cartelle bak

[inesperto]

Ecco il log di sistem scan a questo link:

http://www.freefilehosting.net/download/39kdi

[BilloKenobi]

come prevedibile ci sono un paio di classici file in più, e anche qualche infezione gratuita mi farebbe comodo anche lo scan con questo

http://www.kaspersky.com/virusscanner

[inesperto]

siccome mi va lentissima la scansoione con kaspersky non è che ppossoio usare altri programmi per eliminare quei file?

[BilloKenobi]

lo so che la scansione è lenta, ma è necessaria. farla con il tuo antivirus se vuoi

[inesperto]

io ho AVG dopo la scansione posto il log qui e me lo controli tu?

[BilloKenobi]

sì

[inesperto]

Eccp il log di antiir PE :

AntiVir PersonalEdition Classic
Report file date: venerdì 4 gennaio 2008 15:26

Scanning for 1000067 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: mauro
Computer name: MAURO-E03C960A0

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 07/09/2007 23:06:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 07/09/2007 23:06:27
LUKE.DLL : 7.0.5.3 147496 Bytes 07/09/2007 23:06:38
LUKERES.DLL : 7.0.6.1 10280 Bytes 07/09/2007 23:06:39
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:02:56
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 20:35:54
ANTIVIR2.VDF : 7.0.1.170 311296 Bytes 28/12/2007 21:48:35
ANTIVIR3.VDF : 7.0.1.191 84480 Bytes 03/01/2008 11:04:57
AVEWIN32.DLL : 7.6.0.46 3084800 Bytes 29/12/2007 21:48:37
AVWINLL.DLL : 1.0.0.7 14376 Bytes 21/04/2007 23:16:00
AVPREF.DLL : 7.0.2.2 25640 Bytes 07/09/2007 23:06:27
AVREP.DLL : 7.0.0.1 155688 Bytes 21/04/2007 23:16:16
AVPACK32.DLL : 7.6.0.2 360488 Bytes 29/12/2007 21:48:37
AVREG.DLL : 7.0.1.6 30760 Bytes 07/09/2007 23:06:27
AVARKT.DLL : 1.0.0.20 278568 Bytes 07/09/2007 23:06:19
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 07/09/2007 23:06:24
NETNT.DLL : 7.0.0.0 7720 Bytes 21/04/2007 23:16:09
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/09/2007 23:05:52
RCTEXT.DLL : 7.0.62.0 86056 Bytes 07/09/2007 23:05:53
SQLITE3.DLL : 3.3.17.1 339968 Bytes 07/09/2007 23:06:43

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Dati applicazioni\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: E:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: venerdì 4 gennaio 2008 15:26

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'IEXPLORE.EXE' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SAgent2.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'DKService.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'cfp.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMS.EXE' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'dslagent.exe' - '1' Module(s) have been scanned
Scan process 'dslstat.exe' - '1' Module(s) have been scanned
Scan process 'cmdagent.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
34 processes with 34 modules were scanned

Start scanning boot sectors:
Boot sector 'A:\'
[NOTE] In the drive 'A:\' no data medium is inserted!
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '31' files ).


Starting the file scan:

Begin scan in 'A:\'
Search path A:\ could not be opened!
Periferica non pronta.

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'
Search path D:\ could not be opened!
Periferica non pronta.

Begin scan in 'E:\'
Search path E:\ could not be opened!
Periferica non pronta.



End of the scan: venerdì 4 gennaio 2008 18:08
Used time: 2:43:07 min

The scan has been done completely.

2943 Scanning directories
202918 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
202918 Files not concerned
1006 Archives were scanned
2 Warnings
0 Notes

Avvisatemi se c'è qualcosa che non va ciao

[Andy94]

Il LOG è pulito.

[inesperto]

Sembrava tutto apposto ma stasera sono riapparse le cartelle bak e all'improvviso mi cade la connessione e accede ad un altra connessione tutta sua chiamata INTERNET CONNECTION per favore mi dite cosa devo fare sono al punto di partenza?

Adesso però ho visto nei processi questo processo strano col nome 1302333390 l'ho terminato.
Però il file con questo nome non lo riesco a trovare cm posso fare

[crazy.cat]

Riproviamo con il consiglio dato in precedenza e non fatto.

fai uno scan anche con kasperksy per vedere quali file infetti sono rimasti
http://www.kaspersky.com/virusscanner

Vediamo dove si nasconde il virus e posta il log finale della scansione.

[inesperto]

Crazy ci sto provano tutto il giorno a scannareizxzare con kasper ma o si blocca o mi scannerizza un file ogni 5 minuti... non è che ci so altri metodi?

[ste_95]

Restituisce errori?

