bagle 4

[alefar]

salve a tutti è la prima volta che posto in questo forum, spinto a iscrivermi dal virus bagle. Premettendo che non ho ancora finito la scansione con kaspersky ho provato a eliminare il simpatico virus con avenger, ma una volta riavviato il pc mi spunta questo:


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ewnqlehs

*******************

Script file located at: \??\C:\WINDOWS\yxwrhwbq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.


File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.
File C:\Programmi\Windows Media Player\WMPNSCFG.exe deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.





e pur non essendo un genio dei computer mi pare ovvio che bagle stia ancora dando rogne nel mio pc....qualcuno ha modo di salvarmi?

[alefar]

ok eco qua la scansione con skaspersky

Scan Statistics
Total number of scanned objects 58703
Number of viruses found 4
Number of infected objects 36
Number of suspicious objects 0
Duration of the scan process 07:43:04

Infected Object Name Virus Name Last Action
C:\avenger\backup.zip/avenger/hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\avenger\backup.zip/avenger/wintems.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip ZIP: infected - 2 skipped

C:\Documents and Settings\Alefar\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Cronologia\History.IE5\MSHist012008011420080115\index.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\Ahead\Nero Home\bl.db Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\Ahead\Nero Home\is2.db Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\ApplicationHistory\Acer.Empowering.Framework.Launcher.exe.7c55249b.ini.inuse Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\ApplicationHistory\ePower_DMC.exe.3ca0acde.ini.inuse Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\ApplicationHistory\ePresentation.exe.e70224e9.ini.inuse Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\ApplicationHistory\LockMon.exe.7987f3da.ini.inuse Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temp\Perflib_Perfdata_ab0.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temp\Perflib_Perfdata_e44.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temp\~DF3C5.tmp Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temp\~DFC720.tmp Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temp\~DFC72B.tmp Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\8JPBWIVG\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\D23QZMWD\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\IPIBA14T\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\S9UDSROL\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\S9UDSROL\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Alefar\ntuser.dat Object is locked skipped

C:\Documents and Settings\Alefar\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\Acer\OrbiCam\CameraAssistant.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\Programmi\Nero\Nero8\Nero BackItUp\BIU1.txt Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP60\A0014091.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP60\A0014096.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP60\A0014102.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP61\A0014110.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP62\A0014124.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP62\A0014128.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP62\A0015128.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP63\A0016144.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP63\A0016254.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP64\A0016262.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP65\A0016278.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP65\A0016284.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP66\A0016326.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016348.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016357.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016365.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016375.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016465.reg Infected: Trojan-Downloader.Win32.Bagle.hp skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016466.reg Infected: Trojan-Downloader.Win32.Bagle.hp skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016468.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\A0016470.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{F4B3DB8F-B928-4CB3-AD61-2850A479D8C6}\RP67\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\down\174656.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\196609.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\36126328.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\36137828.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\WINDOWS\system32\drivers\down\36179265.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_68c.dat Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_7b4.dat Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


spero davvero riusciate ad aiutarmi, sennò mi vedrò costretto a formattare o peggio a portarlo da un tecnico

[ste_95]

Per Alefar:

Disattiva il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\avenger\backup.zip
C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\8JPBWIVG\b64_2[1].jpg
C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\D23QZMWD\b64_3[1].jpg
C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\IPIBA14T\b64_3[1].jpg
C:\Programmi\Acer\OrbiCam\CameraAssistant.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\S9UDSROL

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[alefar]

ho fatto come mi ha detto ste

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ycssbpcy

*******************

Script file located at: \??\C:\WINDOWS\mxpffeig.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034




ma ho il vago sentore che ancora non ci siamo


oppure si?

[alefar]

ahhhhhhhhhhhhhhh aspetta ci siamo credo ho avviato antivir e stava cominciando a installarsi, ma per ora aspetto per maggiori conferme....comunque c'è poco da dire siete superiori....grazie ste

[ste_95]

Il logdi avenger non è stato postato per intero, postalo tutto.

Se tutte le anomalie sono state corrette, allora il problema dovrebbe essersi risolto.

[alefar]

non ho ancora verificato se la modalità provvisoria parte, ma ho installato nod32 trial senza problemi...per riportarer il blocco note di avenger devo riefettuare la scansione col suddetto programma?

ti ho già detto greazie?

[ste_95]

Il log di Avenger lo trovi in C:\Avenger\avenger.txt.

Per la modalità provvisoria, nel caso non funzionasse:

Scarica ed esegui questo file:

http://www.MegaLab.it/3250

[alefar]

ECCO QUA il testo completo



Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ycssbpcy

*******************

Script file located at: \??\C:\WINDOWS\mxpffeig.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.


File C:\WINDOWS\system32\drivers\hldrrr.ex_ not found!
Deletion of file C:\WINDOWS\system32\drivers\hldrrr.ex_ failed!

Could not process line:
C:\WINDOWS\system32\drivers\hldrrr.ex_
Status: 0xc0000034

File C:\avenger\backup.zip deleted successfully.
File C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\8JPBWIVG\b64_2[1].jpg deleted successfully.
File C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\D23QZMWD\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\IPIBA14T\b64_3[1].jpg deleted successfully.
File C:\Programmi\Acer\OrbiCam\CameraAssistant.exe deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Folder C:\Documents and Settings\Alefar\Impostazioni locali\Temporary Internet Files\Content.IE5\S9UDSROL deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.


ti farò sapere per la modalitàprovvisoria

[ste_95]

Ok, il virus non c'è più