Bagle 3

[ste_95]

Si ho svuotato la cartella tasks ..ma per togliere quelle righe le cancello come se fossero delle righe di testo lette da blocknotes?

Esatto...

In pratica dovrebbe rimanere così:

http://www.freefilehosting.net/download/3aaid

[misterxfiles]

ok ma col blocco note me lo salva in formto txt che è diverso dal file originale...nel senso che non lo sostituisce non lo sovrascrive.....


devo forse allora cancellare il file originale e metterci questo da te modificato e nel formato txt? Non ho capito e ho paura di sbagliare....

[crazy.cat]

Cancelli il file originale e salvi questo file txt rinominandolo togliendo l'estensione .txt e lasciando solo il nome hosts
Ti dirà che cambiando l'estensione il file sarà danneggiato o inutile (o qualcosa del genere) gli dici di si e vai avanti.

[Robertoxxx]

.. Oppure scrivere il nome del file senza estensione con le virgolette nel blocco note

[misterxfiles]

.. Oppure scrivere il nome del file senza estensione con le virgolette nel blocco note

ecco cosi' ci sono riuscito a cambiare l'estensione ....ad ogni modo pare che il portatile non ne voglia sapere di pulirsi completamente.. forse perche ho riavviato senza pulire questo file hosts vi mandero al piu' presto un altro report di kasper per uno script nuovo per avenger ....
Attendo con fiducia la medicina ......

[ste_95]

Potresti intanto postarne uno di hijackthis? Non ricordo se avevi eliminato tutti i file dalla cartella Tasks...

[misterxfiles]

buongiorno ste_95 ...si avevo cancellato il contenuto della cartella tasks ma non sono in possesso di hijakthis..dove si scarica? con l'altro pc non lo abbiamo usato ad ogni modo serve ..dove lo trovo?

[ste_95]

Scarica HiJackThis
Salvalo in una cartella (non aprirlo direttamente, sennò non farà i backup!)
Apri l'eseguibile
Clicca quindi su "Do a System Scan and Save a Logfile"
Attendi che finisca la scansione
Quindi copia il contenuto del blocco note qui sul forum.

[misterxfiles]

sto eseguando anche una nuova scansione con kasper... intanto eccoti il freschissimo report di hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11.58.30, on 13/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM_STI.EXE
C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe
C:\Programmi\PrevxCSI\prevxcsi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surclaro.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,"c:\windows\system32\googlehelper.exe",
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x
O4 - HKLM\..\Run: [geydx] "C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe"
O4 - HKLM\..\Run: [PrevxCSI] "C:\Programmi\PrevxCSI\prevxcsi.exe" -boot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [geydx] "C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe"
O4 - HKCU\..\Run: [MalwareBot] C:\Programmi\MalwareBot\MalwareBot.exe -boot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to AMV Convert Tool... - D:\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - D:\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://atticoportuensi.spaces.live.com/ ... nPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O16 - DPF: {FF022190-EEE0-434E-82E7-C17104E40526} (Chiamagratis XVOW SIP Component) - http://chiamagratis.abbeyphone.it/servi ... isXVOW.cab
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 5883 bytes

[ste_95]

Eh, ancora alcune cose ci sono, seleziona a sinistra queste voci e premi fix checked:

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,"c:\windows\system32\googlehelper.exe",
O4 - HKLM\..\Run: [geydx] "C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe"
O4 - HKCU\..\Run: [geydx] "C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe"

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
c:\windows\system32\googlehelper.exe

Folders to delete:
C:\DOCUME~1\Alex\IMPOST~1\Temp

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[misterxfiles]

prima di usare avenger non è meglio che lascio ultimare kaspersky e inviare il suo report..? Sta trovando parecchia roba

[ste_95]

Aspetta allora

[crazy.cat]

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,"c:\windows\system32\googlehelper.exe",
O4 - HKLM\..\Run: [geydx] "C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe"
O4 - HKCU\..\Run: [geydx] "C:\DOCUME~1\Alex\IMPOST~1\Temp\1113812.exe"

Questo è il gromozon/linkoptimizer.

