Лечим WinCtrl32, ntos.exe и прочее

[Sim]

sysinfo.ziphijackthis.zipvirusinfo_syscheck.zipvirusinfo_syscure.zipПрошла, логи должны быть в этом сообщении Изменено 20 сентября, 2008 пользователем Falcon

[JIABP]

Sim, проблема так и не решилась? Когда хелпер сможет проанализировать логи, тогда всё встанет на свои места = )

[Sim]

Проблема разрешилась частично. С експлорером какие-то глюки постоянно случаются - но это пережить можно. А вот то, что мозилла перестал сохранять страницы, слегка напрягает...ну, это мелочи...установили 7ую версию - лицензию - вашего антивируса, и почти все вернулось на место...^^

[Евгений Малинин]

Попробуйте обовиться до версии 8.0 (2009) и версию браузера до самой последней...

Изменено 20 сентября, 2008 пользователем JIABP

[Falcon]

Sim

У вас целый букет, но удалить это вполне реально.

 

Качаем IceSword.

 

Прибиваем в нем:

C:\WINDOWS\System32\Drivers\Winfm52.sys

C:\WINDOWS\system32\Drivers\Hnt85.sys

C:\WINDOWS\system32\WinCtrl32.dl

 

Как это сделать?

-Запустите программу.

-Внизу слева выберите меню File.

Появится аналог проводника. Найдите в нем файл руткита.

-Нажмите по нему правой кнопкой мыши и выберите force delete.

-На запрос потверждения ответьте "да".

 

 

Пофиксить в HJT:

R3 - URLSearchHook: (no name) - {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Program Files\Mail.Ru\Agent\Mra\dll\newmrasearch.dll (file missing)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\Dmitry\pwoyaia.exe \s,C:\WINDOWS\system32\ntos.exe,
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: VirtualNetwork module - {6C517674-DE1C-4493-977C-34A1BFAB35BA} - C:\Program Files\VirtualNetwork\VirtualNetwork.dll
O2 - BHO: BitAccelerator module - {92860A02-4D69-48c1-82D7-EF6B2C609502} - D:\Program Files\BitAccelerator\BitAccelerator.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4D91-8333-CF10577473F7} - C:\Documents and Settings\Dmitry\Google\googletoolbar1.dll
O2 - BHO: (no name) - {FFFC57DB-1DE3-4303-B24D-CEE6DCDD3D86} - C:\PROGRA~1\MYCENT~1\InfoBar\MYCENT~1.DLL
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [lanmanwrk.exe clean] C:\WINDOWS\System32\lanmanwrk.exe clean
O4 - HKLM\..\Run: [KernelDrv.exe clean] C:\WINDOWS\System32\KernelDrv.exe clean
O4 - HKLM\..\Run: [awdr] C:\WINDOWS\system32\awdr.exe \u
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZKman000
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll

 

Выполнить в AVZ:

begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
TerminateProcessByName('C:\Documents and Settings\Dmitry\pwoyaia.exe ');
DeleteService('AppMgmtFastUserSwitchingCompatibility');
DeleteService('AppMgmtSSDPSRV');
DeleteService('BrowserwinmgmtALG');
DeleteService('ClipSrvupnphost');
DeleteService('ClipSrvWebClient');
DeleteService('ClipSrvWebClientSSDPSRV');
DeleteService('CryptSvcLmHosts');
DeleteService('CryptSvcNetmanAppMgmt');
DeleteService('CryptSvcNetmanAppMgmtMessenger');
DeleteService('CryptSvcPlugPlayBrowser');
DeleteService('CryptSvcWebClient');
DeleteService('CryptSvcWebClientRSVPwscsvc');
DeleteService('DcomLaunchNla');
DeleteService('dmadminClipSrvWebClientSSDPSRV');
DeleteService('FastUserSwitchingCompatibilitywuauservDcomLaunch');
DeleteService('HidServERSvc');
DeleteService('HidServERSvcwscsvcNla');
DeleteService('HidServlanmanworkstation');
DeleteService('HidServlanmanworkstationRSVPNOD32krnEventSystem');
DeleteService('HidServWmdmPmSN');
DeleteService('HTTPFilterBITS');
DeleteService('HTTPFilterBITSRasAutoAlerter');
DeleteService('HTTPFilterBITSRasAutoAlerterdmserver');
DeleteService('HTTPFilterHidServ');
DeleteService('lanmanserverose');
DeleteService('lanmanworkstationNetlogon');
DeleteService('LmHostsClipSrv');
DeleteService('LmHostsClipSrvAppMgmtFastUserSwitchingCompatibility');
DeleteService('LmHostsClipSrvHidServlanmanworkstationRSVPNOD32krnEventSystem');
DeleteService('MDMNetDDE');
DeleteService('MDMRasMan');
DeleteService('MDMRasManShellHWDetection');
DeleteService('MDMRemoteRegistry');
DeleteService('MSDTCTermService');
DeleteService('MSDTCTermServiceProtectedStorage');
DeleteService('MSDTCTermServiceProtectedStorageWmi');
DeleteService('MyWebSearchServiceMSDTC');
DeleteService('MyWebSearchServiceMSDTCProtectedStorage');
DeleteService('MyWebSearchServiceMSDTCProtectedStorageMessenger');
DeleteService('MyWebSearchServiceMSDTCProtectedStorageMessengerBrowserwinmgmtALG');
DeleteService('NetDDEdsdmNtmsSvc');
DeleteService('NetlogonCiSvc');
DeleteService('NetlogonCiSvcEventSystem');
DeleteService('NetlogonCiSvcEventSystemClipSrv');
DeleteService('NetlogonCiSvcWmi');
DeleteService('NetlogonCiSvcWmiseclogon');
DeleteService('NetlogonCiSvcWmiTlntSvr');
DeleteService('NetmanAppMgmt');
DeleteService('NetmanAppMgmtEventlog');
DeleteService('NetmanAppMgmtEventlogAppMgmt');
DeleteService('NetmanAppMgmtEventlogAppMgmtwinmgmt');
DeleteService('NetmanAppMgmtEventlogAppMgmtwinmgmtAlerter');
DeleteService('NlaMessenger');
DeleteService('NlaMessengerlanmanworkstationNetlogon');
DeleteService('Nlaupnphost');
DeleteService('NtmsSvcRSVP');
DeleteService('NtmsSvcRSVPW32Time');
DeleteService('NtmsSvcRSVPW32TimewinmgmtALG');
DeleteService('PlugPlayBrowser');
DeleteService('PlugPlayBrowserHTTPFilterBITS');
DeleteService('PlugPlaySpooler');
DeleteService('PlugPlaySpoolerhelpsvc');
DeleteService('RasAutoAlerter');
DeleteService('RemoteAccesswinmgmt');
DeleteService('RemoteRegistryRpcSs');
DeleteService('RpcLocatorMDM');
DeleteService('RpcSsNtmsSvcRSVPW32Time');
DeleteService('RSVPNOD32krn');
DeleteService('RSVPNOD32krnCOMSysApp');
DeleteService('RSVPNOD32krnEventSystem');
DeleteService('RSVPwscsvc');
DeleteService('RSVPwscsvcMDMRasMan');
DeleteService('seclogonNtmsSvcRSVP');
DeleteService('seclogonPlugPlayBrowser');
DeleteService('ShellHWDetectionSysmonLog');
DeleteService('TapiSrvHidServ');
