Ewido Bloccato e Avast Disattivato.. aiuto!

[wolly76]

scusami ma da dove lo scarico avenger??? non riesco a trovarlo

[Amantide]

scusami ma da dove lo scarico avenger??? non riesco a trovarlo

Segui le istruzioni sulla prima pagina che avevo dato a monykina

[wolly76]

scusa ma penso di aver sbagliato qualcosa
ho aperto avenger cliccato sulla lente di ingrandimento e copiato con copia e incolla quello che mi hai detto poi dopo vari errori si è riavviato il pc e quando si è riavviato è uscita unha finestra di prompt e un messaggio di errore

[Amantide]

scusa ma penso di aver sbagliato qualcosa
ho aperto avenger cliccato sulla lente di ingrandimento e copiato con copia e incolla quello che mi hai detto poi dopo vari errori si è riavviato il pc e quando si è riavviato è uscita unha finestra di prompt e un messaggio di errore

La finestra prompt contiene illog di Avenger, se non l'hai ancora chiusa copia il contenuto e copialo qui, altrimenti postami il contenuto del log che trovi in F:/avenger
L'errore è sicuramente dovuto all'impossibilità di processare le chiavi del registro in HK_Current_User, prima o poi riuscirò a capire perché non lo vuole fare.

[wolly76]

aiutooo all'avvio di windows ora mi esce il messaggio windows disco non presente
impossibile trovare il disco nell'unità. inserire un disco nell'unità A
per quel che riguarda il log ce ne sono due nella cartella avenger il primo dice / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /

A v e n g e r P r e - P r o c e s s o r l o g

/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /



E r r o r : c o u l d n o t c r e a t e z i p f i l e .

E r r o r c o d e : 1 8 1 3
il secondo

/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /

A v e n g e r P r e - P r o c e s s o r l o g

/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /



S y n t a x e r r o r i n l i n e - - - d o e s n o t a p p e a r t o b e a v a l i d r e g i s t r y p a t h . L i n e w i l l b e i g n o r e d .

E r r o r c o d e : 1 8 1 3

L i n e : H K C U \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n | d r v s y s k i t





S y n t a x e r r o r i n l i n e - - - d o e s n o t a p p e a r t o b e a v a l i d r e g i s t r y p a t h . L i n e w i l l b e i g n o r e d .

E r r o r c o d e : 1 8 1 3

L i n e : H K C U \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n | h l d r r r





S y n t a x e r r o r i n l i n e - - - d o e s n o t a p p e a r t o b e a v a l i d r e g i s t r y p a t h . L i n e w i l l b e i g n o r e d .

E r r o r c o d e : 1 8 1 3

L i n e : H K E Y _ C U R R E N T _ U S E R \ S o f t w a r e \ F i r s t R R R u n





/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /





L o g f i l e o f T h e A v e n g e r v e r s i o n 1 , b y S w a n d o g 4 6

R u n n i n g f r o m r e g i s t r y k e y :

\ R e g i s t r y \ M a c h i n e \ S y s t e m \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ i k h p h j o m



* * * * * * * * * * * * * * * * * * *



S c r i p t f i l e l o c a t e d a t : \ ? ? \ F : \ q m q q a j p u . t x t

S c r i p t f i l e o p e n e d s u c c e s s f u l l y .



S c r i p t f i l e r e a d s u c c e s s f u l l y



B a c k u p s d i r e c t o r y o p e n e d s u c c e s s f u l l y a t F : \ A v e n g e r



* * * * * * * * * * * * * * * * * * *



B e g i n n i n g t o p r o c e s s s c r i p t f i l e :







F i l e F : \ W I N D O W S \ s y s t e m 3 2 \ h l d r r r . e x e n o t f o u n d !

D e l e t i o n o f f i l e F : \ W I N D O W S \ s y s t e m 3 2 \ h l d r r r . e x e f a i l e d !



C o u l d n o t p r o c e s s l i n e :

F : \ W I N D O W S \ s y s t e m 3 2 \ h l d r r r . e x e

S t a t u s : 0 x c 0 0 0 0 0 3 4



F i l e F : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D a t i a p p l i c a z i o n i \ h i d i r e s \ h i d r . e x e d e l e t e d s u c c e s s f u l l y .

