www.MegaLab.it

da **5Philippe5** » sab set 29, 2007 1:25 am

raga è da gg che quando accendo il pc ANTIVIR mi rileva questo virus...
lo rileva anche quando apro una qualsiasi cartella posizionata nel desktop oppure quando apro internet explorer....e quando provo a cancellarlo ..nn cambia nulla..anchw quando mi dice che devo riavviare..x cancellare definitivamente il file infetto....

lascio un immagine di qllo che mi compare quando mi rileva il virus!

da **Andy94** » sab set 29, 2007 6:15 am

Fai una scansione con HijackThis e posta qui il log che viene generato.

da **5Philippe5** » sab set 29, 2007 1:53 pm

Logfile of HijackThis v1.99.1
Scan saved at 14.54.57, on 29/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\Downlo~1\rtim1\5jwry.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\File comuni\Ulead Systems\AutoDetector\monitor.exe
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\APPS\SMP\SmpSys.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\sUNvruqMVrH.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Programmi\WinRAR\WinRAR.exe
D:\DOCUME~1\gvggt\IMPOST~1\Temp\Rar$EX00.688\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
R3 - URLSearchHook: elenco_radio toolbar - {337d7945-7b40-405d-95d9-b4f5c93148f2} - C:\Programmi\elenco_radio\tbelen.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Programmi\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\Programmi\MegauploadToolbar\megauploadtoolbar.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programmi\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programmi\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: elenco_radio toolbar - {337d7945-7b40-405d-95d9-b4f5c93148f2} - C:\Programmi\elenco_radio\tbelen.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programmi\File comuni\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [StartCCC] C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [Skype] "C:\APPS\SKYPE\PHONE\SKYPE.EXE" /nosplash /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Programmi\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [updateMgr] C:\Programmi\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [EPSON Stylus C20 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /A "C:\WINDOWS\system32\E_S4A.tmp"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe (file missing)
O9 - Extra button: Alice - {6A149D78-3D89-4CD2-BBE0-0F680574FDE2} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://andrea26asr.spaces.live.com//Pho ... nPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-U ... E_UNO1.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://andrea26asr.spaces.live.com/Phot ... nPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/A ... tPkMSN.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b55762.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZI ... b56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Ba ... b31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{81BCCC61-15D0-4248-8914-0D9F97BD6B82}: NameServer = 85.37.17.17 85.38.28.72
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmi\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Media Center Receiver Service (ehRecvr) - Unknown owner - C:\WINDOWS\eHome\ehRecvr.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programmi\File comuni\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

da **crazy.cat** » sab set 29, 2007 2:28 pm

Che brutto nome questo file, dai un occhiata se lo trovi
C:\WINDOWS\Downlo~1\rtim1\5jwry.exe

che programma è questo?
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

da **5Philippe5** » sab set 29, 2007 6:56 pm

crazy.cat ha scritto:Che brutto nome questo file, dai un occhiata se lo trovi
C:\WINDOWS\Downlo~1\rtim1\5jwry.exe

che programma è questo?
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe

il primo file nn lo trovo mentre x quanto riguarda vaderetro..è un programma che serve x filtrare la posta e respingere tt i tipi di spam..ed è un programma che già ho trovato quando ho acquistato il pc..

da **5Philippe5** » lun ott 01, 2007 4:44 pm

si puo far qualcosa allora??...io nn sono riuscito ad eliminarlo qsto virus e mi si presenta ogni volta che accendo il pc..il file infetto nella cartella windows lo trovo ma nn me lo fa cancellare

da **crazy.cat** » lun ott 01, 2007 5:01 pm

Hai provato a cancellare i file infetti con unlocker o killbox?

da **5Philippe5** » lun ott 01, 2007 6:05 pm

crazy.cat ha scritto:Hai provato a cancellare i file infetti con unlocker o killbox?

no perché..nn so dove mettere mano e aspettavo vostri consigli [:)]

adesso ci provo

da **5Philippe5** » lun ott 01, 2007 6:40 pm

n unlocker se vado a sbloccare il file mi da errore irreversibile in C ..e il computer si blocca..l'errore critico viene dallo sblocco di winlogon.exe con una schermata blu mentre con killbox mi dice che il file nn si puo cancellare

da **crazy.cat** » mar ott 02, 2007 1:04 pm

Utilizza the avenger
http://www.MegaLab.it/2656
e gli dai in pasto questo script

Files to delete:
c:\windows\system32\urpqqqq.dll
C:\WINDOWS\sUNvruqMVrH.exe
C:\WINDOWS\Downlo~1\rtim1\5jwry.exe

da **5Philippe5** » mar ott 02, 2007 2:49 pm

nnt al riavvio del pc mi ha trovato lo stesso il virus.... [acc2]

che sfiga

da **crazy.cat** » mar ott 02, 2007 4:38 pm

Fai una scansione online sul sito della kaspersky e posta qui il risultato finale
http://www.kaspersky.com/virusscanner

da **5Philippe5** » mar ott 02, 2007 10:05 pm

Infected Object Name Virus Name Last Action
C:\!KillBox\urqpppp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\!KillBox\urqpppp.dll( 1) Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\!KillBox\urqpppp.dll( 2) Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\!KillBox\urqpppp.dll( 3) Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\Programmi\DAEMON Tools\SetupDTSB.exe Infected: not-a-virus:AdTool.Win32.WhenU.a skipped

