INFETTATO DA BAGLE E PROBABILMENTE DA MOLTO ALTRO

[pieroxx]

Salve,
ho cercato di risolvere il mio problema seguendo la vostra guida ma non ci sono riuscito. Ho fatto la scansione online con Kaspersky (durata 3 giorni) ed ho trovato tantissimi files infetti!! Non sono però riuscito ad utilizzare AVENGER. Vi posto il report di Kaspersky con la speranza di riuscire a salvare il PC....
GRAZIE IN ANTICIPO

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Piero\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\BitTorrent\bittorrent.log Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\BitTorrent\incomplete\0bb3e74e-027a Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\BitTorrent\incomplete\378fd142-fb45 Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\BitTorrent\incomplete\a7263760-eed7 Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\BitTorrent\incomplete\c2bb91a4-18bd Object is locked skipped
C:\Documents and Settings\Piero\Dati applicazioni\m\data.oct Infected: Trojan-Downloader.Win32.Bagle.in skipped
C:\Documents and Settings\Piero\Dati applicazioni\Sprite PC Agent\SpriteLog.txt Object is locked skipped
C:\Documents and Settings\Piero\Desktop\MAIL PASSWORD\mailpv_setup.exe/mailpv.exe Infected: not-a-virus:PSWTool.Win32.MailPassView.130 skipped
C:\Documents and Settings\Piero\Desktop\MAIL PASSWORD\mailpv_setup.exe ZIP: infected - 1 skipped
C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.zip/VITO QuickContact (Windows Mobile 5.0) 2.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Piero\Desktop\WINDOWS VISTA\[App ITA] Windows VISTA ULTIMATE Rtm FINAL Build 6000.16386 (NOVEMBER 2006) activation crack keygen serial updated-fixed 01-2007.zip/Patch.exe Infected: Trojan-Clicker.Win32.Agent.ij skipped
C:\Documents and Settings\Piero\Desktop\WINDOWS VISTA\[App ITA] Windows VISTA ULTIMATE Rtm FINAL Build 6000.16386 (NOVEMBER 2006) activation crack keygen serial updated-fixed 01-2007.zip/Setup.exe Infected: P2P-Worm.Win32.Kapucen.b skipped
C:\Documents and Settings\Piero\Desktop\WINDOWS VISTA\[App ITA] Windows VISTA ULTIMATE Rtm FINAL Build 6000.16386 (NOVEMBER 2006) activation crack keygen serial updated-fixed 01-2007.zip ZIP: infected - 2 skipped
C:\Documents and Settings\Piero\Documenti\BitTorrent Downloads\Multi Password Recovery.rar/Multi Password Recovery/Multi Password Recovery v1.0.6/MPRSetup.exe/data0008 Infected: not-a-virus:PSWTool.Win32.MPR.015 skipped
C:\Documents and Settings\Piero\Documenti\BitTorrent Downloads\Multi Password Recovery.rar/Multi Password Recovery/Multi Password Recovery v1.0.6/MPRSetup.exe/data0013 Infected: not-a-virus:PSWTool.Win32.MPR.015 skipped
C:\Documents and Settings\Piero\Documenti\BitTorrent Downloads\Multi Password Recovery.rar/Multi Password Recovery/Multi Password Recovery v1.0.6/MPRSetup.exe Infected: not-a-virus:PSWTool.Win32.MPR.015 skipped
C:\Documents and Settings\Piero\Documenti\BitTorrent Downloads\Multi Password Recovery.rar/Multi Password Recovery/Multi Password Recovery v1.0.7/MPRSetup.exe/data0014 Infected: not-a-virus:PSWTool.Win32.MPR.015 skipped
C:\Documents and Settings\Piero\Documenti\BitTorrent Downloads\Multi Password Recovery.rar/Multi Password Recovery/Multi Password Recovery v1.0.7/MPRSetup.exe Infected: not-a-virus:PSWTool.Win32.MPR.015 skipped
C:\Documents and Settings\Piero\Documenti\BitTorrent Downloads\Multi Password Recovery.rar RAR: infected - 5 skipped
C:\Documents and Settings\Piero\Documenti\TUTTALAPOSTA\Re_ ShowPass.DOC.eml/[From "Happy Computer" ][Date Wed, 1 May 2002 15:43:29 +0200]/ShowPass.exe/Tira Asteriscos.exe Infected: not-a-virus:PSWTool.Win32.SnadBoy.11 skipped
C:\Documents and Settings\Piero\Documenti\TUTTALAPOSTA\Re_ ShowPass.DOC.eml/[From "Happy Computer" ][Date Wed, 1 May 2002 15:43:29 +0200]/ShowPass.exe Infected: not-a-virus:PSWTool.Win32.SnadBoy.11 skipped
C:\Documents and Settings\Piero\Documenti\TUTTALAPOSTA\Re_ ShowPass.DOC.eml Mail: infected - 2 skipped
C:\Documents and Settings\Piero\Documenti\TUTTALAPOSTA\ShowPass.DOC.eml/[From "Happy Computer" ][Date Tue, 30 Apr 2002 20:04:30 +0200]/ShowPass.DOC/Tira Asteriscos.exe Infected: not-a-virus:PSWTool.Win32.SnadBoy.11 skipped
C:\Documents and Settings\Piero\Documenti\TUTTALAPOSTA\ShowPass.DOC.eml/[From "Happy Computer" ][Date Tue, 30 Apr 2002 20:04:30 +0200]/ShowPass.DOC Infected: not-a-virus:PSWTool.Win32.SnadBoy.11 skipped
C:\Documents and Settings\Piero\Documenti\TUTTALAPOSTA\ShowPass.DOC.eml Mail: infected - 2 skipped
C:\Documents and Settings\Piero\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Piero\Impostazioni locali\Cronologia\History.IE5\MSHist012008012320080124\index.dat Object is locked skipped
C:\Documents and Settings\Piero\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Piero\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.in skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR\mxd[2].jpg Infected: Trojan-Downloader.Win32.Bagle.in skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.in skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[5].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[6].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_2[7].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[10].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[11].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[8].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\b64_3[9].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.in skipped
C:\Documents and Settings\Piero\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Piero\ntuser.dat.LOG Object is locked skipped
C:\Programmi\Alwil Software\Avast4\ashDisp.exe Infected: Trojan-Downloader.Win32.Bagle.ij skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\dllcache\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped

