WIRELESS ASSENTE...AVRO' CANCELLATO QUALCHE FILE IMPORTANTE?

[ilovejohnnies]

salve a tutti,
ho un problema con internet diciamo difficile da descrivere...difficile forse perché non ci capisco niente!
semplicemente da qualche giorno non riesco a connettermi col wireless...non mi rileva proprio le reti...
se clicco sull'icona della connessione mi esce scritto "impossibile configurare la connessione senza fili. se si è attivato un altro programma per la gestione della connessione senza fili utilizzare quel programma".
ora...ho pensato che quel programma potesse essere intel pro set wireless...sono andata a controllare che nella cartella in questione ci fossero tutti i file e in effetti non c'era quasi niente..
mi son fatta passare il programma dalla mia amica ma non è cambiato granchè...inspiegabilmente lo stesso giorno in cui si è "rotta" la connessione è sparito anche l antivirus avast...l ho reinstallato ma niente! non mi trova neppure l'icona di avast...
la mia preoccupazione è quella di aver cancellato tutto dopo aver usato Ccleaner..in realtà nn ho fatto attenzione a ciò che il programma stava cancellando...è già per questo motivo mi sono mangiata le mani..
spero che qualcuno di voi sia in grado di darmi anche una minima spiegazione o aiuto...l unica cosa che ho pensato è quella di formattare il computer e reinstallare tutto...ma ci vogliono 10 giorni che mi arrivino i cd del computer dall italia!!infatti adesso sono in erasmus..

bando alle ciance..vi ringrazio in anticipo...
bye bye

[crazy.cat]

Niente antivirus e niente rete senza fili, virus bagle assicurato.
Serve il log della scansione di kaspersky e postalo qui.
Poi leggi l'articolo per ripristinare la connessione senza fili.
http://www.MegaLab.it/forum/viewtopic.php?t=34966

[ilovejohnnies]

Scan Statistics:
Total number of scanned objects: 59077
Number of viruses found: 1
Number of infected objects: 2
Number of suspicious objects: 0
Duration of the scan process: 01:22:11

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\HI\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\HI\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HI\Impostazioni locali\Cronologia\History.IE5\MSHist012007101820071019\index.dat Object is locked skipped
C:\Documents and Settings\HI\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\HI\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\HI\Impostazioni locali\Temp\hpodvd09.log Object is locked skipped
C:\Documents and Settings\HI\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HI\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\HI\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Programmi\File comuni\Logitech\QCDRV\BIN\Update.exe Object is locked skipped
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.eo skipped
C:\Programmi\Hp\hpcoretech\hpcmerr.log Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\chandir.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\chandir.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\chn.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\chn.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\D0000000.FCS Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\inuse.txt Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\L0000004.FCS Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\main.log Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_die.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_die.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_dnd.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_dnd.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_ext.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_ext.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_rcv.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\prs_rcv.idx Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\storydb.dat Object is locked skipped
C:\Programmi\Logitech\Desktop Messenger\8876480\Users\HI\Data\storydb.idx Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\srosa.sys Infected: Trojan-Downloader.Win32.Bagle.eo skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

[ilovejohnnies]

A questo punto cosa dovrei fare??
non ho ben capito come usare The Avenger....
grazie

[tecnico24]

scarica the avenger http://swandog46.geekstogo.com/avenger.zip
estrai ed avvialo.
clicca su Input script manually e poi sulla lente di ingrandimento.
nello spazio bianco inserisci questo script:

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

clicca su done,sul semaforo,due volte si,il pc si riavviera,al ritorno posta il log di avenger,lo trovi in c:/

[crazy.cat]

Mettiamo anche questo nei files to delete
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

altrimenti al riavvio del pc il virus si ripresenta tale e quale a prima.

[ilovejohnnies]

purtroppo non è cambiato niente...ecco il log di avenger:
(questo file l avevo già cancellato: C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe)


Beginning to process script file:

File C:\WINDOWS\system32\drivers\hidr.exe deleted successfully.
File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.


File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034



Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

[crazy.cat]

Non si reinstalla l'antivirus, o non funziona la rete?

