spambot или что

[evgen_ln]

Что за вирус, каспер не не находит по словам клиента, валит dns запросами на левые хосты, постояная активность на 139 порт

[11/May/2009 10:20:44] {proto_dns} DNS: query 10.241.1.10:2388 -> 10.241.1.30:53 for vmwoyacchk.net
[11/May/2009 10:20:45] {proto_dns} DNS: query 10.241.1.10:2388 -> 10.241.1.30:53 for vmwoyacchk.net
[11/May/2009 10:20:46] {proto_dns} DNS: query 10.241.1.10:2388 -> 10.241.1.30:53 for vmwoyacchk.net
[11/May/2009 10:20:48] {proto_dns} DNS: query 10.241.1.10:2388 -> 10.241.1.30:53 for vmwoyacchk.net
[11/May/2009 10:20:52] {proto_dns} DNS: query 10.241.1.10:2388 -> 10.241.1.30:53 for vmwoyacchk.net
[11/May/2009 10:21:07] {proto_dns} DNS: query 10.241.1.10:2389 -> 10.241.1.30:53 for ixnyhjvhbya.com
[11/May/2009 10:21:08] {proto_dns} DNS: query 10.241.1.10:2389 -> 10.241.1.30:53 for ixnyhjvhbya.com
[11/May/2009 10:21:09] {proto_dns} DNS: query 10.241.1.10:2389 -> 10.241.1.30:53 for ixnyhjvhbya.com
[11/May/2009 10:21:11] {proto_dns} DNS: query 10.241.1.10:2389 -> 10.241.1.30:53 for ixnyhjvhbya.com
[11/May/2009 10:21:15] {proto_dns} DNS: query 10.241.1.10:2389 -> 10.241.1.30:53 for ixnyhjvhbya.com
[11/May/2009 10:21:29] {proto_dns} DNS: query 10.241.1.10:2390 -> 10.241.1.30:53 for vjvtqjyu.org
[11/May/2009 10:21:30] {proto_dns} DNS: query 10.241.1.10:2390 -> 10.241.1.30:53 for vjvtqjyu.org
[11/May/2009 10:21:31] {proto_dns} DNS: query 10.241.1.10:2390 -> 10.241.1.30:53 for vjvtqjyu.org
[11/May/2009 10:21:33] {proto_dns} DNS: query 10.241.1.10:2390 -> 10.241.1.30:53 for vjvtqjyu.org
[11/May/2009 10:21:37] {proto_dns} DNS: query 10.241.1.10:2390 -> 10.241.1.30:53 for vjvtqjyu.org
[11/May/2009 10:21:51] {proto_dns} DNS: query 10.241.1.10:2391 -> 10.241.1.30:53 for cggyup.cn
[11/May/2009 10:21:52] {proto_dns} DNS: query 10.241.1.10:2391 -> 10.241.1.30:53 for cggyup.cn
[11/May/2009 10:21:53] {proto_dns} DNS: query 10.241.1.10:2391 -> 10.241.1.30:53 for cggyup.cn
[11/May/2009 10:21:55] {proto_dns} DNS: query 10.241.1.10:2391 -> 10.241.1.30:53 for cggyup.cn
[11/May/2009 10:21:59] {proto_dns} DNS: query 10.241.1.10:2391 -> 10.241.1.30:53 for cggyup.cn
[11/May/2009 10:22:13] {proto_dns} DNS: query 10.241.1.10:2392 -> 10.241.1.30:53 for rbfbwqrovj.org
[11/May/2009 10:22:14] {proto_dns} DNS: query 10.241.1.10:2392 -> 10.241.1.30:53 for rbfbwqrovj.org
[11/May/2009 10:22:15] {proto_dns} DNS: query 10.241.1.10:2392 -> 10.241.1.30:53 for rbfbwqrovj.org
[11/May/2009 10:22:17] {proto_dns} DNS: query 10.241.1.10:2392 -> 10.241.1.30:53 for rbfbwqrovj.org
[11/May/2009 10:22:21] {proto_dns} DNS: query 10.241.1.10:2392 -> 10.241.1.30:53 for rbfbwqrovj.org
[11/May/2009 10:22:36] {proto_dns} DNS: query 10.241.1.10:2393 -> 10.241.1.30:53 for frjtctvq.net
[11/May/2009 10:22:37] {proto_dns} DNS: query 10.241.1.10:2393 -> 10.241.1.30:53 for frjtctvq.net
