWork.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMNet.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMReport.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMStringUtils.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BDMTinyXml.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\DriverManager.dll');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\TrustAndIso.dll');

 BC_DeleteFile('C:\Windows\system32\DRIVERS\bd0001.sys');

 BC_DeleteFile('C:\Windows\system32\DRIVERS\bd0002.sys');

 BC_DeleteFile('C:\Windows\system32\DRIVERS\BDArKit.sys');

 BC_DeleteFile('C:\Windows\system32\drivers\BDDefense.sys');

 BC_DeleteFile('C:\Windows\system32\DRIVERS\BDSafeBrowser.sys');

 BC_DeleteSvc('BaiduHips');

 BC_DeleteFile('C:\Program Files (x86)\Common Files\Baidu\BaiduHips\1.1.0.733\BaiduHips.exe');

 BC_DeleteSvc('bd0001');

 BC_DeleteSvc('bd0002');

 BC_DeleteSvc('BDArKit');

 BC_DeleteSvc('BDDefense');

 BC_DeleteSvc('BDSafeBrowser');

 BC_DeleteSvc('bd0004');

 BC_DeleteSvc('BDAntiExp');

 BC_DeleteFile('C:\Program Files (x86)\BaiduEx\uninit.exe');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduAn\3.0.0.3971\baiduAnTray.exe');

 BC_DeleteFile('C:\Program Files (x86)\Baidu\BaiduSd\1.8.0.1255\BaiduSdTray.exe');

 BC_DeleteFile('C:\Program Files\BaiduEx\uninit.exe');

BC_Activate;

RebootWindows(false);

end.

Компьютер перезагрузится.

 

Сделайте новые логи

 

Сделайте лог ComboFix

[Krankh_A]

Скрипт результатов не дал, клиент решил переустанавливать систему. Проблема закрыта, спасибо.