[ste_95]

3 giorni? ma non facevi prima a formattare?

Comunque, Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\WINDOWS\system32\mdelk.exe
C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.exe
C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.zip
C:\Documents and Settings\Piero\Desktop\WINDOWS VISTA\[App ITA] Windows VISTA ULTIMATE Rtm FINAL Build 6000.16386 (NOVEMBER 2006) activation crack keygen serial updated-fixed 01-2007.zip

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\Piero\Dati applicazioni\m
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.

[pieroxx]

Nell'attesa della risposta ho avuto la malaugurata idea di tentare di riavviare in modalità provvisoria da msconfig >boot.ini > safemod

Adesso il computer non si avvia nè in modalità provvisoria nè normalmente... si ferma sulla schermata dove sono elencate le varie opzioni:

avvia in modalità provvisoria
avvia in modalità provvisoria con rete
ecc. ecc. e poi

avvia windows normalmente

Qualunque sia la scelta il computer tenta di avviarsi dopodichè si riavvia rientrando nella schermata sopra descritta.

Adesso per potere accedere al forum ho avviato il PC con una distribuzione di linux da CD ROM

SONO DISPERATO, COSA POSSO TENTARE?

[ste_95]

Neanche in modalità normale si avvia?

[pieroxx]

Niente da fare, ho provato e riprovato ma non si riavvia più, a proposito della formattazione ... sarei nei guai perché non ho salvato dei dati importantissimi!!!