F i l e F : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D a t i a p p l i c a z i o n i \ h i d i r e s \ m _ h o o k . s y s d e l e t e d s u c c e s s f u l l y .





F i l e F : \ W i n d o w s \ S y s t e m 3 2 \ w i n t e m s . e x e n o t f o u n d !

D e l e t i o n o f f i l e F : \ W i n d o w s \ S y s t e m 3 2 \ w i n t e m s . e x e f a i l e d !



C o u l d n o t p r o c e s s l i n e :

F : \ W i n d o w s \ S y s t e m 3 2 \ w i n t e m s . e x e

S t a t u s : 0 x c 0 0 0 0 0 3 4



F o l d e r F : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D a t i a p p l i c a z i o n i \ h i d i r e s d e l e t e d s u c c e s s f u l l y .

R e g i s t r y k e y H K E Y _ L O C A L _ M A C H I N E \ S y s t e m \ C u r r e n t C o n t r o l S e t \ S e r v i c e s \ m _ h o o k d e l e t e d s u c c e s s f u l l y .

R e g i s t r y v a l u e H K L M \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n | h l d r r r d e l e t e d s u c c e s s f u l l y .

R e g i s t r y v a l u e H K L M \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n | N W E R e b o o t d e l e t e d s u c c e s s f u l l y .



C o m p l e t e d s c r i p t p r o c e s s i n g .



* * * * * * * * * * * * * * * * * * *



F i n i s h e d ! T e r m i n a t e .



PS il messaggio di inserire il disco non va + via che devo fare?

[Amantide]

Ti posso assicurare che Avenger non ha eliminato nessun file vitale, erano tutti i file ed i valori del registro inerenti al virus.
Come hai fatto a copiare il log di avenger se ti appare quel errore? Oppure poi il computer si è avviato? Prova a togliere eventuali floppy e cd dal lettori.
L'unica cosa che avenger non è riuscito ad eliminare è il file F:\WINDOWS\system32\hldrrr.exe
Se ti si avvia il pc prova ad eliminarlo dalla modalità provvisoria (F8 all'avvio).

[wolly76]

non so come ma dopo aver provato a fare quello che mi hai detto il pc andava bene sono riuscito a rinstallare l'antivirus anche se ora mi dice che c'è un tizio che mi attacca se riposto i file gmer e l'altro puoi vedere se ci sono ancora problemi per favore grazie
questo è gmer autosart


GMER 1.0.12.12011 - http://www.gmer.net
Autostart scan 2007-01-04 21:33:13
Windows 5.1.2600 Service Pack 2


HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = F:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>
NavLogon@DLLName = F:\WINDOWS\system32\NavLogon.dll
WgaLogon@DLLName = WgaLogon.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aswUpdSv /*avast! iAVS4 Control Service*/@ = "F:\Programmi\Alwil Software\Avast4\aswUpdSv.exe"
avast! Antivirus /*avast! Antivirus*/@ = "F:\Programmi\Alwil Software\Avast4\ashServ.exe"
CLTNetCnService /*Symantec Lic NetConnect service*/@ = "F:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe" /h ccCommon /*file not found*/
NVSvc /*NVIDIA Display Driver Service*/@ = %SystemRoot%\system32\nvsvc32.exe
SoundMAX Agent Service (default) /*SoundMAX Agent Service*/@ = F:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe
StarWindService /*StarWind iSCSI Service*/@ = F:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
Utilità di pianificazione di LiveUpdate automatico /*Utilità di pianificazione di LiveUpdate automatico*/@ = "F:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@CmaudioRunDll32 cmicnfg.cpl,CMICtrlWnd = RunDll32 cmicnfg.cpl,CMICtrlWnd
@SmappF:\Programmi\Analog Devices\SoundMAX\SMTray.exe = F:\Programmi\Analog Devices\SoundMAX\SMTray.exe
@GSICONEXEGSICON.EXE = GSICON.EXE
@DSLAGENTEXEdslagent.exe USB = dslagent.exe USB
@NeroFilterCheckF:\WINDOWS\system32\NeroCheck.exe = F:\WINDOWS\system32\NeroCheck.exe
@PinnacleDriverCheckF:\WINDOWS\system32\PSDrvCheck.exe -CheckReg = F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
@PMCRemoteF:\Programmi\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe = F:\Programmi\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
@NvCplDaemonRUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup = RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
@nwiznwiz.exe /install = nwiz.exe /install
@NvMediaCenterRunDLL32.exe NvMCTray.dll,NvTaskbarInit = RunDLL32.exe NvMCTray.dll,NvTaskbarInit
@avast!F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe = F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>
@H/PC Connection Agent"F:\Programmi\Microsoft ActiveSync\wcescomm.exe" = "F:\Programmi\Microsoft ActiveSync\wcescomm.exe"
@BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"F:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe" = "F:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
@BitTorrent"F:\Programmi\BitTorrent\bittorrent.exe" --force_start_minimized /*file not found*/ = "F:\Programmi\BitTorrent\bittorrent.exe" --force_start_minimized /*file not found*/
@spywatchF:\Programmi\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP = F:\Programmi\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP
@drvsyskitF:\Documents and Settings\Administrator\Dati applicazioni\hidires\hidr.exe /*file not found*/ = F:\Documents and Settings\Administrator\Dati applicazioni\hidires\hidr.exe /*file not found*/
@hldrrrF:\WINDOWS\system32\hldrrr.exe /*file not found*/ = F:\WINDOWS\system32\hldrrr.exe /*file not found*/
@updateMgr"F:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1 = "F:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Pagina proprietà versioni precedenti*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Versioni precedenti*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll
@{87D62D94-71B3-4b9a-9489-5FE6850DC73E} /*Avi Properties Handler*/(null) =
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/%SystemRoot%\system32\extmgr.dll = %SystemRoot%\system32\extmgr.dll
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Cartelle Web*/F:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = F:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/F:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = F:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/F:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = F:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/F:\Programmi\Microsoft Office\OFFICE11\msohev.dll = F:\Programmi\Microsoft Office\OFFICE11\msohev.dll
@{BDA77241-42F6-11d0-85E2-00AA001FE28C} /*LDVP Shell Extensions*/(null) =
@{5464D816-CF16-4784-B9F3-75C0DB52B499} /*Yahoo! Mail*/F:\PROGRA~1\Yahoo!\Common\ymmapi.dll = F:\PROGRA~1\Yahoo!\Common\ymmapi.dll
@{49BF5420-FA7F-11cf-8011-00A0C90A8F78} /*Mobile Device*/F:\PROGRA~1\MICROS~3\Wcesview.dll = F:\PROGRA~1\MICROS~3\Wcesview.dll
@{32020A01-506E-484D-A2A8-BE3CF17601C3} /*AlcoholShellEx*/F:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll = F:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll
@{00e72351-c3bd-48cd-b090-77ea0d87a10a} /*Uw Shell Extension*/F:\PROGRA~1\REDSTR~1\ULTRAW~1\uwshext.dll = F:\PROGRA~1\REDSTR~1\ULTRAW~1\uwshext.dll
@{B327765E-D724-4347-8B16-78AE18552FC3} /*NeroDigitalIconHandler*/F:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll = F:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll
@{7F1CF152-04F8-453A-B34C-E609530A9DC8} /*NeroDigitalPropSheetHandler*/F:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll = F:\Programmi\File comuni\Ahead\lib\NeroDigitalExt.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/F:\Programmi\WinRAR\rarext.dll = F:\Programmi\WinRAR\rarext.dll
@{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} /*Messenger Sharing Folders*/F:\Programmi\MSN Messenger\fsshext.8.0.0812.00.dll = F:\Programmi\MSN Messenger\fsshext.8.0.0812.00.dll
@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/F:\WINDOWS\system32\nvcpl.dll = F:\WINDOWS\system32\nvcpl.dll
@{FFB699E0-306A-11d3-8BD1-00104B6F7516} /*Play on my TV helper*/F:\WINDOWS\system32\nvcpl.dll = F:\WINDOWS\system32\nvcpl.dll
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/F:\WINDOWS\system32\nvshell.dll = F:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/F:\WINDOWS\system32\nvshell.dll = F:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A48} /*nView Desktop Context Menu*/F:\WINDOWS\system32\nvshell.dll = F:\WINDOWS\system32\nvshell.dll
@{472083B0-C522-11CF-8763-00608CC02F24} /*avast*/F:\Programmi\Alwil Software\Avast4\ashShell.dll = F:\Programmi\Alwil Software\Avast4\ashShell.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
avast@{472083B0-C522-11CF-8763-00608CC02F24} = F:\Programmi\Alwil Software\Avast4\ashShell.dll
UltraWipe@{00e72351-c3bd-48cd-b090-77ea0d87a10a} = F:\PROGRA~1\REDSTR~1\ULTRAW~1\uwshext.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = F:\Programmi\WinRAR\rarext.dll
Yahoo! Mail@{5464D816-CF16-4784-B9F3-75C0DB52B499} = F:\PROGRA~1\Yahoo!\Common\ymmapi.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = F:\Programmi\Nero\Nero 7\Nero BackItUp\NBShell.dll

