Problemi connessione ed aggiornamenti

[John Doe]

L'errore riportato è il seguente! Cosa devo fare adesso ?

[ste_95]

hai premuto Ok? Il programma dovrebbe comunque aver rimosso gli altri file, no? In caso non avesse funzionato, usa questo script:

Codice: Seleziona tutto

Files to delete:
c:\windows\system32\b6a3.sys
c:\windows\system32\b693CC.sys
c:\windows\system32\d3d8caps.dat
c:\windows\system32\drivers\ybbqgcebfoid.sys

[John Doe]

Questo è il log di Avanger

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Error: could not create zip file.
Error code: 0


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\uqbdtbfm

*******************

Script file located at: \??\C:\Documents and Settings\elbxlhih.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Documents and Settings\John Doe\Dati applicazioni\hidires\m_hook.sys for deletion
Deletion of file C:\Documents and Settings\John Doe\Dati applicazioni\hidires\m_hook.sys failed!

Could not process line:
C:\Documents and Settings\John Doe\Dati applicazioni\hidires\m_hook.sys
Status: 0xc000003a



Could not open file C:\Documents and Settings\John Doe\Dati applicazioni\hidires\hidr.exe for deletion
Deletion of file C:\Documents and Settings\John Doe\Dati applicazioni\hidires\hidr.exe failed!

Could not process line:
C:\Documents and Settings\John Doe\Dati applicazioni\hidires\hidr.exe
Status: 0xc000003a



File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



Folder C:\Documents and Settings\John Doe\Dati applicazioni\hidires not found!
Deletion of folder C:\Documents and Settings\John Doe\Dati applicazioni\hidires failed!

Could not process line:
C:\Documents and Settings\John Doe\Dati applicazioni\hidires
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK
Status: 0xc0000034



Could not delete registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|hldrrr
Deletion of registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|hldrrr failed!
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Jan 14 17:51:25 2009

17:51:23: Error: Invalid registry syntax in command:
"HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\{72e9b194-4601-11dd-9105-00155817c715}\Shell\AutoRun\command"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry key deletion mode)


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Error: Script file not found!
Could not open script file! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist

Abort!



//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Jan 14 18:04:23 2009

18:04:19: Error: Invalid registry syntax in command:
"HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\{72e9b194-4601-11dd-9105-00155817c715}\Shell\AutoRun\command"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry key deletion mode)
18:04:23: Error: Execution aborted by user!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Jan 14 18:04:53 2009

18:04:49: Error: Invalid registry syntax in command:
"HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\{72e9b194-4601-11dd-9105-00155817c715}\Shell\AutoRun\command"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry key deletion mode)
18:04:53: Error: Execution aborted by user!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Jan 14 18:13:45 2009

18:13:38: Error: Invalid registry syntax in command:
"HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\{72e9b194-4601-11dd-9105-00155817c715}\Shell\AutoRun\command"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry key deletion mode)
18:13:45: Error: Execution aborted by user!


//////////////////////////////////////////


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Wed Jan 14 18:14:15 2009

18:13:55: Error: Invalid registry syntax in command:
"HKCU\software\microsoft\windows\currentversion\explorer\mountpoints2\{72e9b194-4601-11dd-9105-00155817c715}\Shell\AutoRun\command"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry key deletion mode)


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:


Error: file "c:\windows\system32\b6a3.sys" not found!
Deletion of file "c:\windows\system32\b6a3.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "c:\windows\system32\b693CC.sys" not found!
Deletion of file "c:\windows\system32\b693CC.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "c:\windows\system32\d3d8caps.dat" not found!
Deletion of file "c:\windows\system32\d3d8caps.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "c:\windows\system32\drivers\ybbqgcebfoid.sys" not found!
Deletion of file "c:\windows\system32\drivers\ybbqgcebfoid.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Sembra che nessuno dei file infetti fosse presente. A mio parere, il problema è da ricercarsi da un'altra parte, non è quasi sicuramente dato da un malware.

[John Doe]

Sembra che nessuno dei file infetti fosse presente. A mio parere, il problema è da ricercarsi da un'altra parte, non è quasi sicuramente dato da un malware.

Cosa consigli?

[ste_95]

Non saprei proprio cosa dirti. E' un problema che non ho mai visto, e non saprei fornirti una soluzione. Aspettiamo qualcuno che possa fornirti qualche suggerimento.

[John Doe]

Non saprei proprio cosa dirti. E' un problema che non ho mai visto, e non saprei fornirti una soluzione. Aspettiamo qualcuno che possa fornirti qualche suggerimento.

Beh giusto per la cronaca... il problema sembrerebbe risolto. Adesso tutti siti si viualizzano correttamente e sono riuscito anche ad aggiornare!

Grazie

[ste_95]

Ah be, allora qualcosa tra tool e programmi di sicurezza abbiamo risolto.

[pastanaca]

Grazie a Ste_95 ho risolto il problema sui miei due computer e tramite Norton antivirus ho rimosso il virus WIN32.Downadup.B sia dalle penne USB responsabili dell'infezione che dal computer che mi aveva a sua volta infettato le penne USB. Ora è tutto a posto!!

[ste_95]

Grazie a Ste_95 ho risolto il problema sui miei due computer e tramite Norton antivirus ho rimosso il virus WIN32.Downadup.B sia dalle penne USB responsabili dell'infezione che dal computer che mi aveva a sua volta infettato le penne USB. Ora è tutto a posto!!