virus beagle

[Fidelius]

Salve ragazzi.
Ho un grosso problema anch'io sono stato infettato da beagle, ho effettuato la scansione on line con Kaspersky, e adesso vorrei una mano per lo script da inserire in Avenger.
Di seguto troverete il log della scansione

[crazy.cat]

allega alla discussione un file zip, o copia e incolla il testo del file html nel post, non ho modo di aprire i file rar adesso.

[Fidelius]

KASPERSKY ONLINE SCANNER REPORT
Friday, January 11, 2008 2:03:10 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 10/01/2008
Kaspersky Anti-Virus database records: 506928


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\

Scan Statistics
Total number of scanned objects 44786
Number of viruses found 10
Number of infected objects 49
Number of suspicious objects 0
Duration of the scan process 05:03:54

Infected Object Name Virus Name Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Principal\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3\PuAzZo ScRipT 2.3.exe/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3\PuAzZo ScRipT 2.3.exe/Progs/PortScan.exe Infected: not-a-virus:NetTool.Win32.Scan.12 skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3\PuAzZo ScRipT 2.3.exe CreateInstall: infected - 2 skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3.rar/PuAzZo ScRipT 2.3.exe/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3.rar/PuAzZo ScRipT 2.3.exe/Progs/PortScan.exe Infected: not-a-virus:NetTool.Win32.Scan.12 skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3.rar/PuAzZo ScRipT 2.3.exe Infected: not-a-virus:NetTool.Win32.Scan.12 skipped

C:\Documents and Settings\Principal\Desktop\Driver\puazzo\[mIRC + script] PuAzZo ScRiPt v2.3.rar RAR: infected - 3 skipped

C:\Documents and Settings\Principal\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Principal\Impostazioni locali\Cronologia\History.IE5\MSHist012008011020080111\index.dat Object is locked skipped

C:\Documents and Settings\Principal\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Principal\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\8TURC5YV\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\FXSKSZVB\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\HSJY3RXF\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\OP89ABUV\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\Principal\ntuser.dat Object is locked skipped

C:\Documents and Settings\Principal\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Principal\UserData\index.dat Object is locked skipped

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.hr skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP11\A0004501.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP11\A0004502.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP11\A0004504.exe Infected: not-a-virus:Server-Proxy.Win32.AnalogX.414 skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP15\A0006017.exe Infected: Trojan-Downloader.Win32.Bagle.hr skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP15\A0006019.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP15\A0006031.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP15\A0006045.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP15\A0006067.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP18\A0006089.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP20\A0006184.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP20\A0006211.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP20\A0006220.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP21\A0006247.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP21\A0006249.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP21\A0006308.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP22\A0006382.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP22\A0006392.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP22\A0006397.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0006484.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0007140.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008135.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008140.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008146.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008154.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008165.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008175.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008180.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\A0008185.sys Infected: Trojan-Downloader.Win32.Bagle.hs skipped

C:\System Volume Information\_restore{CA0C31B1-1314-434F-B231-64FEA0D1C595}\RP24\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped

C:\WINDOWS\system32\drivers\down\141562.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\drivers\down\152671.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\drivers\down\30140.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\drivers\down\41078.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\drivers\down\44015.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\drivers\down\448781.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\drivers\down\496890.exe Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\WINDOWS\system32\drivers\down\512984.exe Infected: Trojan-Downloader.Win32.Bagle.gi skipped

C:\WINDOWS\system32\drivers\down\79296.exe Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

Scan process completed.

[crazy.cat]

Disattiva il ripristino della configurazione e riavvia il pc
http://www.MegaLab.it/2330

Poi applichi questo script ad avenger.

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\8TURC5YV\b64_1[1].jpg
C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\FXSKSZVB\b64_2[1].jpg
C:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\HSJY3RXF\b64_1[1].jpg
c:\Documents and Settings\Principal\Impostazioni locali\Temporary Internet Files\Content.IE5\OP89ABUV\b64_2[1].jpg
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

[Fidelius]

Grazie Crazy adesso è tutto OK!!

[Fidelius]

Ho notato che anche se il pc non ha più problemi non riesco più ad avviare xp in modalità provvisoria. Forse è rimasta ancora qualche traccia del virus?

[ste_95]

Per ripristinare la modalità provvisoria:
scarica il file [url=http://www.didierstevens.com/files/data/SafeBoot.zip]Safeboot.zip

estrai/scompatta l'archivio in una cartella a tua scelta ed esegui ...

[Fidelius]

Per ripristinare la modalità provvisoria:
scarica il file [url=http://www.didierstevens.com/files/data/SafeBoot.zip]Safeboot.zip

Non riesco ad andare nella pagina

[Pct]

Per ripristinare la modalità provvisoria:
scarica il file [url=http://www.didierstevens.com/files/data/SafeBoot.zip]Safeboot.zip

Non riesco ad andare nella pagina

Prova a cliccare sul link diretto(questo qua sotto):

http://www.didierstevens.com/files/data/SafeBoot.zip

se non riesci ancora da andarci,aspetta la risposta degli altri perché...

[Fidelius]

Adesso si.
Appena arrivo a casa lo provo e vi farò sapere.

[crazy.cat]

Ma il nostro file, non vi piace?
http://www.MegaLab.it/3250

[Pct]

Ma il nostro file, non vi piace?
http://www.MegaLab.it/3250

io i file del genere preferisco prenderli da MegaLab: in questo caso però, non l'ho consigliato io quel file,ma ste,quindi mi sono limitato a dare il link diretto che aveva dato ste_95.

[ste_95]

Ma il nostro file, non vi piace?
http://www.MegaLab.it/3250

Scusate

[Fidelius]

Adesso si che è tutto a posto
Ho scaricaro il file SafeBoot, ovviamente da MegaLab, è tutto è ritornato a funzionare al 100%.