MegaLab.it

Ecco il report di kaspersky on-line, se, come al solito ormai, potete fornirmi lo script per la rimozione.
Infinitamente grazie.


KASPERSKY ONLINE SCANNER REPORT
Saturday, February 02, 2008 10:05:39 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/02/2008
Kaspersky Anti-Virus database records: 545991


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 55002
Number of viruses found 3
Number of infected objects 12
Number of suspicious objects 0
Duration of the scan process 02:19:23

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Support\MPLog-01262008-161451.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\HPPAppActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\HPPHomePageActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\LiveUpdate\2008-02-02_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\frastepat\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\frastepat\Dati applicazioni\Microsoft\Internet Explorer\UserData\index.dat Object is locked skipped

C:\Documents and Settings\frastepat\Dati applicazioni\Symantec\PendingAlertsQueue.log Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Dati applicazioni\ApplicationHistory\cli.exe.af01e8cc.ini.inuse Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\1012688563.exe Infected: Trojan.Win32.Dialer.abi skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\1273482500.exe Infected: Trojan.Win32.Dialer.abi skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\2050280734.exe Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\497116699.exe Infected: Trojan.Win32.Dialer.abi skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\599650015.exe Infected: Trojan.Win32.Dialer.abi skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\Perflib_Perfdata_5d4.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\Perflib_Perfdata_638.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temp\Perflib_Perfdata_788.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temporary Internet Files\Content.IE5\DSKLVS6Z\mynetfinder[1].htm Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temporary Internet Files\Content.IE5\TGGVKRLK\mynetfinder[1].htm Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temporary Internet Files\Content.IE5\TGGVKRLK\searchCA6XCX2M.htm Object is locked skipped

C:\Documents and Settings\frastepat\Impostazioni locali\Temporary Internet Files\Content.IE5\TGGVKRLK\searchCAF15A2J.htm Object is locked skipped

C:\Documents and Settings\frastepat\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\frastepat\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDCON.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDFW.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\Programmi\iTunes\iTunesHelper.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\Programmi\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Programmi\Norton AntiVirus\AVError.log Object is locked skipped

C:\Programmi\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Programmi\Norton AntiVirus\Savrt\0315NAV~.TMP Object is locked skipped

C:\Programmi\Norton AntiVirus\Savrt\0770NAV~.TMP Object is locked skipped

C:\Programmi\QuickTime\QTTask.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\Programmi\Windows Defender\MSASCui.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{771697BE-A273-43FC-88AF-B4AB7C72C69E}\RP28\A0005803.exe Infected: Trojan-Downloader.Win32.Agent.iar skipped

C:\System Volume Information\_restore{771697BE-A273-43FC-88AF-B4AB7C72C69E}\RP44\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{29EEDC0C-507D-45C0-9583-50C66E24B282}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\NeroCheck.exe Infected: Trojan.Win32.KillAV.oe skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_6e8.dat Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Mi potresti insegnare a beccare tutti sti malware?

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\QuickTime\QTTask.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\NeroCheck.exe

Folders to delete:
C:\Documents and Settings\frastepat\Impostazioni locali\Temp

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Alla fine della rimozione, potresti cortesemente comprimere la cartella C:\Avenger e inoltrarla a http://softnews.altervista.org/upload_malware.php

ste_95 ha scritto:Mi potresti insegnare a beccare tutti sti malware?

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\QuickTime\QTTask.exe
C:\Programmi\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\NeroCheck.exe

Folders to delete:
C:\Documents and Settings\frastepat\Impostazioni locali\Temp

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Alla fine della rimozione, potresti cortesemente comprimere la cartella C:\Avenger e inoltrarla a http://softnews.altervista.org/upload_malware.php

Se lo sapessi come faccio a beccarli, te lo direi e forse riuscirei anche a non prenderli.....
Ti incollo il report e provvedo ad inviare la cartella, a proposito, non ho il programma per comprimere, la settimana scorso ho formattato e devo ancora reinstallarne uno, fa lo stesso o cosa mi consigli?


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ixclonkh

*******************

Script file located at: \??\C:\rpelt^le.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Programmi\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe deleted successfully.
File C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe deleted successfully.
File C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe deleted successfully.
File C:\Programmi\iTunes\iTunesHelper.exe deleted successfully.
File C:\Programmi\QuickTime\QTTask.exe deleted successfully.
File C:\Programmi\Windows Defender\MSASCui.exe deleted successfully.
File C:\WINDOWS\system32\NeroCheck.exe deleted successfully.
Folder C:\Documents and Settings\frastepat\Impostazioni locali\Temp deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Inviare file per file credo che sarebbe una cosa complicata, se credi di installarne uno a breve, aspetta di installarlo.

ste_95 ha scritto:Inviare file per file credo che sarebbe una cosa complicata, se credi di installarne uno a breve, aspetta di installarlo.

Buongiorno ste, ho compresso ed inviato la cartella.

Ora, la situazione del mio pc non mi sembra il massimo; task manager non si avvia; il pc mi si impianta spesso e volentieri e devo riavviarlo ogni volta; ripristino configurazione di sistema non riesce a completarsi.

Potrebbe trattarsi di un problema hardware?

Ad eccezione del ripristino che non andava neanche prima, tutti gli altri problemi mi si sono presentati dopo la formattazione. Fui costretto a formattare perché volendo avviare in modalità provvisoria non mi era possibile tramite f8, quindi, operai tramite msconfig, ma ottenni il risultato che il pc dopo aver eseguito i comando modalità provvisoria, si riavviava per ritornare alla stessa schermata, insomma si era bloccato tutto.
Cosa mi consigli?

Per il task manager non funzionante puoi usare questo programma.

PS. Hai un pm

ste_95 ha scritto:Per il task manager non funzionante puoi usare questo programma.

PS. Hai un pm

Scusa l'ignoranza, cosa sarebbe il pm?
Grazie per il programma, lo provo subito

PM = Private Message = Messaggio Privato.

Fine OT

ste_95 ha scritto:PM = Private Message = Messaggio Privato.

Fine OT

Pensa te !! Si ce l'ho, mi era spaventato, pensavo ad un pubblico ministero....

Task manager