[inesperto]

No o si blocca o va lento

[inesperto]

Dopo 4 ore di scansione ecco il report (spero aver fatto tuto bene sennò mi ammazzo ) :

Tuesday, January 08, 2008 12:36:54 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 7/01/2008
Kaspersky Anti-Virus database records: 503726


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases false

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 70435
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0
Duration of the scan process 04:42:57

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Comodo\Firewall Pro\cfplogdb.sdb Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\mauro\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Cronologia\History.IE5\MSHist012008010720080108\index.dat Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Temp\~DF4C55.tmp Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Temp\~DF4EFB.tmp Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Temp\~DF7FBD.tmp Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Temp\~DF801C.tmp Object is locked skipped

C:\Documents and Settings\mauro\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\mauro\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\mauro\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\EPSON\epson680\epson3105eu.exe Object is locked skipped

C:\Programmi\EPSON\epson680\epson4069eu.exe Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{BEA823BB-D412-4D03-B6AE-0FB68BB961BA}\RP64\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

A presto ciao e grazie per la pazienza

[inesperto]

nessuno mi controlla il log per favoreee

[BilloKenobi]

scarica The Avenger --- http://swandog46.geekstogo.com/avenger.zip

Ora estrai e avvia Avenger.exe

disattiva antivirus, firewall, eventuali moduli hips

Clicca su "Input Script Manually". E poi sulla lente di ingrandimento. così si aprira una finestra,"View/edit script"
devi copiarci e incollarci queste scritte in grassetto:

Files to delete:
C:\DOCUME~1\mauro\IMPOST~1\Temp\3162834804.exe
C:\DOCUME~1\mauro\IMPOST~1\Temp\abc123.pid
C:\DOCUME~1\mauro\IMPOST~1\Temp\826157052.exe
C:\WINDOWS\csrs.exe

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run|5T19I3B27A

folders to delete:
C:\Program Files\D-Link\DSL-200\bak
C:\Programmi\File comuni\Logitech\QCDriver\bak
C:\WINDOWS\system32\bak

Dopo di che, clicca sul pulsante Done, poi sul semaforo, e dai due consensi. Il pc si riavvierà da solo, altrimenti fallo a mano

Il programma rilascia un log con le operazioni eseguite.

Allegami il log di Avenger (che si trova in C:\avenger.txt) con l´esito dello script.

[inesperto]

ho fatto cm tu hai detto ecco il log fammi sapere poi:


ogfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tbrnjqhw

*******************

Script file located at: \??\C:\Program Files\nrckoyxm.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\DOCUME~1\mauro\IMPOST~1\Temp\3162834804.exe not found!
Deletion of file C:\DOCUME~1\mauro\IMPOST~1\Temp\3162834804.exe failed!

Could not process line:
C:\DOCUME~1\mauro\IMPOST~1\Temp\3162834804.exe
Status: 0xc0000034

File C:\DOCUME~1\mauro\IMPOST~1\Temp\abc123.pid deleted successfully.


File C:\DOCUME~1\mauro\IMPOST~1\Temp\826157052.exe not found!
Deletion of file C:\DOCUME~1\mauro\IMPOST~1\Temp\826157052.exe failed!

Could not process line:
C:\DOCUME~1\mauro\IMPOST~1\Temp\826157052.exe
Status: 0xc0000034



File C:\WINDOWS\csrs.exe not found!
Deletion of file C:\WINDOWS\csrs.exe failed!

Could not process line:
C:\WINDOWS\csrs.exe
Status: 0xc0000034



Folder C:\Program Files\D-Link\DSL-200\bak not found!
Deletion of folder C:\Program Files\D-Link\DSL-200\bak failed!

Could not process line:
C:\Program Files\D-Link\DSL-200\bak
Status: 0xc0000034



Folder C:\Programmi\File comuni\Logitech\QCDriver\bak not found!
Deletion of folder C:\Programmi\File comuni\Logitech\QCDriver\bak failed!

Could not process line:
C:\Programmi\File comuni\Logitech\QCDriver\bak
Status: 0xc0000034



Folder C:\WINDOWS\system32\bak not found!
Deletion of folder C:\WINDOWS\system32\bak failed!

Could not process line:
C:\WINDOWS\system32\bak
Status: 0xc0000034

Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run|5T19I3B27A deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[BilloKenobi]

ora i problemi del pc si sono risolti?

[inesperto]

Spero anche se l'altra volta per un periodo nn diede problemi però poi doipo 3 4 giorni ricominciò

[inesperto]

Scusate se vi rompo in questi giorni ma puntualmente comodo mi avvisa che ha rilevato delle cartelle bak io ho messo block te request ma facendo una ricerca le cartelle bak sono tornate dentro alcuni programmi. Premesso che nn scarico nulla e vado sempre su siti normali qualcuno mi può dire cm posso fare per risolvere una volta per tutte sto problema? Aiutatemi per favore il primo passo che devo fare è sempre sostituirle?