[misterxfiles]

ho fixato con hijackthis come mi avevi indicato ...ma ecco l'ultimo report di kaspersky... con lo script adatto penso di farcela ..tocca a te ste_95.......
attendo fiducioso

[misterxfiles]

scusate ecco il report di kasper:


Sunday, January 13, 2008 6:40:00 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 13/01/2008
Kaspersky Anti-Virus database records: 509951
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
C:\
D:\
F:\
G:\
Scan Statistics
Total number of scanned objects 438596
Number of viruses found 13
Number of infected objects 111
Number of suspicious objects 0
Duration of the scan process 03:56:22

Infected Object Name Virus Name Last Action
C:\avenger\backup.zip/avenger/10073187.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/10073187[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4875046.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4875046[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4886578.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4886578[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4898421.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4898421[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4902140.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4902140[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4902578.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4902578[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4912015.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4947921.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/4947921[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5050468.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5050468[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5078093.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5078093[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5247468.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5247468[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5990687.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/5990687[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/833859.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/833859[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/834375.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/835093.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/835093[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/837390.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/837390[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/838125.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/838125[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/838265.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/838265[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/839406.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/839406[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/840234.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/841750.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/841750[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/842265.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/842265[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/842828.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/842828[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/842859.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/842859[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/843234.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/843234[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/843453.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/843453[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/843500.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/844437[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/844531.