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = F:\Programmi\WinRAR\rarext.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
avast@{472083B0-C522-11CF-8763-00608CC02F24} = F:\Programmi\Alwil Software\Avast4\ashShell.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = F:\Programmi\WinRAR\rarext.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers@{EB4D3CFE-E2AA-4C6E-B2FE-2A749F95D208} = F:\Programmi\Nero\Nero 7\Nero BackItUp\NBShell.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>
@{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}F:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll = F:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
@{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}F:\Programmi\Yahoo!\Common\yiesrvc.dll = F:\Programmi\Yahoo!\Common\yiesrvc.dll
@{9030D464-4C02-4ABF-8ECC-5164760863C6}F:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll = F:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.google.it/ = http://www.google.it/
@Local PageF:\WINDOWS\system32\blank.htm = F:\WINDOWS\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = F:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = F:\WINDOWS\system32\msvidctl.dll
its@CLSID = F:\WINDOWS\system32\itss.dll
livecall@CLSID = F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mhtml@CLSID = %SystemRoot%\system32\inetcomm.dll
ms-its@CLSID = F:\WINDOWS\system32\itss.dll
msnim@CLSID = F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
mso-offdap@CLSID = F:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
mso-offdap11@CLSID = F:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
tv@CLSID = F:\WINDOWS\system32\msvidctl.dll

HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = F:\WINDOWS\system32\wiascr.dll

F:\Documents and Settings\Administrator\Menu Avvio\Programmi\Esecuzione automatica = Utilità controllo supporti di Cyber-shot Viewer.lnk

F:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica >>>
Adobe Reader Speed Launch.lnk = Adobe Reader Speed Launch.lnk
Alice ti aiuta.lnk = Alice ti aiuta.lnk
Avvio veloce di Adobe Reader.lnk = Avvio veloce di Adobe Reader.lnk
NaturalColorLoad.lnk = NaturalColorLoad.lnk
Ultra Wipe Launcher.lnk = Ultra Wipe Launcher.lnk

[wolly76]

e questo è l'altro poi dimmi che altro ti serve provo a fare anche il rootkit????



