Trojan-Downloader.Win32.Bagle.fi

[giukie]

Dopo avere ripetutamente provato ad installare un antivirus, ma senza successo in quanto il processo si interrompeva continuamente e questo accadeva con antivirus diversi, ho fatto una scansione online con il kaspersky. Nell'oggetto del mio post il nome del bagle che è stato trovato. Sono sicura di averlo preso da un file di emule.
PLEASE HELP

Non so usare gmer e temo di combinare casini, questo è il report di kaspersky.


unday, November 11, 2007 11:23:34 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/11/2007
Kaspersky Anti-Virus database records: 456450
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 79768
Number of viruses found 1
Number of infected objects 2
Number of suspicious objects 0
Duration of the scan process 01:17:17

Infected Object Name Virus Name Last Action

C:\Programmi\Yahoo!\Messenger\ypager.exe -quiet Infected: Trojan-Downloader.Win32.Bagle.fi skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{2621D9D6-C9A5-498E-94B2-BE1085C08858}\RP455\A0069447.exe Infected: Trojan-Downloader.Win32.Bagle.fi skipped

Scan process completed.

[ste_95]

dsiattiva il ripristino di sistema e con avenger esegui questo script:

Files to delete:
%SystemDrive%/WINDOWS/system32/drivers/hidr.exe
%SystemDrive%/WINDOWS/system32/drivers/srosa.sys
%SystemDrive%/WINDOWS/system32/wintems.exe
%SystemDrive%/WINDOWS/system32/hldrrr.exe
%SystemDrive%/WINDOWS/system32/trusted.exe
%SystemDrive%/WINDOWS/system32/drivers/pci32.sys
%UserProfile%/Dati applicazioni/hidires/hidr.exe
%UserProfile%/Dati applicazioni/hidires/rosa.sys
C:\Programmi\Yahoo!\Messenger\ypager.exe

Folders to delete:
%SystemDrive%/WINDOWS/exefnd
%SystemDrive%/WINDOWS/exefld

Registry keys to delete:
HKLM/SYSTEM/CurrentControlSet/Services/srosa
HKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_SROSA
HKLM/SYSTEM/CurrentControlSet/Services/pci32
HKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_PCI32

[giukie]

Ciao, grazie per la tua risposta.
Ho eseguito lo script di avenger. Di seguito il report, il problema non si
è ancora risolto. L'antivirus non si installa.


//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKLM/SYSTEM/CurrentControlSet/Services/srosa


Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_SROSA


Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKLM/SYSTEM/CurrentControlSet/Services/pci32


Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_PCI32

[ste_95]

scarica elibagla e fai la scansione con lui

[crazy.cat]

Files to delete:
%SystemDrive%/WINDOWS/system32/drivers/hidr.exe
%SystemDrive%/WINDOWS/system32/drivers/srosa.sys
%SystemDrive%/WINDOWS/system32/wintems.exe
%SystemDrive%/WINDOWS/system32/hldrrr.exe
%SystemDrive%/WINDOWS/system32/trusted.exe
%SystemDrive%/WINDOWS/system32/drivers/pci32.sys
%UserProfile%/Dati applicazioni/hidires/hidr.exe
%UserProfile%/Dati applicazioni/hidires/rosa.sys
C:\Programmi\Yahoo!\Messenger\ypager.exe

Folders to delete:
%SystemDrive%/WINDOWS/exefnd
%SystemDrive%/WINDOWS/exefld

Registry keys to delete:
HKLM/SYSTEM/CurrentControlSet/Services/srosa
HKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_SROSA
HKLM/SYSTEM/CurrentControlSet/Services/pci32
HKLM/SYSTEM/CurrentControlSet/Enum/Root/LEGACY_PCI32

perché avevi girato tutte le barre?
Questo è lo script giusto.

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\Programmi\Yahoo!\Messenger\ypager.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

[giukie]

Grazie! ce l'ho fatta. L'installer di Antivir è partito!