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/844531[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/844562.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/844562[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/845218.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/845312.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/845312[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/845875.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/845875[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/846062.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/846062[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/846953.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/847734.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/847890[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/848609.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9037328.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9037328[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9312046.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9312046[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9323828.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9323828[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9385234.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/9385234[1].txt Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/adult[1].exe Infected: not-a-virus:Porn-Dialer.Win32.Agent.aj skipped
C:\avenger\backup.zip/avenger/advertizing[1].htm Infected: Trojan-Downloader.JS.Agent.ab skipped
C:\avenger\backup.zip/avenger/Dc10.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/Dc9.exe Infected: Trojan.Win32.Dialer.tl skipped
C:\avenger\backup.zip/avenger/Galaxy[1].htm Infected: Trojan-Downloader.JS.Agent.ann skipped
C:\avenger\backup.zip/avenger/hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.hn skipped
C:\avenger\backup.zip/avenger/hosts.msn Infected: Trojan.Win32.Qhost.kk skipped
C:\avenger\backup.zip/avenger/IH2FF.tmp Infected: Trojan-Downloader.Win32.Tiny.eu skipped
C:\avenger\backup.zip/avenger/index[1].htm Infected: Trojan-Downloader.JS.Psyme.gy skipped
C:\avenger\backup.zip/avenger/Intelliscore Polyphonic WAV to MIDI Converter 7.1 Patch.exe Infected: Trojan-Downloader.Win32.Bagle.hn skipped
C:\avenger\backup.zip/avenger/l[1].exe Infected: Trojan-Downloader.Win32.Nurech.bd skipped
C:\avenger\backup.zip/avenger/srosa.sys Infected: Trojan-Downloader.Win32.Bagle.hq skipped
C:\avenger\backup.zip/avenger/u[1].dat Infected: Trojan-Downloader.Win32.Nurech.bd skipped
C:\avenger\backup.zip/avenger/u[1].dat-ren-483 Infected: Trojan-Downloader.Win32.Nurech.bd skipped
C:\avenger\backup.zip/avenger/u[1].exe Infected: Trojan-Downloader.Win32.Nurech.bd skipped
C:\avenger\backup.zip/avenger/u[1].exe-ren-386 Infected: Trojan-Downloader.Win32.Nurech.bd skipped
C:\avenger\backup.zip ZIP: infected - 90 skipped
C:\Documents and Settings\Alex\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Cronologia\History.IE5\MSHist012008011320080114\index.dat Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temp\40000060004550fd802a\cleaner.exe Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\0L2JCHUZ\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\0L2JCHUZ\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\5BBFPH4E\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\7F1JR1GW\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\8B3Z2OD1\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\IPNWH8RM\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\K9MNCP67\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\K9MNCP67\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\KB97EIFL\hosts4[1] Infected: Trojan.Win32.Qhost.kk skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\MZWN698V\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\POS79T89\hosts3[1] Infected: Trojan.Win32.Qhost.kk skipped
