Усиленый режим Eset SS

Добрый день! Поймал вирус! Нажимаю на иконку нода в трее выскакивает сообщение про усиленый режим! Лог сделал! Прикрепляю!

архив поврежден, переделайте образ автозапуска.

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Версия базы данных: 7346

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

01.08.2011 19:10:53
mbam-log-2011-08-01 (19-10-53).txt

Тип сканирования: Быстрое сканирование
Просканированные объекты: 156529
Времени прошло: 7 минут, 6 секунд

Зараженные процессы в памяти: 5
Зараженные модули в памяти: 0
Зараженные ключи в реестре: 7
Зараженные параметры в реестре: 15
Объекты реестра заражены: 3
Зараженные папки: 1
Зараженные файлы: 20

Зараженные процессы в памяти:
c:\Windows\update.tray-3-0\svchost.exe (Trojan.Dropper) -> 780 -> Unloaded process successfully.
c:\Windows\update.tray-12-0\svchost.exe (Trojan.Dropper) -> 1108 -> Unloaded process successfully.
c:\Windows\systemup.exe (Trojan.Agent) -> 1156 -> Unloaded process successfully.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 1912 -> Unloaded process successfully.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> 2884 -> Unloaded process successfully.

Зараженные модули в памяти:
(Вредоносных программ не обнаружено)

Зараженные ключи в реестре:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpdriv­ers (Trojan.Dropper) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srviech­eck (Backdoor.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\sysdriver32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\systeminfog (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SERVICES32.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot­\Minimal\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot­\Network\wxpdrivers (Trojan.Agent) -> Quarantined and deleted successfully.

Зараженные параметры в реестре:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\tray_ico0 (Trojan.Dropper) -> Value: tray_ico0 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\tray_ico1 (Trojan.Dropper) -> Value: tray_ico1 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\systemup (Trojan.Agent) -> Value: systemup -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\8805497.exe (Trojan.Downloader.Gen) -> Value: 8805497.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\72453142-loader2.exe (Trojan.Agent) -> Value: 72453142-loader2.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\20431354-loader2.exe (Trojan.Agent) -> Value: 20431354-loader2.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\82281017-loader2.exe (Trojan.Agent) -> Value: 82281017-loader2.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\6559957-loader2.exe (Trojan.Downloader.Gen) -> Value: 6559957-loader2.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\84758970-loader2.exe (Trojan.Agent) -> Value: 84758970-loader2.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\74950108-loader2.exe (Trojan.Agent) -> Value: 74950108-loader2.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\8083420.exe (Trojan.Downloader.Gen) -> Value: 8083420.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\3097344.exe (Trojan.Downloader.Gen) -> Value: 3097344.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\Run\wxpdrv (Backdoor.Agent) -> Value: wxpdrv -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Services32.exe\close (Trojan.Agent) -> Value: close -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wxpDriv­ers\ImagePath (Trojan.Agent) -> Value: ImagePath -> Quarantined and deleted successfully.

Объекты реестра заражены:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Зараженные папки:
c:\Windows\rpcminer (Trojan.BCMiner) -> Quarantined and deleted successfully.

Зараженные файлы:
c:\Windows\update.tray-3-0\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\update.tray-12-0\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\systemup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\update.1\svchost.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\System32\config\svchost.exe (Trojan.StartPage) -> Quarantined and deleted successfully.
c:\Windows\update.2\svchost.exe (Backdoor.Agent) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinmineropencl.cl (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_10.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_11.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\bitcoinminercuda_20.cubin (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\cudart32_32_16.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\curllib.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libeay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\libsasl.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\openldap.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-4way.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cpu.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-cuda.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\rpcminer-opencl.exe (Trojan.BCMiner) -> Quarantined and deleted successfully.
c:\Windows\rpcminer\ssleay32.dll (Trojan.BCMiner) -> Quarantined and deleted successfully.


Только что сделал Anti malware

малваребайт нам пока не нужен, нужен новый образ автозапуска.

+ логи от малваребайт не надо постить в сообщение, прикладывайте как текстовый файл

Новый лог!

пароль какой?

infected

1. выполните в uVS приложенный скрипт (меню- скрипт - выполнить скрипт из файла);

после перезагрузки,
2. пробуем обновить антивирус, выполнить полное сканирование;

далее,
3. архив из папки uVS (с копиями вирусов для вирлаба, имя автоматически формируется от текущей даты,
  например: 2010-10-04_13-30-55.rar/7z)
... отправить в почту [email protected], [email protected];
*** если архив не был создан автоматически, самостоятельно добавьте папку ZOO в архив с паролем infected

далее,
4. добавить на форум новый образ автозапуска uVS.