www.MegaLab.it

da **iL_t3MpL4r3_d1g1t4L3** » gio set 20, 2007 1:53 pm

Mi date un'occhiata a questo log di kaspersky?

Ho 2 files infetti: che faccio?

Thursday, September 20, 2007 2:48:17 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 20/09/2007
Kaspersky Anti-Virus database records: 421155

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\

Scan Statistics
Total number of scanned objects 134472
Number of viruses found 1
Number of infected objects 2
Number of suspicious objects 0
Duration of the scan process 01:26:47

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Windows Defender\Support\MPLog-09202007-124005.log Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Cronologia\History.IE5\MSHist012007092020070921\index.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Dati applicazioni\Microsoft\Windows Defender\FileTracker\{A9066ED9-E735-4E44-BBB2-C716233D25D8} Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Temp\~DF974C.tmp Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Temp\~DF9760.tmp Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\iL_t3MpL4r3_d1g1t4L3\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\DAP\History\iL_t3MpL4r3_d1g1t4L3\_lasthist.dat Object is locked skipped

C:\Programmi\DAP\Log\DAP_REPORT.LOG Object is locked skipped

C:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skipped

C:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skipped

C:\System Volume Information\catalog.wci\00010002.ci Object is locked skipped

C:\System Volume Information\catalog.wci\cicat.fid Object is locked skipped

C:\System Volume Information\catalog.wci\cicat.hsh Object is locked skipped

C:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\INDEX.000 Object is locked skipped

C:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skipped

C:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{75E124C1-5C36-448F-8696-3C3E9C0E4EBD}\RP104\A0015508.exe/irsetup.dat Infected: P2P-Worm.Win32.P2PAdware.a skipped

C:\System Volume Information\_restore{75E124C1-5C36-448F-8696-3C3E9C0E4EBD}\RP104\A0015508.exe SetupFactory: infected - 1 skipped

C:\System Volume Information\_restore{75E124C1-5C36-448F-8696-3C3E9C0E4EBD}\RP109\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\WINDOWS\{00000001-00000000-00000001-00001102-00000004-20021102}.CDF Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

D:\System Volume Information\_restore{75E124C1-5C36-448F-8696-3C3E9C0E4EBD}\RP109\change.log Object is locked skipped

Scan process completed.

Ci tengo a precisare che ho Antivir PE.

Grazie!

da **BilloKenobi** » gio set 20, 2007 2:29 pm

niente di preoccupante, segui queste istruzioni per disattivare il ripristino configurazione di sistema e vai tranquillo

http://support.microsoft.com/kb/310405/it

da **iL_t3MpL4r3_d1g1t4L3** » gio set 20, 2007 2:37 pm

BilloKenobi ha scritto:niente di preoccupante, segui queste istruzioni per disattivare il ripristino configurazione di sistema e vai tranquillo

http://support.microsoft.com/kb/310405/it

Fatto! E adesso!?

...comunque il ripristino mi fa comodo in alcune situazioni, vorrei riattivarlo...

GRAZIE 1000 x la velocità!!! [applauso+]

da **BilloKenobi** » gio set 20, 2007 2:58 pm

si infatti. riattivalo con tranqullità

parrebbe tutto ok, kaspersky non ha evidenziato altro... altri sintomi?

da **iL_t3MpL4r3_d1g1t4L3** » gio set 20, 2007 3:04 pm

Niente di rilevante.

Per maggior sicurezza mi faccio una scansione con a-squared... può esser stato questo worm ad aver disattivato l'autoplay del mio lettore dvd?!

...e comunque ho trovato su un forum francese il modo con cui quel cosetto si sta propagando... si finge un **ack per dei famosi videogame sportivi 2007 e 2008.

Nulla in confronto alla potenza di bagle!

Grazie 1000 Kenobi!!! Che la forza sia con te! [...e con il tuo spirito...]

www.MegaLab.it

Virus?

Virus?

Chi c’è in linea