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\WZ2J2PA5\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped
C:\Documents and Settings\Alex\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Alex\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\RECYCLER\S-1-5-21-790525478-1604221776-1417001333-1003\Dc2 Infected: Trojan.Win32.Qhost.kk skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\down\14695359.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\down\14699515.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\down\167984.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\down\169593.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\down\188437.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\down\29229046.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\down\29236906.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\GoogleHelper.exe Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\monedmyi.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Tasks\abezih.job Object is locked skipped
C:\WINDOWS\Tasks\acynm.job Object is locked skipped
C:\WINDOWS\Tasks\afwrp.job Object is locked skipped
C:\WINDOWS\Tasks\aix.job Object is locked skipped
C:\WINDOWS\Tasks\aiz.job Object is locked skipped
C:\WINDOWS\Tasks\ajncoi.job Object is locked skipped
C:\WINDOWS\Tasks\akijnad.job Object is locked skipped
C:\WINDOWS\Tasks\akvq.job Object is locked skipped
C:\WINDOWS\Tasks\amryohe.job Object is locked skipped
C:\WINDOWS\Tasks\arggkxu.job Object is locked skipped
C:\WINDOWS\Tasks\arqas.job Object is locked skipped
C:\WINDOWS\Tasks\aszhadx.job Object is locked skipped
C:\WINDOWS\Tasks\axr.job Object is locked skipped
C:\WINDOWS\Tasks\bbfbimbh.job Object is locked skipped
C:\WINDOWS\Tasks\bdzuziu.job Object is locked skipped
C:\WINDOWS\Tasks\bgjcwgys.job Object is locked skipped
C:\WINDOWS\Tasks\bhske.job Object is locked skipped
C:\WINDOWS\Tasks\bhzj.job Object is locked skipped
C:\WINDOWS\Tasks\bnvt.job Object is locked skipped
C:\WINDOWS\Tasks\bnynfu.job Object is locked skipped
C:\WINDOWS\Tasks\bpbzmyf.job Object is locked skipped
C:\WINDOWS\Tasks\bsl.job Object is locked skipped
C:\WINDOWS\Tasks\btajkstf.job Object is locked skipped
C:\WINDOWS\Tasks\buba.job Object is locked skipped
C:\WINDOWS\Tasks\caqd.job Object is locked skipped
C:\WINDOWS\Tasks\cdjmlxj.job Object is locked skipped
C:\WINDOWS\Tasks\cjbxxs.job Object is locked skipped
C:\WINDOWS\Tasks\cjhg.job Object is locked skipped
C:\WINDOWS\Tasks\cutfjdyy.job Object is locked skipped
C:\WINDOWS\Tasks\czeztls.job Object is locked skipped
C:\WINDOWS\Tasks\dal.job Object is locked skipped
C:\WINDOWS\Tasks\daox.job Object is locked skipped
C:\WINDOWS\Tasks\dewclf.job Object is locked skipped
C:\WINDOWS\Tasks\dfx.job Object is locked skipped
C:\WINDOWS\Tasks\dgmw.job Object is locked skipped
C:\WINDOWS\Tasks\dhaqn.job Object is locked skipped
C:\WINDOWS\Tasks\dnz.job Object is locked skipped
C:\WINDOWS\Tasks\dpzxt.job Object is locked skipped
C:\WINDOWS\Tasks\dqmcbeyp.job Object is locked skipped
C:\WINDOWS\Tasks\dqygh.job Object is locked skipped
C:\WINDOWS\Tasks\drgvqi.job Object is locked skipped
C:\WINDOWS\Tasks\drqz.job Object is locked skipped
C:\WINDOWS\Tasks\drsl.job Object is locked skipped
C:\WINDOWS\Tasks\drxdtzt.job Object is locked skipped
C:\WINDOWS\Tasks\dsukfvt.job Object is locked skipped
C:\WINDOWS\Tasks\dux.job Object is locked skipped
C:\WINDOWS\Tasks\dwlyjsex.job Object is locked skipped
C:\WINDOWS\Tasks\dylsptts.job Object is locked skipped
C:\WINDOWS\Tasks\dztpldkz.job Object is locked skipped