DeleteService('TapiSrvTapiSrv');
DeleteService('TermServiceNetDDEdsdm');
DeleteService('TermServiceWmi');
DeleteService('ThemesSENS');
DeleteService('UPSEventSystem');
DeleteService('W32Timestisvc');
DeleteService('winmgmtALG');
DeleteService('winmgmtCOMSysApp');
DeleteService('winmgmtCOMSysAppPlugPlay');
DeleteService('WmiRasAutoAlerter');
DeleteService('WmiApSrvNtmsSvcRSVPW32Time');
DeleteService('WmiRasAutoAlerter');
DeleteService('wscsvcEventSystem');
DeleteService('wscsvcNla');
DeleteService('wscsvcNlaW32Time');
DeleteService('wuauservDcomLaunch');
DeleteService('WZCSVCHidServERSvc');
DeleteService('MyWebSearchService');
DeleteService('lanmandrv');
DeleteService('djO05');
DeleteService('gdrv');
DeleteService('tcpsr');
DeleteService('Hnt85');
DeleteService('Winfm52');
QuarantineFile('C:\WINDOWS\system32\awdr.exe ',' ');
QuarantineFile('C:\WINDOWS\system32\igfxtray.exe ',' ');
QuarantineFile('C:\WINDOWS\system32\IMEw.dll ',' ');
QuarantineFile('c:\program files\common files\acd systems\en\devdetect.exe ',' ');
DeleteFile('c:\windows\system32\lanmanwrk.exe');
DeleteFile('c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe');
DeleteFile('c:\documents and settings\dmitry\pwoyaia.exe');
DeleteFile('C:\Documents and Settings\Dmitry\Google\googletoolbar1.dll');
DeleteFile('C:\PROGRA~1\MYCENT~1\InfoBar\MYCENT~1.DLL');
DeleteFile('C:\WINDOWS\system32\WinCtrl32.dll');
DeleteFile('D:\Program Files\BitAccelerator\BitAccelerator.dll');
DeleteFile('C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL');
DeleteFile('C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL');
DeleteFile('C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL');
DeleteFile('C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoestb.dll');
DeleteFile('C:\WINDOWS\System32\lanmandrv.sys');
DeleteFile('C:\WINDOWS\System32\KernelDrv.exe');
DeleteFile('C:\WINDOWS\system32\ntos.exe');
DeleteFile('c:\program files\virtualnetwork\virtualnetwork.dll');
DeleteFile('C:\WINDOWS\System32\Drivers\djO05.sys');
DeleteFile('C:\WINDOWS\System32\drivers\tcpsr.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Hnt85.sys');
DeleteFile('C:\WINDOWS\System32\Drivers\Winfm52.sys');
DeleteFile('srv.exe');
BC_ImportAll;
BC_DeleteSvc('AppMgmtFastUserSwitchingCompatibility');
BC_DeleteSvc('AppMgmtSSDPSRV');
BC_DeleteSvc('BrowserwinmgmtALG');
BC_DeleteSvc('ClipSrvupnphost');
BC_DeleteSvc('ClipSrvWebClient');
BC_DeleteSvc('ClipSrvWebClientSSDPSRV');
BC_DeleteSvc('CryptSvcLmHosts');
BC_DeleteSvc('CryptSvcNetmanAppMgmt');
BC_DeleteSvc('CryptSvcNetmanAppMgmtMessenger');
BC_DeleteSvc('CryptSvcPlugPlayBrowser');
BC_DeleteSvc('CryptSvcWebClient');
BC_DeleteSvc('CryptSvcWebClientRSVPwscsvc');
BC_DeleteSvc('DcomLaunchNla');
BC_DeleteSvc('dmadminClipSrvWebClientSSDPSRV');
BC_DeleteSvc('FastUserSwitchingCompatibilitywuauservDcomLaunch');
BC_DeleteSvc('HidServERSvc');
BC_DeleteSvc('HidServERSvcwscsvcNla');
BC_DeleteSvc('HidServlanmanworkstation');
BC_DeleteSvc('HidServlanmanworkstationRSVPNOD32krnEventSystem');
BC_DeleteSvc('HidServWmdmPmSN');
BC_DeleteSvc('HTTPFilterBITS');
BC_DeleteSvc('HTTPFilterBITSRasAutoAlerter');
BC_DeleteSvc('HTTPFilterBITSRasAutoAlerterdmserver');
BC_DeleteSvc('HTTPFilterHidServ');
BC_DeleteSvc('lanmanserverose');
BC_DeleteSvc('lanmanworkstationNetlogon');
BC_DeleteSvc('LmHostsClipSrv');