[ilovejohnnies]

entrambe le cose!
oltretutto ieri ho provato anche a disinstallare avast dato che non funziovana..ma non è successo niente.
c'è da dire che riesco a connettermi tramite ethernet..
adesso sto provando di nuovo con kaspersky...

[crazy.cat]

Hai applicato il file reg che trovi in allegato all'articolo sul virus bagle?

Dal log di avenger il virus sembra sia stato rimosso.
si è riformato qualche file di quelli che sono scritti nel log?
avevi disattivato il ripristino della configurazione prima di fare avenger?

[tecnico24]

disattiva il ripristino configurazione di sistema.
poi
scarica elibagla.
www.zonavirus.com/datos/descargas/95/elibagla.asp
il download in fondo alla pagina.
avvialo,assicurati che la casella eliminar ficheros sia automaticamente spuntata.
fai la scansione e quando ha finito,posta il suo log in c:/.

[ilovejohnnies]

ecco il log di elibagle:



Fri Oct 19 13:13:06 2007
EliBagle v10.62 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Restaurada Clave: "SafeBoot\Minimal y Network"

Fri Oct 19 13:13:22 2007
EliBagle v10.62 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 5692
Nº Total de Ficheros: 57449
Nº de Ficheros Analizados: 9625
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Fri Oct 19 13:19:31 2007
EliBagle v10.62 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 5692
Nº Total de Ficheros: 57451
Nº de Ficheros Analizados: 9625
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

[ilovejohnnies]

ecco l'ultimo report di kaspersky che ho fatto...ci sono altri 2file infetti che avenger nn riesce a cancellare


C:\avenger\backup-18.10.07-21.33.09,39.zip/avenger/GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.eo skipped

C:\avenger\backup-18.10.07-21.33.09,39.zip ZIP: infected - 1 skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\eMule\Temp\002.part Object is locked skipped

C:\Programmi\eMule\Temp\011.part Object is locked skipped

C:\Programmi\eMule\Temp\012.part Object is locked skipped

C:\Programmi\eMule\Temp\013.part Object is locked skipped

C:\Programmi\eMule\Temp\017.part Object is locked skipped

C:\Programmi\eMule\Temp\022.part Object is locked skipped

C:\Programmi\eMule\Temp\024.part Object is locked skipped

C:\Programmi\eMule\Temp\026.part Object is locked skipped

C:\Programmi\eMule\Temp\029.part Object is locked skipped

C:\Programmi\eMule\Temp\032.part Object is locked skipped

C:\Programmi\eMule\Temp\033.part Object is locked skipped

C:\Programmi\eMule\Temp\041.part Object is locked skipped

C:\Programmi\Hp\hpcoretech\hpcmerr.log Object is locked skipped

C:\System Volume Information\_restore{AF5D15D8-6ED8-4BE7-9E13-F134D7ED7648}\RP1\A0000015.exe Infected: Trojan-Downloader.Win32.Bagle.eo skipped

C:\System Volume Information\_restore{AF5D15D8-6ED8-4BE7-9E13-F134D7ED7648}\RP1\A0000016.sys Infected: Trojan-Downloader.Win32.Bagle.eo skipped
C:\System Volume Information\_restore{AF5D15D8-6ED8-4BE7-9E13-F134D7ED7648}\RP1\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[tecnico24]

system volume information e la cartella del ripristino configurazione di sistema.disattivalo e poi riattivalo:
http://www.MegaLab.it/2330

[ilovejohnnies]

ok...la connessione wireless funziona...
provo a reinstallare avast...

[tecnico24]

ok,tienici informati.

[ilovejohnnies]

TUTTO OK!!! ANCHE AVAST HA RIPRESO A FUNZIONARE!
GRAZIE X L'AIUTO E LA PAZIENZA!
UN BACIO
chiara

[tecnico24]

di niente e buona giornata.

[ste_95]

ok...la connessione wireless funziona...
provo a reinstallare avast...

se non sbaglio è stato garzie ad avast che ti sei infettato il pc... non pensi a cambiarlo?