C:\WINDOWS\Tasks\ebiahtsx.job Object is locked skipped
C:\WINDOWS\Tasks\ecsugli.job Object is locked skipped
C:\WINDOWS\Tasks\ecv.job Object is locked skipped
C:\WINDOWS\Tasks\ehccinp.job Object is locked skipped
C:\WINDOWS\Tasks\ejol.job Object is locked skipped
C:\WINDOWS\Tasks\emkowca.job Object is locked skipped
C:\WINDOWS\Tasks\esl.job Object is locked skipped
C:\WINDOWS\Tasks\evejmt.job Object is locked skipped
C:\WINDOWS\Tasks\eyoru.job Object is locked skipped
C:\WINDOWS\Tasks\ezvgja.job Object is locked skipped
C:\WINDOWS\Tasks\ezxee.job Object is locked skipped
C:\WINDOWS\Tasks\fbphj.job Object is locked skipped
C:\WINDOWS\Tasks\fegtnlby.job Object is locked skipped
C:\WINDOWS\Tasks\ffmlvdu.job Object is locked skipped
C:\WINDOWS\Tasks\fhz.job Object is locked skipped
C:\WINDOWS\Tasks\fnslaolw.job Object is locked skipped
C:\WINDOWS\Tasks\focf.job Object is locked skipped
C:\WINDOWS\Tasks\fooylyqp.job Object is locked skipped
C:\WINDOWS\Tasks\fqz.job Object is locked skipped
C:\WINDOWS\Tasks\fsy.job Object is locked skipped
C:\WINDOWS\Tasks\ftlsnv.job Object is locked skipped
C:\WINDOWS\Tasks\ggtnslxk.job Object is locked skipped
C:\WINDOWS\Tasks\gjx.job Object is locked skipped
C:\WINDOWS\Tasks\gnxjv.job Object is locked skipped
C:\WINDOWS\Tasks\gpd.job Object is locked skipped
C:\WINDOWS\Tasks\gptfoq.job Object is locked skipped
C:\WINDOWS\Tasks\gwhpuh.job Object is locked skipped
C:\WINDOWS\Tasks\gxic.job Object is locked skipped
C:\WINDOWS\Tasks\hafv.job Object is locked skipped
C:\WINDOWS\Tasks\hezoshu.job Object is locked skipped
C:\WINDOWS\Tasks\hfghc.job Object is locked skipped
C:\WINDOWS\Tasks\hftjj.job Object is locked skipped
C:\WINDOWS\Tasks\hgvwix.job Object is locked skipped
C:\WINDOWS\Tasks\hjfsb.job Object is locked skipped
C:\WINDOWS\Tasks\hkiixqb.job Object is locked skipped
C:\WINDOWS\Tasks\hlwgw.job Object is locked skipped
C:\WINDOWS\Tasks\hocwpufo.job Object is locked skipped
C:\WINDOWS\Tasks\homsummv.job Object is locked skipped
C:\WINDOWS\Tasks\hopzgqq.job Object is locked skipped
C:\WINDOWS\Tasks\hqesnii.job Object is locked skipped
C:\WINDOWS\Tasks\hric.job Object is locked skipped
C:\WINDOWS\Tasks\hrk.job Object is locked skipped
C:\WINDOWS\Tasks\hvfrjp.job Object is locked skipped
C:\WINDOWS\Tasks\hwfsb.job Object is locked skipped
C:\WINDOWS\Tasks\hxdzq.job Object is locked skipped
C:\WINDOWS\Tasks\iczsh.job Object is locked skipped
C:\WINDOWS\Tasks\ikmjr.job Object is locked skipped
C:\WINDOWS\Tasks\itygfudg.job Object is locked skipped
C:\WINDOWS\Tasks\itzm.job Object is locked skipped
C:\WINDOWS\Tasks\iywcgy.job Object is locked skipped
C:\WINDOWS\Tasks\jddt.job Object is locked skipped
C:\WINDOWS\Tasks\jdmn.job Object is locked skipped
C:\WINDOWS\Tasks\jlnz.job Object is locked skipped
C:\WINDOWS\Tasks\jmee.job Object is locked skipped
C:\WINDOWS\Tasks\jqn.job Object is locked skipped
C:\WINDOWS\Tasks\jryv.job Object is locked skipped
C:\WINDOWS\Tasks\jvuslrke.job Object is locked skipped
C:\WINDOWS\Tasks\jxoqltwo.job Object is locked skipped
C:\WINDOWS\Tasks\kgcnudz.job Object is locked skipped
C:\WINDOWS\Tasks\kkam.job Object is locked skipped
C:\WINDOWS\Tasks\ksshj.job Object is locked skipped
C:\WINDOWS\Tasks\kxujgaq.job Object is locked skipped
C:\WINDOWS\Tasks\ldbyqeax.job Object is locked skipped
C:\WINDOWS\Tasks\ldyk.job Object is locked skipped
C:\WINDOWS\Tasks\lezyp.job Object is locked skipped
C:\WINDOWS\Tasks\lgnpn.job Object is locked skipped
C:\WINDOWS\Tasks\lmdz.job Object is locked skipped
C:\WINDOWS\Tasks\lmp.job Object is locked skipped
C:\WINDOWS\Tasks\lnvap.job Object is locked skipped
C:\WINDOWS\Tasks\lpfhjwzy.job Object is locked skipped
C:\WINDOWS\Tasks\lpfrjx.job Object is locked skipped
C:\WINDOWS\Tasks\ltcocq.job Object is locked skipped
C:\WINDOWS\Tasks\lvdcgcpu.job Object is locked skipped