[11/May/2009 10:22:38] {proto_dns} DNS: query 10.241.1.10:2393 -> 10.241.1.30:53 for frjtctvq.net
[11/May/2009 10:22:40] {proto_dns} DNS: query 10.241.1.10:2393 -> 10.241.1.30:53 for frjtctvq.net
[11/May/2009 10:22:44] {proto_dns} DNS: query 10.241.1.10:2393 -> 10.241.1.30:53 for frjtctvq.net
[11/May/2009 10:22:58] {proto_dns} DNS: query 10.241.1.10:2394 -> 10.241.1.30:53 for vpgbdnzctw.com
[11/May/2009 10:22:59] {proto_dns} DNS: query 10.241.1.10:2394 -> 10.241.1.30:53 for vpgbdnzctw.com
[11/May/2009 10:23:00] {proto_dns} DNS: query 10.241.1.10:2394 -> 10.241.1.30:53 for vpgbdnzctw.com
[11/May/2009 10:23:02] {proto_dns} DNS: query 10.241.1.10:2394 -> 10.241.1.30:53 for vpgbdnzctw.com
[11/May/2009 10:23:06] {proto_dns} DNS: query 10.241.1.10:2394 -> 10.241.1.30:53 for vpgbdnzctw.com
[11/May/2009 10:23:20] {proto_dns} DNS: query 10.241.1.10:2395 -> 10.241.1.30:53 for qldddbkqo.com
[11/May/2009 10:23:21] {proto_dns} DNS: query 10.241.1.10:2395 -> 10.241.1.30:53 for qldddbkqo.com
[11/May/2009 10:23:22] {proto_dns} DNS: query 10.241.1.10:2395 -> 10.241.1.30:53 for qldddbkqo.com
[11/May/2009 10:23:24] {proto_dns} DNS: query 10.241.1.10:2395 -> 10.241.1.30:53 for qldddbkqo.com
[11/May/2009 10:23:28] {proto_dns} DNS: query 10.241.1.10:2395 -> 10.241.1.30:53 for qldddbkqo.com
[11/May/2009 10:23:42] {proto_dns} DNS: query 10.241.1.10:2396 -> 10.241.1.30:53 for aomwsxtwqs.ws
[11/May/2009 10:23:43] {proto_dns} DNS: query 10.241.1.10:2396 -> 10.241.1.30:53 for aomwsxtwqs.ws
[11/May/2009 10:23:44] {proto_dns} DNS: query 10.241.1.10:2396 -> 10.241.1.30:53 for aomwsxtwqs.ws
[11/May/2009 10:23:46] {proto_dns} DNS: query 10.241.1.10:2396 -> 10.241.1.30:53 for aomwsxtwqs.ws
[11/May/2009 10:23:50] {proto_dns} DNS: query 10.241.1.10:2396 -> 10.241.1.30:53 for aomwsxtwqs.ws
[11/May/2009 10:24:05] {proto_dns} DNS: query 10.241.1.10:2397 -> 10.241.1.30:53 for irkuzmste.org
[11/May/2009 10:24:06] {proto_dns} DNS: query 10.241.1.10:2397 -> 10.241.1.30:53 for irkuzmste.org
[11/May/2009 10:24:07] {proto_dns} DNS: query 10.241.1.10:2397 -> 10.241.1.30:53 for irkuzmste.org
[11/May/2009 10:24:09] {proto_dns} DNS: query 10.241.1.10:2397 -> 10.241.1.30:53 for irkuzmste.org
[11/May/2009 10:24:13] {proto_dns} DNS: query 10.241.1.10:2397 -> 10.241.1.30:53 for irkuzmste.org
[11/May/2009 10:24:27] {proto_dns} DNS: query 10.241.1.10:2398 -> 10.241.1.30:53 for vqytotijba.com
[11/May/2009 10:24:28] {proto_dns} DNS: query 10.241.1.10:2398 -> 10.241.1.30:53 for vqytotijba.com
[11/May/2009 10:24:29] {proto_dns} DNS: query 10.241.1.10:2398 -> 10.241.1.30:53 for vqytotijba.com
[11/May/2009 10:24:31] {proto_dns} DNS: query 10.241.1.10:2398 -> 10.241.1.30:53 for vqytotijba.com
[11/May/2009 10:24:35] {proto_dns} DNS: query 10.241.1.10:2398 -> 10.241.1.30:53 for vqytotijba.com
