Script Avenger per rimuovere Bagle

[crazy.cat]

C'ho provaturtroppo questo antivirus non funziona con windows vista. Sono disperato perché purtroppo il computer mi serve e non posso permettermi di formattarlo...Cosa posso fare?

Anche per te vale questa richiesta
http://www.MegaLab.it/forum/viewtopic.p ... 869#319869
se riesci a farci avere il file che hai scaricato e dato il via all'infezione.
Se abbiamo modo di riprodurre l'infezione su un pc con vista, possiamo anche trovare il modo di toglierlo.
Mandami il link dove carichi il file con un messaggio privato.
Grazie

[Matteo6252]

purtroppo...maledetto me...l'ho immediatamente cancellato perché mi sono fatto prendere dal panico..posso ricercarlo però...nel frattempo non c'è niente da fare?

[Matteo6252]

Ok..l'ho ritrovato quel maledetto file..Come faccio a passartelo?

[crazy.cat]

Ma perché non parte la scansione online?
Dovrebbe andare anche con vista, devi usare internet explorer
http://www.kaspersky.it/Servizi/virusscanner.asp

Anche usando lo script generico, non possiamo sapere dove si nasconde il resto del virus e quindi dirti quali file eliminare.

[crazy.cat]

Ok..l'ho ritrovato quel maledetto file..Come faccio a passartelo?

Devi andare sul sito www.mediafire.com

Quindi scegliere il pulsante Sfoglia e selezionare il file infetto prima e premere upload file to mediafire.

Copia il link che ti dirà il sito e mandamelo con un messaggio privato.

Grazie

[Matteo6252]

è partita la scansione di kaspersky...vi faccio sapere appena ha finito...ho provato ad uploadare il file su mediafire ma da errore perché dice che è un file infetto...Come posso passartelo?

[crazy.cat]

è partita la scansione di kaspersky...vi faccio sapere appena ha finito...ho provato ad uploadare il file su mediafire ma da errore perché dice che è un file infetto...Come posso passartelo?

Usa uno di questi siti, comprimi il file prima di caricarlo.
http://w12.easy-share.com/
http://www.mytempdir.com/

[Matteo6252]

Fatto..te l'ho inviato zippato proprio come l'ho scaricato da emule. Spero saprai aiutarmi..Grazie. Matteo

[crazy.cat]

Ricevuto il file.
Aspetto il log della scansione di kaspersky

[Matteo6252]

Qundo ho finito la scansione con kaspersky che sono finalmente riuscito a far partire dopo aver eseguito l'explorer come amminitratore cosa devo fare?

[crazy.cat]

selezioni tutto il testo del file html e fai copia e poi incolla qui nella discussione

[Matteo6252]

Scusami se faccio tante domande ma sono un po' preoccupato. Ma alla fine si riesce a venirne fuori senza danni?

[ste_95]

Scusami se faccio tante domande ma sono un po' preoccupato. Ma alla fine si riesce a venirne fuori senza danni?

Sì

[Matteo6252]

Ho appena terminato la scansione con kaspersky. Questo è il rapporto. Spero che qualcuno sappia indicarmi la soluzione.
Vi ringrazio in anticipo. MatteoOperating System: Microsoft Windows Vista Home Edition, (Build 6000)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 11/01/2008
Kaspersky Anti-Virus database records: 507602


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 129705
Number of viruses found 3
Number of infected objects 5
Number of suspicious objects 0
Duration of the scan process 01:39:27

Infected Object Name Virus Name Last Action
C:\boot\bcd Object is locked skipped

C:\boot\BCD.LOG Object is locked skipped

C:\Program Files\Alcohol 120\StarWind\logs\sw_ae-20080111-133211.log Object is locked skipped

C:\Program Files\FreePOPs\log.txt Object is locked skipped

C:\Program Files\FreePOPs\stderr.txt Object is locked skipped

C:\Program Files\FreePOPs\stdout.txt Object is locked skipped

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe Infected: Trojan-Downloader.Win32.Bagle.ht skipped

C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.ilg Object is locked skipped

C:\Program Files\Nero\Nero-8.1.1.0b_ita_trial.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped

C:\Program Files\Nero\Nero-8.1.1.0b_ita_trial.exe 7-Zip: infected - 1 skipped

C:\Program Files\Nero\Nero8\Nero BackItUp\BIU315C.txt Object is locked skipped

C:\ProgramData\CyberLink\TinyDB\EPGSignal Object is locked skipped

C:\ProgramData\CyberLink\TinyDB\Schedule Object is locked skipped

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\91f1052d3a236826d71948c9c8e72096_00629bbe-b47a-4120-a33a-031f378077bf Object is locked skipped

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_00629bbe-b47a-4120-a33a-031f378077bf Object is locked skipped

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_00629bbe-b47a-4120-a33a-031f378077bf Object is locked skipped

C:\ProgramData\Microsoft\User Account Pictures\Prova.dat Object is locked skipped

C:\ProgramData\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped

C:\System.sav\util\App.Evt Object is locked skipped

C:\System.sav\util\Sec.Evt Object is locked skipped

C:\System.sav\util\Sys.Evt Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\UsrClass.dat{5d4c76b6-8d91-11dc-8b07-001a6bb2a68c}.TM.blf Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\UsrClass.dat{5d4c76b6-8d91-11dc-8b07-001a6bb2a68c}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Users\Matteo\AppData\Local\Microsoft\Windows\UsrClass.dat{5d4c76b6-8d91-11dc-8b07-001a6bb2a68c}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Windows\Logs\DPX\setupact.log Object is locked skipped

C:\Windows\Logs\DPX\setuperr.log Object is locked skipped

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped

C:\Windows\panther\diagerr.xml Object is locked skipped

C:\Windows\panther\diagwrn.xml Object is locked skipped

C:\Windows\panther\setupact.log Object is locked skipped

C:\Windows\panther\setuperr.log Object is locked skipped

C:\Windows\panther\UnattendGC\diagerr.xml Object is locked skipped

C:\Windows\panther\UnattendGC\diagwrn.xml Object is locked skipped

C:\Windows\panther\UnattendGC\setupact.log Object is locked skipped

C:\Windows\panther\UnattendGC\setuperr.log Object is locked skipped

C:\Windows\security\database\secedit.sdb Object is locked skipped

C:\Windows\SFF3BD489.tmp Object is locked skipped

C:\Windows\SoftwareDistribution\EventCache\{D640DA7B-8237-4047-8C07-2D7E506FC954}.bin Object is locked skipped

C:\Windows\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

C:\Windows\System32\catroot2\edb.log Object is locked skipped

C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped

C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped

C:\Windows\System32\drivers\down\8032569.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\Windows\System32\drivers\hldrrr.ex_ Infected: Trojan-Downloader.Win32.Bagle.ht skipped

C:\Windows\System32\drivers\sptd.sys Object is locked skipped

C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped

C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\Windows\System32\restore\MachineGuid.txt Object is locked skipped

C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped

C:\Windows\System32\sysprep\Panther\diagerr.xml Object is locked skipped

C:\Windows\System32\sysprep\Panther\diagwrn.xml Object is locked skipped

C:\Windows\System32\sysprep\Panther\setupact.log Object is locked skipped

C:\Windows\System32\sysprep\Panther\setuperr.log Object is locked skipped

C:\Windows\System32\wbem\AutoRecover\3460B7617E0429A960E481B197F238A3.mof Object is locked skipped

C:\Windows\System32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof Object is locked skipped

C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped

C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked skipped

C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked skipped

C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked skipped

C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked skipped

C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DateTimeControlPanel%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-MSDT%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PLA%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnostic%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Forwarding%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WDI%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MeetingSpace%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MemoryDiagnostics-Results%4Debug.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ParentalControls%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Admin.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RemoteAssistance%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winsock-WS2HELP%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wired-AutoConfig%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Setup.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\VeriSoft.evtx Object is locked skipped

C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped

C:\Windows\WindowsUpdate.log Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped

Scan process completed.

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32


Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[Matteo6252]

Purtroppo avenger non funziona perché ho windows vista....Cosa faccio?

[Matteo6252]

Non c'è nessun sistema alternativo per i poveri disgraziati che hanno Vista come me?....

[ste_95]

Prova a eliminare tutti i file e le cartelle con unlocker.

[Matteo6252]

Il problema è che se seguo quei percorsi non riesco a trovare i file che tu mi hai indicato..Porbabilmente il virus li nasconde....Hai qualche soluzione?

[ste_95]

Alcuni file potrebbero anche non esserci...