C:\WINDOWS\Tasks\mgkdnp.job Object is locked skipped
C:\WINDOWS\Tasks\mgptvcr.job Object is locked skipped
C:\WINDOWS\Tasks\mivwqcc.job Object is locked skipped
C:\WINDOWS\Tasks\mltpxmdp.job Object is locked skipped
C:\WINDOWS\Tasks\mmb.job Object is locked skipped
C:\WINDOWS\Tasks\mpna.job Object is locked skipped
C:\WINDOWS\Tasks\mvsxtfnp.job Object is locked skipped
C:\WINDOWS\Tasks\mxhqh.job Object is locked skipped
C:\WINDOWS\Tasks\nbm.job Object is locked skipped
C:\WINDOWS\Tasks\ndo.job Object is locked skipped
C:\WINDOWS\Tasks\neirv.job Object is locked skipped
C:\WINDOWS\Tasks\nkyj.job Object is locked skipped
C:\WINDOWS\Tasks\nmjwwzg.job Object is locked skipped
C:\WINDOWS\Tasks\nmv.job Object is locked skipped
C:\WINDOWS\Tasks\nntr.job Object is locked skipped
C:\WINDOWS\Tasks\nsw.job Object is locked skipped
C:\WINDOWS\Tasks\ntzo.job Object is locked skipped
C:\WINDOWS\Tasks\nyqrmq.job Object is locked skipped
C:\WINDOWS\Tasks\nzdmr.job Object is locked skipped
C:\WINDOWS\Tasks\oiaruk.job Object is locked skipped
C:\WINDOWS\Tasks\ojbvgt.job Object is locked skipped
C:\WINDOWS\Tasks\ojmtukr.job Object is locked skipped
C:\WINDOWS\Tasks\omyt.job Object is locked skipped
C:\WINDOWS\Tasks\oxpvola.job Object is locked skipped
C:\WINDOWS\Tasks\oztxxif.job Object is locked skipped
C:\WINDOWS\Tasks\pcnyr.job Object is locked skipped
C:\WINDOWS\Tasks\pdcqc.job Object is locked skipped
C:\WINDOWS\Tasks\phpcd.job Object is locked skipped
C:\WINDOWS\Tasks\phx.job Object is locked skipped
C:\WINDOWS\Tasks\pidb.job Object is locked skipped
C:\WINDOWS\Tasks\pkgysfce.job Object is locked skipped
C:\WINDOWS\Tasks\plk.job Object is locked skipped
C:\WINDOWS\Tasks\pnhiilr.job Object is locked skipped
C:\WINDOWS\Tasks\ppq.job Object is locked skipped
C:\WINDOWS\Tasks\psk.job Object is locked skipped
C:\WINDOWS\Tasks\ptjkbrqs.job Object is locked skipped
C:\WINDOWS\Tasks\ptql.job Object is locked skipped
C:\WINDOWS\Tasks\puow.job Object is locked skipped
C:\WINDOWS\Tasks\pxn.job Object is locked skipped
C:\WINDOWS\Tasks\qcr.job Object is locked skipped
C:\WINDOWS\Tasks\qgbzr.job Object is locked skipped
C:\WINDOWS\Tasks\qhdndj.job Object is locked skipped
C:\WINDOWS\Tasks\qojqx.job Object is locked skipped
C:\WINDOWS\Tasks\qygj.job Object is locked skipped
C:\WINDOWS\Tasks\rdadxkr.job Object is locked skipped
C:\WINDOWS\Tasks\reqhclar.job Object is locked skipped
C:\WINDOWS\Tasks\rfborn.job Object is locked skipped
C:\WINDOWS\Tasks\rhde.job Object is locked skipped
C:\WINDOWS\Tasks\rmkanmm.job Object is locked skipped
C:\WINDOWS\Tasks\rnwhcvq.job Object is locked skipped
C:\WINDOWS\Tasks\rpjze.job Object is locked skipped
C:\WINDOWS\Tasks\rrjq.job Object is locked skipped
C:\WINDOWS\Tasks\rrxeb.job Object is locked skipped
C:\WINDOWS\Tasks\rtkzkup.job Object is locked skipped
C:\WINDOWS\Tasks\rvptvhy.job Object is locked skipped
C:\WINDOWS\Tasks\rzjbzrne.job Object is locked skipped
C:\WINDOWS\Tasks\scg.job Object is locked skipped
C:\WINDOWS\Tasks\shqcb.job Object is locked skipped
C:\WINDOWS\Tasks\shxasg.job Object is locked skipped
C:\WINDOWS\Tasks\siio.job Object is locked skipped
C:\WINDOWS\Tasks\sjsoqzv.job Object is locked skipped
C:\WINDOWS\Tasks\skhdsiap.job Object is locked skipped
C:\WINDOWS\Tasks\slmd.job Object is locked skipped
C:\WINDOWS\Tasks\smpsqlb.job Object is locked skipped
C:\WINDOWS\Tasks\sscqrfk.job Object is locked skipped
C:\WINDOWS\Tasks\stz.job Object is locked skipped
C:\WINDOWS\Tasks\suk.job Object is locked skipped
C:\WINDOWS\Tasks\swsjtlk.job Object is locked skipped
C:\WINDOWS\Tasks\sxrxtu.job Object is locked skipped
C:\WINDOWS\Tasks\tbvgs.job Object is locked skipped
C:\WINDOWS\Tasks\tef.job Object is locked skipped
C:\WINDOWS\Tasks\tfkwqhy.job Object is locked skipped
