virus inattaccabile

[nennyge]

penso che il problema sia più grave di quanto pensassi....
ho lanciato la scansione che kasper, ma si è bloccato dopo alcuni minuti perché ha trovato un antivirus... l'unico che è installato è kaspeksy, ma non funziona perche non è presente in system 32.
l'ho disinstallato, spento il computer e quando si è acceso non si connetteva nuovamente, con il solito problema.
ho ripercorso i vs consigli e ora si connette ma si bloca spesso. faccio ripartire kasper....
e vediamo un po.....

[nennyge]

dopo mezz'ora che kasper scannerizzava, ha leggato in verde le due liste è comparsa la scritta next e mi si p presentata questa maschera:
Initialize Kaspersky Online Scanner
(downloading and installing Kaspersky Online Scanner ActiveX from the server into your computer)


.... forse ora devo fare tutte queste scansioni???..... che schiappa che sono

Critical Areas
scan critical areas of your hard disks
specified in %windir% and %tmp% system variables
Memory
scan disk modules of running processes
My Computer
scan all your hard and mapped disks
My Email
scan all your hard and mapped disks only for the following extensions: *.PST; *.MSG; *.OST; *.MDB; *.DBX; *.EML; *.MBS
Folders...
scan selected folders
A File...
scan a one file


Warning: The Kaspersky Online Scanner may not run successfully while any other Anti-Virus software is running. If you have Anti-Virus

Update Kaspersky Anti-Virus Databases [100%]:
(downloading and installing the latest Kaspersky Anti-Virus Databases)


Next
Please select a target to scan:
You can configure the scanning process by pressing "Scan Settings" button.

Critical Areas
scan critical areas of your hard disks
specified in %windir%

[ste_95]

La scansione va effettuata Estesa, cioè My Computer.

[nennyge]

scusa....... ovvio!!!

devo collegare l'hard disk esterno?.....
posso lavorare su file in condivisione in rete????... potrei contagiare la rete?

[ste_95]

Ti consiglierei di rimanere fuori dalla rete finché sei infetto. Collega pure l'hard disk.

[nennyge]

come faccio a rimanere connessa ad internet, ma non alla rete condivisa dagli altri utenti......

Ignorante!!!!!!!!.... io s'intende!!!!! .... dando il corretto significato etimologico al termine...

[ste_95]

Io intendevo di non scambiare file, entrare nel computer...

[nennyge]

[nennyge]

Non è per impazienza, ma perché mi sembra strano
La scansione è al 20% dopo 50 minuti..... è normale?

[ste_95]

Se hai pochi e piccoli file nel computer non preoccuparti, non preoccuparti in ogni caso

[crazy.cat]

Non è per impazienza, ma perché mi sembra strano
La scansione è al 20% dopo 50 minuti..... è normale?

C'è gente che con vista ha impiegato 10 ore e passa per fare la scansione.
Con xp un paio d'ore vanno via come niente se hai parecchi file.

[nennyge]

uno dei motivi per cui non penso di installarlo... per ora. Voi cosa ne pensate?.... di vista
inganno il tempo con una "baccinella" di pop corn....

[nennyge]

finalmente kasper ha partorito

KASPERSKY ONLINE SCANNER REPORT
Thursday, January 17, 2008 6:36:29 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 17/01/2008
Kaspersky Anti-Virus database records: 514019


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 62787
Number of viruses found 3
Number of infected objects 8
Number of suspicious objects 0
Duration of the scan process 03:56:57