[11/May/2009 10:24:49] {proto_dns} DNS: query 10.241.1.10:2399 -> 10.241.1.30:53 for kobnpmk.cn
[11/May/2009 10:24:50] {proto_dns} DNS: query 10.241.1.10:2399 -> 10.241.1.30:53 for kobnpmk.cn
[11/May/2009 10:24:51] {proto_dns} DNS: query 10.241.1.10:2399 -> 10.241.1.30:53 for kobnpmk.cn
[11/May/2009 10:24:53] {proto_dns} DNS: query 10.241.1.10:2399 -> 10.241.1.30:53 for kobnpmk.cn
[11/May/2009 10:24:57] {proto_dns} DNS: query 10.241.1.10:2399 -> 10.241.1.30:53 for kobnpmk.cn
[11/May/2009 10:25:11] {proto_dns} DNS: query 10.241.1.10:2400 -> 10.241.1.30:53 for huaur.ws
[11/May/2009 10:25:12] {proto_dns} DNS: query 10.241.1.10:2400 -> 10.241.1.30:53 for huaur.ws
[11/May/2009 10:25:13] {proto_dns} DNS: query 10.241.1.10:2400 -> 10.241.1.30:53 for huaur.ws
[11/May/2009 10:25:15] {proto_dns} DNS: query 10.241.1.10:2400 -> 10.241.1.30:53 for huaur.ws
[11/May/2009 10:25:19] {proto_dns} DNS: query 10.241.1.10:2400 -> 10.241.1.30:53 for huaur.ws
[11/May/2009 10:25:34] {proto_dns} DNS: query 10.241.1.10:2401 -> 10.241.1.30:53 for avoqrovf.biz
[11/May/2009 10:25:35] {proto_dns} DNS: query 10.241.1.10:2401 -> 10.241.1.30:53 for avoqrovf.biz
[11/May/2009 10:25:36] {proto_dns} DNS: query 10.241.1.10:2401 -> 10.241.1.30:53 for avoqrovf.biz
[11/May/2009 10:25:38] {proto_dns} DNS: query 10.241.1.10:2401 -> 10.241.1.30:53 for avoqrovf.biz
[11/May/2009 10:25:42] {proto_dns} DNS: query 10.241.1.10:2401 -> 10.241.1.30:53 for avoqrovf.biz
[11/May/2009 10:25:56] {proto_dns} DNS: query 10.241.1.10:2402 -> 10.241.1.30:53 for vnqyh.ws
[11/May/2009 10:25:57] {proto_dns} DNS: query 10.241.1.10:2402 -> 10.241.1.30:53 for vnqyh.ws
[11/May/2009 10:25:58] {proto_dns} DNS: query 10.241.1.10:2402 -> 10.241.1.30:53 for vnqyh.ws
[11/May/2009 10:26:00] {proto_dns} DNS: query 10.241.1.10:2402 -> 10.241.1.30:53 for vnqyh.ws
[11/May/2009 10:26:04] {proto_dns} DNS: query 10.241.1.10:2402 -> 10.241.1.30:53 for vnqyh.ws
[11/May/2009 10:26:18] {proto_dns} DNS: query 10.241.1.10:2403 -> 10.241.1.30:53 for pxwhcxttxu.org
[11/May/2009 10:26:19] {proto_dns} DNS: query 10.241.1.10:2403 -> 10.241.1.30:53 for pxwhcxttxu.org
[11/May/2009 10:26:20] {proto_dns} DNS: query 10.241.1.10:2403 -> 10.241.1.30:53 for pxwhcxttxu.org
[11/May/2009 10:26:22] {proto_dns} DNS: query 10.241.1.10:2403 -> 10.241.1.30:53 for pxwhcxttxu.org
[11/May/2009 10:26:26] {proto_dns} DNS: query 10.241.1.10:2403 -> 10.241.1.30:53 for pxwhcxttxu.org

Edited May 11, 2009 by evgen_ln

[evgen_ln]

отредактировал

[sdy_moscow]

плохо ищите... колупайте в устройствах левый драйвер (уже писал где-то месяц назад, поищите мои посты)

Edited May 11, 2009 by sdy_moscow

[bitbucket]

Вообще то очень похоже на kido/conficker.

[evgen_ln]

Выловлен kido, при помощи майкрософт ремовтол. Странно но касперский не обнаружил.