C:\WINDOWS\Tasks\tfuc.job Object is locked skipped
C:\WINDOWS\Tasks\tgjca.job Object is locked skipped
C:\WINDOWS\Tasks\thpddrd.job Object is locked skipped
C:\WINDOWS\Tasks\tib.job Object is locked skipped
C:\WINDOWS\Tasks\tmjrt.job Object is locked skipped
C:\WINDOWS\Tasks\trtasq.job Object is locked skipped
C:\WINDOWS\Tasks\uao.job Object is locked skipped
C:\WINDOWS\Tasks\ubh.job Object is locked skipped
C:\WINDOWS\Tasks\ubqfvmn.job Object is locked skipped
C:\WINDOWS\Tasks\uhhnbss.job Object is locked skipped
C:\WINDOWS\Tasks\umtzg.job Object is locked skipped
C:\WINDOWS\Tasks\uofuz.job Object is locked skipped
C:\WINDOWS\Tasks\uov.job Object is locked skipped
C:\WINDOWS\Tasks\upzq.job Object is locked skipped
C:\WINDOWS\Tasks\uqcynsqe.job Object is locked skipped
C:\WINDOWS\Tasks\utgrh.job Object is locked skipped
C:\WINDOWS\Tasks\utnles.job Object is locked skipped
C:\WINDOWS\Tasks\uvh.job Object is locked skipped
C:\WINDOWS\Tasks\uvrkl.job Object is locked skipped
C:\WINDOWS\Tasks\uxpfx.job Object is locked skipped
C:\WINDOWS\Tasks\vaf.job Object is locked skipped
C:\WINDOWS\Tasks\vapk.job Object is locked skipped
C:\WINDOWS\Tasks\vaztsl.job Object is locked skipped
C:\WINDOWS\Tasks\vfly.job Object is locked skipped
C:\WINDOWS\Tasks\vgtxrlee.job Object is locked skipped
C:\WINDOWS\Tasks\vig.job Object is locked skipped
C:\WINDOWS\Tasks\vspyqw.job Object is locked skipped
C:\WINDOWS\Tasks\vwaitrr.job Object is locked skipped
C:\WINDOWS\Tasks\vyfjsizj.job Object is locked skipped
C:\WINDOWS\Tasks\wgwz.job Object is locked skipped
C:\WINDOWS\Tasks\whkpxrj.job Object is locked skipped
C:\WINDOWS\Tasks\whqe.job Object is locked skipped
C:\WINDOWS\Tasks\wivqqx.job Object is locked skipped
C:\WINDOWS\Tasks\wjzub.job Object is locked skipped
C:\WINDOWS\Tasks\wmgwlmnc.job Object is locked skipped
C:\WINDOWS\Tasks\wudf.job Object is locked skipped
C:\WINDOWS\Tasks\wxhe.job Object is locked skipped
C:\WINDOWS\Tasks\xcpdmkdf.job Object is locked skipped
C:\WINDOWS\Tasks\xfzjupwh.job Object is locked skipped
C:\WINDOWS\Tasks\xgitzr.job Object is locked skipped
C:\WINDOWS\Tasks\xlj.job Object is locked skipped
C:\WINDOWS\Tasks\xnw.job Object is locked skipped
C:\WINDOWS\Tasks\xrwzrs.job Object is locked skipped
C:\WINDOWS\Tasks\xwn.job Object is locked skipped
C:\WINDOWS\Tasks\xyep.job Object is locked skipped
C:\WINDOWS\Tasks\xyglz.job Object is locked skipped
C:\WINDOWS\Tasks\xzqydpix.job Object is locked skipped
C:\WINDOWS\Tasks\xzwigjhm.job Object is locked skipped
C:\WINDOWS\Tasks\ydlz.job Object is locked skipped
C:\WINDOWS\Tasks\ygh.job Object is locked skipped
C:\WINDOWS\Tasks\ylllt.job Object is locked skipped
C:\WINDOWS\Tasks\yllqceud.job Object is locked skipped
C:\WINDOWS\Tasks\ymrb.job Object is locked skipped
C:\WINDOWS\Tasks\yovye.job Object is locked skipped
C:\WINDOWS\Tasks\yrg.job Object is locked skipped
C:\WINDOWS\Tasks\yurdbdr.job Object is locked skipped
C:\WINDOWS\Tasks\yutvntnu.job Object is locked skipped
C:\WINDOWS\Tasks\yxq.job Object is locked skipped
C:\WINDOWS\Tasks\zaqfleb.job Object is locked skipped
C:\WINDOWS\Tasks\zcqrmryp.job Object is locked skipped
C:\WINDOWS\Tasks\zfwyjeeq.job Object is locked skipped
C:\WINDOWS\Tasks\zhsbfwo.job Object is locked skipped
C:\WINDOWS\Tasks\zjev.job Object is locked skipped
C:\WINDOWS\Tasks\zjyvydb.job Object is locked skipped
C:\WINDOWS\Tasks\zmk.job Object is locked skipped
C:\WINDOWS\Tasks\zqltkby.job Object is locked skipped
C:\WINDOWS\Tasks\ztck.job Object is locked skipped
C:\WINDOWS\Tasks\ztl.job Object is locked skipped
C:\WINDOWS\Tasks\ztytf.job Object is locked skipped
C:\WINDOWS\Tasks\zwadwck.job Object is locked skipped
C:\WINDOWS\Tasks\zxpl.job Object is locked skipped
C:\WINDOWS\Tasks\zzf.job Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