Logfile of HijackThis v1.99.1
Scan saved at 21.34.41, on 04/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
F:\Programmi\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
F:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
F:\WINDOWS\system32\svchost.exe
F:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe
F:\WINDOWS\Explorer.EXE
F:\Programmi\Analog Devices\SoundMAX\SMTray.exe
F:\WINDOWS\system32\GSICON.EXE
F:\WINDOWS\system32\dslagent.exe
F:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
F:\Programmi\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Programmi\Microsoft ActiveSync\wcescomm.exe
F:\WINDOWS\system32\WgaTray.exe
F:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
F:\Programmi\Alwil Software\Avast4\ashWebSv.exe
F:\Programmi\BulletProofSoft.com\SpywareRemover\SpyWatch.exe
F:\PROGRA~1\MICROS~3\rapimgr.exe
F:\Programmi\SEC\Natural Color\NaturalColorLoad.exe
F:\Programmi\RedStrike\UltraWipe\Launcher.exe
F:\Programmi\BulletProofSoft.com\SpywareRemover\73B350AD.DLL
F:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
F:\Programmi\Alice ti aiuta\bin\mpbtn.exe
F:\Programmi\eMule\emule.exe
F:\Programmi\Internet Explorer\IEXPLORE.EXE
F:\Programmi\Windows NT\Accessori\wordpad.exe
F:\Programmi\WinRAR\WinRAR.exe
F:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\Rar$EX00.484\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Programmi\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - F:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Smapp] F:\Programmi\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PMCRemote] F:\Programmi\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "F:\Programmi\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent] "F:\Programmi\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [spywatch] F:\Programmi\BulletProofSoft.com\SpywareRemover\SpyWatch.exe /STARTUP
O4 - HKCU\..\Run: [drvsyskit] F:\Documents and Settings\Administrator\Dati applicazioni\hidires\hidr.exe
O4 - HKCU\..\Run: [hldrrr] F:\WINDOWS\system32\hldrrr.exe
O4 - HKCU\..\Run: [updateMgr] "F:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Startup: Utilità controllo supporti di Cyber-shot Viewer.lnk = F:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Alice ti aiuta.lnk = F:\Programmi\Alice ti aiuta\bin\matcli.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = F:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Ultra Wipe Launcher.lnk = F:\Programmi\RedStrike\UltraWipe\Launcher.exe
O8 - Extra context menu item: &Yahoo! Search - file:///F:\Programmi\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///F:\Programmi\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///F:\Programmi\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///F:\Programmi\Yahoo!\Common/ycsms.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - F:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Programmi\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{74F3899F-A8B7-4565-90E7-A47B69E2A4B1}: NameServer = 85.37.17.11 151.99.125.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - F:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - F:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - F:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - F:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - F:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - F:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - F:\Programmi\File comuni\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - F:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - F:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - F:\Programmi\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Utilità di pianificazione di LiveUpdate automatico - Symantec Corporation - F:\Programmi\Symantec\LiveUpdate\ALUSchedulerSvc.exe

[Amantide]

Devi solo eliminare qualche valore nel registro che Avenger non è riuscito ad eliminare.
Vai su Start Esegui digita regedit e premi Ok.

Ora tramite espansione delle "cartelle" arriva fino a questa chiave

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Nella scheda a destra trova questi 2 valori
drvsyskit
hldrrr
ed eliminali cliccando sopra con il tasto destro e poi su Elimina.

Poi abilita la visualizzazione di filenascosti (Apri una cartella qualsiasi Strumenti Opzioni cartella Visualizzazione--> Visualizza file e cartelle nascosti) e vedi se c'è ancora questo file F:\WINDOWS\system32\hldrrr.exe

[wolly76]

l'attacco mi viene da dcom exploit e poi mi da un indirizzo ip ma dice che viene bloccato che devo fare ???
ti posto anche lo scan di rootkit



GMER 1.0.12.12011 - http://www.gmer.net
Rootkit scan 2007-01-04 21:53:24
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.12 ----

SSDT Vax347b.sys ZwClose
SSDT Vax347b.sys ZwCreateKey
SSDT Vax347b.sys ZwCreatePagingFile
SSDT Vax347b.sys ZwEnumerateKey
SSDT Vax347b.sys ZwEnumerateValueKey
SSDT Vax347b.sys ZwOpenKey
SSDT Vax347b.sys ZwQueryKey
SSDT Vax347b.sys ZwQueryValueKey
SSDT Vax347b.sys ZwSetSystemPowerState