[ste_95]

Collega il tuo hard disk in un altro computer come slave e recupera i dati, quindi formattalo.

[pieroxx]

Sigh Sigh, speravo tanto di non sentirtelo dire....
Allora, mi armo di coraggio e pazienza, prendo un altro hard disk, installo Windows e poi l'attuale disco C lo collego tramite un box USB. Magari ci faccio subito una scansione con Kaspersky. Ma la posta la potrò recuperare? Utilizzo Outlook 2003.
Grazie

[ste_95]

Questo non te lo so dire, credo che sia contenuta in un file nella sua cartella.

[crazy.cat]

Ma la posta la potrò recuperare? Utilizzo Outlook 2003.

Cerca tutti i file *.pst.
Il percorso preciso non te lo so dire.

[pieroxx]

Alla fine, dopo avere collegato l'hard disk tramite un box esterno ad un altro PC ho recuperato i files più importanti, ho fatto una scansione con Kaspersky che ha trovato ed eliminato oltre 370 files infetti. Poi ho modificato il file "boot.ini" cancellando "safemod" e... FINALMENTE il PC si è avviato in modalità normale. Naturalmente non accetta ancora Kaspersky, mi dice che non è un'applicazione di Win32 valida.
Ho incollato lo script che mi hai dato su avenger e mi ha dato il log:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\moqasbwp

*******************

Script file located at: \??\C:\WINDOWS\system32\ngasiyfh.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.


File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034



File C:\windows\system32\drivers\hldrrr.exe not found!
Deletion of file C:\windows\system32\drivers\hldrrr.exe failed!

Could not process line:
C:\windows\system32\drivers\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\hldrrr.ex_ not found!
Deletion of file C:\WINDOWS\system32\drivers\hldrrr.ex_ failed!

Could not process line:
C:\WINDOWS\system32\drivers\hldrrr.ex_
Status: 0xc0000034



File C:\WINDOWS\system32\mdelk.exe not found!
Deletion of file C:\WINDOWS\system32\mdelk.exe failed!

Could not process line:
C:\WINDOWS\system32\mdelk.exe
Status: 0xc0000034



File C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.exe not found!
Deletion of file C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.exe failed!

Could not process line:
C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.exe
Status: 0xc0000034

File C:\Documents and Settings\Piero\Desktop\NUOVI PROGRAMMI HTC\GENNAIO 2008\VITO QuickContact (Windows Mobile 5.0) 2.zip deleted successfully.
File C:\Documents and Settings\Piero\Desktop\WINDOWS VISTA\[App ITA] Windows VISTA ULTIMATE Rtm FINAL Build 6000.16386 (NOVEMBER 2006) activation crack keygen serial updated-fixed 01-2007.zip deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Folder C:\Documents and Settings\Piero\Dati applicazioni\m deleted successfully.


Folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR not found!
Deletion of folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR failed!

Could not process line:
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\2ZYFQ1AR
Status: 0xc0000034



Folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5 not found!
Deletion of folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5 failed!

Could not process line:
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\IHK369M5
Status: 0xc0000034



Folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49 not found!
Deletion of folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49 failed!

Could not process line:
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\O945YV49
Status: 0xc0000034



Folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z not found!
Deletion of folder C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z failed!

Could not process line:
C:\Documents and Settings\Piero\Impostazioni locali\Temporary Internet Files\Content.IE5\SXKZ8Z0Z
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

Cosa faccio adesso?
Grazie

[ste_95]

Servirebbe una nuova scansione online con kaspersky.

[pieroxx]

Beh, al lavoro allora, devo rassegnarmi ad altri 3 giorni di attesa...

[crazy.cat]

Naturalmente non accetta ancora Kaspersky, mi dice che non è un'applicazione di Win32 valida.

Prova a ripulire la vecchia installazione di kaspersky con questo tools
http://www.MegaLab.it/2816
e poi a reinstallarlo.