C:\Programmi\File comuni\{B4530B54-0AE9-1040-0324-060104060027}\services.dll Infected: not-a-virus:AdWare.Win32.Mostofate.q skipped

C:\Programmi\MyGlobalSearch\bar\1.bin\NPMYGLSH.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.i skipped

C:\System Volume Information\_restore{732C3204-2AF9-439C-9CB9-CFF93AE32A0D}\RP312\A0145154.exe Infected: Trojan-Downloader.Win32.Small.dij skipped

C:\System Volume Information\_restore{732C3204-2AF9-439C-9CB9-CFF93AE32A0D}\RP312\change.log Object is locked skipped

C:\WINDOWS\bNeRsYUKAd.exe Infected: Trojan.Win32.Dialer.uj skipped

C:\WINDOWS\bVwYJRjtv.exe Infected: Trojan.Win32.Dialer.uj skipped

C:\WINDOWS\Downloaded Program Files\ClientAX.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped

C:\WINDOWS\HRmfftAfOvB.exe Infected: Trojan.Win32.Dialer.uj skipped

C:\WINDOWS\IjcWjGQOfRg.exe Infected: Trojan.Win32.Dialer.uj skipped

C:\WINDOWS\ktoOvVaFVy.exe Infected: Trojan.Win32.Dialer.uj skipped

C:\WINDOWS\QkexLLdXp.exe Infected: Trojan.Win32.Dialer.uj skipped

C:\WINDOWS\QXOvavj.exe Infected: Trojan.Win32.Dialer.fg skipped

C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{9D50513E-775E-4868-AD9F-EE0F30996E1D}.crmlog Object is locked skipped

C:\WINDOWS\system32\ssqpq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped

C:\WINDOWS\system32\urqpppp.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped

C:\WINDOWS\XqGORAROK.exe Infected: Trojan.Win32.Dialer.fg skipped

C:\WINDOWS\YDoVgkXrqmn.exe Infected: Trojan.Win32.Dialer.uj skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\059B4D19.exe Infected: not-a-virus:AdWare.Win32.Agent.y skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\0734537D.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\07484F68.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\07871C65.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\07D50C0E.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\141D0E6E.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\2CBD4A71.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\2D163810.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\77345DF0.dll Infected: not-a-virus:AdWare.Win32.180Solutions.ao skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\7B000E2E.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\7CD3022C.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\7D1E47D9.wma Infected: Trojan-Downloader.WMA.Wimad.d skipped

D:\Documents and Settings\gvggt\Impostazioni locali\Temp\jar_cache41670.tmp Infected: Trojan.Win32.Dialer.vb skipped

D:\System Volume Information\_restore{732C3204-2AF9-439C-9CB9-CFF93AE32A0D}\RP312\A0144135.exe Infected: Trojan.Win32.Dialer.vb skipped

D:\System Volume Information\_restore{732C3204-2AF9-439C-9CB9-CFF93AE32A0D}\RP312\change.log Object is locked skipped

da **crazy.cat** » mer ott 03, 2007 7:17 am

Disattiva il ripristino della configurazione sul disco C: e D:, e riavvia il pc
http://www.MegaLab.it/2330

Svuota la quarantena di norton che è piena di virus, cancella questa cartella C:\!KillBox\

Dai questo script ad avenger

Files to delete:
c:\windows\system32\urpqqqq.dll
C:\WINDOWS\sUNvruqMVrH.exe
C:\WINDOWS\Downlo~1\rtim1\5jwry.exe
C:\Programmi\File comuni\{B4530B54-0AE9-1040-0324-060104060027}\services.dll
C:\Programmi\MyGlobalSearch\bar\1.bin\NPMYGLSH.DLL
C:\WINDOWS\bNeRsYUKAd.exe
C:\WINDOWS\bVwYJRjtv.exe
C:\WINDOWS\Downloaded Program Files\ClientAX.dll
C:\WINDOWS\HRmfftAfOvB.exe
C:\WINDOWS\IjcWjGQOfRg.exe
C:\WINDOWS\ktoOvVaFVy.exe
C:\WINDOWS\QkexLLdXp.exe
C:\WINDOWS\QXOvavj.exe
C:\WINDOWS\system32\ssqpq.dll
C:\WINDOWS\system32\urqpppp.dll
C:\WINDOWS\XqGORAROK.exe
C:\WINDOWS\YDoVgkXrqmn.exe
D:\Documents and Settings\gvggt\Impostazioni locali\Temp\jar_cache41670.tmp

Fai anche una scansione con A2 squared o superantispyware perché sei pieno di schifezze di vario genere.