---- Devices - GMER 1.0.12 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 8677BB60
Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 864E8330
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 863EA590
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 863EA590
Device \FileSystem\Rdbss \Device\FsWrap IRP_MJ_READ 8641D940
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 863EA590
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 863EA590
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 86412688
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_NAMED_PIPE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLOSE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_READ 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_WRITE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_EA 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_EA 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FLUSH_BUFFERS 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DIRECTORY_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_FILE_SYSTEM_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_INTERNAL_DEVICE_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SHUTDOWN 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_LOCK_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CLEANUP 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_CREATE_MAILSLOT 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_SECURITY 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_SECURITY 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_POWER 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SYSTEM_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_DEVICE_CHANGE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_QUERY_QUOTA 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_SET_QUOTA 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 IRP_MJ_PNP 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 86412688
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CREATE_NAMED_PIPE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_CLOSE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_READ 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_WRITE 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_EA 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_EA 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_FLUSH_BUFFERS 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_QUERY_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_SET_VOLUME_INFORMATION 86412688
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c IRP_MJ_DIRECTORY_CONTROL

[Amantide]

sono riuscito a rinstallare l'antivirus anche se ora mi dice che c'è un tizio che mi attacca

E' Avast che ti notifica gli attacchi? Vedo che non hai nemmeno un firewall, o forse solo quello di Windows. Installa Comodo Firewall o Zone Alarm per bloccare le intrusioni dall'esterno.
Mi sa che anche questi sono causa del virus che avete avuto, lo stesso problema ha avuto anche monykina. Leggi qui come risolvere.

Ah! Dimenticavo. Rifai lo scan con Hijackthis seleziona questa voce e premi Fix Checked.

R3 - Default URLSearchHook is missing

[wolly76]

Tutto risolto grazie mille amantide ma chi sei una specie di genio del computer???
siete davvero grandi in questo forum!!!!!

[Amantide]

No, sono solo un genietto apprendista
Grazie per i complimenti Wolly, spero che continuerai a frequentare il nostro sito

[wolly76]

ciao amantide
ho fatto un nuovo topic in windows riguardante il genuine advantage notifications gli dai un 'occhiata e mi fai sapere grazie

[Amantide]

Ho effettuato un ulteriore ricerca e pare che la storia non finisce qui. Qualcuno ha notato che il computer non si avvia piu in modalita provvisoria ed alcuni servizi non partono all'avvio... è sempre colpa del virus Bagle. Inoltre nella directory principale viene conservata una copia di quel virus Temp.zip, anche questa e da eliminare. Quindi cambiale le X nel log con la lettera dell'unita giusta (C, F, E ecc.) ed eseguite questo script con Avenger.

Files to delete:
X:\WINDOWS\system32\elist.xpt
X:\WINDOWS\re_file.exe
X:\error.gif
X:\temp.zip

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK

Postatemi il log di Avenger alla fine.

[wolly76]

ciao amantide, scusa la domanda un po' da incapace ma io con avenger non ci vado tanto d'accordo, quindi ricapitolando lo script lo devo incollare tutto quanto in una sola volta dopo aver cliccato sula lente oppure no?

[Amantide]

Sisi, tutto quello che vedi in neretto lo devi copiare ed incollare nella finestra del Avenger.

***EDIT***
Non dimenticare di sostituire X con la lettera dell'unità giusta

[wolly76]

Ho fatto utto come dici e sembra che avenger lo abbia cancellato in quanto non ha dato messaggi di errore e poi è ripartito tranquillamente!!!
Però (ops) non posso loggarti nulla in quanto avenger lo scrive su notepad e io per un vecchio problema notepad non ce l'ho + ti chiedo scusa!!!
ti posso postare qualcos'altro???
ps:per il resto non devo fare + nulla??? ossia sto c..... di virus è andato via per sempre!!!

[Amantide]

E' stato eliminato da Avast?
Puoi scaricarlo da qui.
Scaricato il file lo dovrai semplicemente copiare in C:\WINDOWS\system32\ e riavviare il pc.

[Dorkis]

ciao a tutti!!!!!

anche io ho il problema di avast e di ewido!!!!

ho provato anche a usare i programmini che avete linkato ma dice che non ho quel trojan sul mio pc.....mi potete aiutare anche a me x favore???

intanto mi procuro Gmer e faccio lo scan nei 2 modi....

spero di ripulire anche io sto pc :D

aggiungo che anche a me non funziona la modalità provvisoria