Infected Object Name Virus Name Last Action
C:\I386\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\dllcache\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\system32\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB885835_0$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Genny\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Genny\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Cronologia\History.IE5\MSHist012008011720080118\index.dat Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.MSO\msoA.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{773574AB-E068-4E3C-9EA4-AFABBFD4EB13}.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{8C47A104-5E9D-4C1A-B9C1-C1E6B83A3770}.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{8D40EA8A-2A3D-4942-9452-88C65D0CEB9D}.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{450DDDA6-ED2C-456C-ADD6-D8FB051AC4AD}.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{6D19943E-3395-466A-8C8B-3842227EFA65}.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{4C39983C-60E5-4CFA-9787-88258808A17D}.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\~Outlook.pst.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\~archive.pst.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\~Outlookmail.t-online-00000003.pst.tmp Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\Archive.pst Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\Outlook.pst Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Outlook\Outlookmail.t-online-00000003.pst Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Mail\WindowsLiveMail.log Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Mail\Mail.MSMessageStore Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Mail\tmp.edb Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Mail\edb.log Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Mail\edbtmp.log Object is locked skipped

C:\Documents and Settings\Genny\Impostazioni locali\Temp\~DF766.tmp Object is locked skipped

C:\Documents and Settings\Genny\Desktop\Merleg leltár nk 2007 uj.xls Object is locked skipped

C:\Documents and Settings\Genny\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Microsoft\Outlook\Outlook.srs Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Microsoft\Outlook\Outlook.NK2 Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Microsoft\Templates\NormalEmail.dotm Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\index2.dat Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\contactgroup256.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\dyncontent\bundle.dat Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\user256.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\user1024.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\profile4096.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\user4096.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\user16384.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\chatmember256.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\chatmsg256.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\chat512.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\call256.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\callmember256.dbb Object is locked skipped

C:\Documents and Settings\Genny\Dati applicazioni\Skype\nennyge\chatmsg512.dbb Object is locked skipped

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.ig skipped

C:\avenger\backup.zip/avenger/hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.ig skipped

C:\avenger\backup.zip ZIP: infected - 1 skipped

C:\avenger\backup-17.01.2008- 8.13.15,39.zip/avenger/wintems.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-17.01.2008- 8.13.15,39.zip/avenger/hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.ig skipped

C:\avenger\backup-17.01.2008- 8.13.15,39.zip/avenger/down/31772977.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-17.01.2008- 8.13.15,39.zip/avenger/down/31779826.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup-17.01.2008- 8.13.15,39.zip ZIP: infected - 4 skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.


Attendo vostra sentenza....

[ste_95]

Questo è lo script per avenger:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\WINDOWS\system32\mdelk.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\avenger\backup.zip
C:\avenger\backup-17.01.2008- 8.13.15,39.zip

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

[nennyge]

Questo è il responso.....

ho dovuto rilanciare il registro su system 32 dopo il riavvio di avanger perché non si connetteva ad internet... solito problema..

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vcjsckwh

*******************

Script file located at: \??\C:\Documents and Settings\biypxdwp.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.


File C:\WINDOWS\system32\drivers\hldrrr.ex_ not found!
Deletion of file C:\WINDOWS\system32\drivers\hldrrr.ex_ failed!

Could not process line:
C:\WINDOWS\system32\drivers\hldrrr.ex_
Status: 0xc0000034

File C:\WINDOWS\system32\mdelk.exe deleted successfully.
File C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe deleted successfully.
File C:\avenger\backup.zip deleted successfully.
File C:\avenger\backup-17.01.2008- 8.13.15,39.zip deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[nennyge]

... ma si autorigenerano?.....

no capisco perché non si eliminano.

Vi ringrazio per l'enorme disponibilità. Ora devo andare, ma sarò nuovamente qua tra 2 ore circa o domani.

Sono un po demoralizzata...

[nennyge]

... non per la vostra bravura... è inteso!, se non ci foste stati voi-..... ma perché mi caccio semore nei guai... informatici...e spesso non riesco a risolverli da sola.

[ste_95]

Dovrebbe essere tutto a posto, installa un antivirus.

[nennyge]

ehhh che bello che bello!!!. sono riuscita a installare l'antivirus.... ho optato per avg la versione trial del 7.5. Voi cosa consigliate??? se è lecita questa domanda.

Quanto sono stata brava!!!!!!..... scherzo!!!. Grazie ragazzi, ... veramente!!!

[ste_95]

Ti consiglio questo:

http://www.MegaLab.it/1740

Quando scade passi alla versione free.