[ste_95]

Disabilita il ripristino configurazione di sistema.

Svuota il cestino

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\avenger\backup.zip ZIP
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\0L2JCHUZ\b64_3[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\0L2JCHUZ\b64_3[2].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\5BBFPH4E\b64_3[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\7F1JR1GW\b64_3[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\8B3Z2OD1\b64_3[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\IPNWH8RM\b64_3[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\K9MNCP67\b64_1[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\K9MNCP67\b64_2[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\KB97EIFL\hosts4[1]
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\MZWN698V\b64_2[1].jpg
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\POS79T89\hosts3[1]
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\WZ2J2PA5\b64_1[1].jpg

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\WINDOWS\Tasks

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32


Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Poi portati in C:\WINDOWS e crea una nuova cartella di nome Tasks

[misterxfiles]

ecco il report di avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\otgdqeij

*******************

Script file located at: \??\C:\Documents and Settings\qcke^tew.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.


File C:\WINDOWS\system32\drivers\hldrrr.ex_ not found!
Deletion of file C:\WINDOWS\system32\drivers\hldrrr.ex_ failed!

Could not process line:
C:\WINDOWS\system32\drivers\hldrrr.ex_
Status: 0xc0000034



File C:\avenger\backup.zip ZIP not found!
Deletion of file C:\avenger\backup.zip ZIP failed!

Could not process line:
C:\avenger\backup.zip ZIP
Status: 0xc0000034

File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\0L2JCHUZ\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\0L2JCHUZ\b64_3[2].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\5BBFPH4E\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\7F1JR1GW\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\8B3Z2OD1\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\IPNWH8RM\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\K9MNCP67\b64_1[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\K9MNCP67\b64_2[1].jpg deleted successfully.


File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\KB97EIFL\hosts4[1] not found!
Deletion of file C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\KB97EIFL\hosts4[1] failed!

Could not process line:
C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\KB97EIFL\hosts4[1]
Status: 0xc0000034

File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\MZWN698V\b64_2[1].jpg deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\POS79T89\hosts3[1] deleted successfully.
File C:\Documents and Settings\Alex\Impostazioni locali\Temporary Internet Files\Content.IE5\WZ2J2PA5\b64_1[1].jpg deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Folder C:\WINDOWS\Tasks deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Hai ricreato la cartella Tasks?
Puoi postare un log di hijackthis?
Come ti trovi?

[misterxfiles]

La parola fine ancora non puo' essere pronunciata ..sembrerebbe che il bagle rimanga annidato in alcune cartelle e che venendo distrutto dall'antivirus poi si replicherebbe non so grazie a quale meccanismo innescando un meccanismo di riannientamento da parte dell'antivirus nel ricancellarlo pur non riuscendo piu a contrastare l'istallazione dell'antivirus che ora è installato e funziona il bagle troverebbe la risorsa per ricostituirsi...ho dei sospetti su come sia successo ..forse un programma antimalware facwendo dei backup lo isolava in essi e l'antivirus li riconosce come minacce rendendo necessaria la riscansione ...Vi faro sapere al piu presto dopo l'ennesima scansione , questa volta senza antimalware, l'esito delle operazioni...vi postero poi i vari rapprti hijaksthis e quantaltro mi richiederete....grazie per la collaborazione di tutti siete veramente stimabili persone grazie ancora...

[misterxfiles]

Hai ricreato la cartella Tasks?
Puoi postare un log di hijackthis?
Come ti trovi?

Salve ste_95 sembra che vada meglio l'antivirus (kaspersky) si è installato e non ha rilevato minacce....ho ricreato gia da ieri la cartella tasks...ecco cosa mostra hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13.24.16, on 14/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\VM_STI.EXE
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surclaro.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Programmi\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera 301x
O4 - HKLM\..\Run: [PrevxCSI] "C:\Programmi\PrevxCSI\prevxcsi.exe" -boot
O4 - HKLM\..\Run: [AVP] "C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to AMV Convert Tool... - D:\AMVConverter\grab.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - D:\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://atticoportuensi.spaces.live.com/ ... nPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O16 - DPF: {FF022190-EEE0-434E-82E7-C17104E40526} (Chiamagratis XVOW SIP Component) - http://chiamagratis.abbeyphone.it/servi ... isXVOW.cab
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 6091 bytes