BC_DeleteSvc('LmHostsClipSrvAppMgmtFastUserSwitchingCompatibility');
BC_DeleteSvc('LmHostsClipSrvHidServlanmanworkstationRSVPNOD32krnEventSystem');
BC_DeleteSvc('MDMNetDDE');
BC_DeleteSvc('MDMRasMan');
BC_DeleteSvc('MDMRasManShellHWDetection');
BC_DeleteSvc('MDMRemoteRegistry');
BC_DeleteSvc('MSDTCTermService');
BC_DeleteSvc('MSDTCTermServiceProtectedStorage');
BC_DeleteSvc('MSDTCTermServiceProtectedStorageWmi');
BC_DeleteSvc('MyWebSearchServiceMSDTC');
BC_DeleteSvc('MyWebSearchServiceMSDTCProtectedStorage');
BC_DeleteSvc('MyWebSearchServiceMSDTCProtectedStorageMessenger');
BC_DeleteSvc('MyWebSearchServiceMSDTCProtectedStorageMessengerBrowserwinmgmtALG');
BC_DeleteSvc('NetDDEdsdmNtmsSvc');
BC_DeleteSvc('NetlogonCiSvc');
BC_DeleteSvc('NetlogonCiSvcEventSystem');
BC_DeleteSvc('NetlogonCiSvcEventSystemClipSrv');
BC_DeleteSvc('NetlogonCiSvcWmi');
BC_DeleteSvc('NetlogonCiSvcWmiseclogon');
BC_DeleteSvc('NetlogonCiSvcWmiTlntSvr');
BC_DeleteSvc('NetmanAppMgmt');
BC_DeleteSvc('NetmanAppMgmtEventlog');
BC_DeleteSvc('NetmanAppMgmtEventlogAppMgmt');
BC_DeleteSvc('NetmanAppMgmtEventlogAppMgmtwinmgmt');
BC_DeleteSvc('NetmanAppMgmtEventlogAppMgmtwinmgmtAlerter');
BC_DeleteSvc('NlaMessenger');
BC_DeleteSvc('NlaMessengerlanmanworkstationNetlogon');
BC_DeleteSvc('Nlaupnphost');
BC_DeleteSvc('NtmsSvcRSVP');
BC_DeleteSvc('NtmsSvcRSVPW32Time');
BC_DeleteSvc('NtmsSvcRSVPW32TimewinmgmtALG');
BC_DeleteSvc('PlugPlayBrowser');
BC_DeleteSvc('PlugPlayBrowserHTTPFilterBITS');
BC_DeleteSvc('PlugPlaySpooler');
BC_DeleteSvc('PlugPlaySpoolerhelpsvc');
BC_DeleteSvc('RasAutoAlerter');
BC_DeleteSvc('RemoteAccesswinmgmt');
BC_DeleteSvc('RemoteRegistryRpcSs');
BC_DeleteSvc('RpcLocatorMDM');
BC_DeleteSvc('RpcSsNtmsSvcRSVPW32Time');
BC_DeleteSvc('RSVPNOD32krn');
BC_DeleteSvc('RSVPNOD32krnCOMSysApp');
BC_DeleteSvc('RSVPNOD32krnEventSystem');
BC_DeleteSvc('RSVPwscsvc');
BC_DeleteSvc('RSVPwscsvcMDMRasMan');
BC_DeleteSvc('seclogonNtmsSvcRSVP');
BC_DeleteSvc('seclogonPlugPlayBrowser');
BC_DeleteSvc('ShellHWDetectionSysmonLog');
BC_DeleteSvc('TapiSrvHidServ');
BC_DeleteSvc('TapiSrvTapiSrv');
BC_DeleteSvc('TermServiceNetDDEdsdm');
BC_DeleteSvc('TermServiceWmi');
BC_DeleteSvc('ThemesSENS');
BC_DeleteSvc('UPSEventSystem');
BC_DeleteSvc('W32Timestisvc');
BC_DeleteSvc('winmgmtALG');
BC_DeleteSvc('winmgmtCOMSysApp');
BC_DeleteSvc('winmgmtCOMSysAppPlugPlay');
BC_DeleteSvc('WmiRasAutoAlerter');
BC_DeleteSvc('WmiApSrvNtmsSvcRSVPW32Time');
BC_DeleteSvc('WmiRasAutoAlerter');
BC_DeleteSvc('wscsvcEventSystem');
BC_DeleteSvc('wscsvcNla');
BC_DeleteSvc('wscsvcNlaW32Time');
BC_DeleteSvc('wuauservDcomLaunch');
BC_DeleteSvc('WZCSVCHidServERSvc');
BC_DeleteSvc('MyWebSearchService');
BC_DeleteSvc('lanmandrv');
BC_DeleteSvc('djO05');
BC_DeleteSvc('gdrv');
BC_DeleteSvc('tcpsr');
BC_DeleteSvc('Hnt85');
BC_DeleteSvc('Winfm52');
BC_DeleteSvc('MyWebSearchService');
BC_DeleteSvc('lanmandrv');
BC_DeleteSvc('djO05');
BC_DeleteSvc('gdrv');
BC_DeleteSvc('tcps');
ExecuteSysClean;
BC_Activate;
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
RebootWindows(true);
end.

 

ПК перезагрузится. Полученный архив отправьте на newvirus@kaspersky.com не забыв указать пароль(virus). Ответ сообщите, логи повторите.

Изменено 20 сентября, 2008 пользователем Falcon

[Stanislav]

Ого! Давно я таких "маленьких" скриптов АВЗ не видел...

[akoK]

Pro100, он несложный...но трудоемкий.