Anche io col maledetto BAGLE!!!

[Chalys]

Ragazzi buonasera innanzi tutto.
Mi sento perso! Anche io ho beccato questo demonio di virus, ma quando vado a fare la scansione direttamente sul web con kaspersky su tutto C:\ questa mi si è bloccata al file 5837 anche se il tempo continua a scorrere da più di 50 minuti!

Ho la possibilità di usare (ho salvato sul PC) anche HijackThis, gmer e Avenger, ma non ho la minima idea di come si usino.

Sono alla frutta! Spero possiate darmi una mano.

[Chalys]

E' ANCHE PEGGIO: mi si riavvia il PC!!!!!!!!!!

Allucinante...

[ste_95]

Sai il file in cui ti si blocca?

[crazy.cat]

Ho la possibilità di usare (ho salvato sul PC) anche HijackThis, gmer e Avenger, ma non ho la minima idea di come si usino.

Purtroppo ci servono a poco o niente.

Non è che la scansione si blocca su un qualche file video o immagine iso molto grande?

[Chalys]

OK, era come dicevi tu.
Ecco il file della scansione di Kaspersky su tutto il mio pc.

[crazy.cat]

Disattiva il ripristino della configurazione e riavvia il pc
http://www.MegaLab.it/2330

Poi applichi questo script ad avenger.

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\Documents and Settings\HP_Proprietario\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-5aa38e03-197fc209.class
C:\Documents and Settings\HP_Proprietario\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\file\omfge.class-11116b8e-2cf68aad.class
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_1[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_3[1].jpg 
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_3[2].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_3[3].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\DKCVZ2D4\b64_3[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_1[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_1[2].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_1[3].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[2].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[3].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[4].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[2].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[3].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[4].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_2[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_3[1].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_3[2].jpg
C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_3[3].jpg 
C:\Muestras\WINTEMS.EXE.Muestra EliBagle v10.85  Infected: Email-Worm.Win32.Bagle.of  skipped 
C:\Programmi\Help and Support Additions\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe
C:\WINDOWS\S626F7868.tmp
C:\WINDOWS\system32\mdelk.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32


Dopo il riavvio reinstalli l'antivirus.

Poi è strano che questi file ti vengano dati come locked, per sicurezza li fai analizzare sul sito www.virustotal.com e vediamo cosa sono.
C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\system32\dllcache\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\system32\ntkrnlpa.exe Object is locked skipped

[Chalys]

NON riesco ad installare Avanger!!!
Mi dice:

Local machine: installation failed
Installation:
Error: Action failed for file avgamsvr.exe: creating file....
No such file or directory

[crazy.cat]

Avenger non deve essere installato.
http://www.MegaLab.it/2656

cosa hai scaricato?
Avg antispyware per caso?

[Chalys]

Da Virustotal:

Risposta 1° file:
0 bytes size received / Se ha recibido un archivo vacio

Questa directory non esiste:
C:\WINDOWS\system32\dllcache

Risposta 3° file:
0 bytes size received / Se ha recibido un archivo vacio

[Chalys]

Gentilissimo Crazy, ho fatto come dicevi. Di seguito di incollo il log di Avenger dopo il riavvio.
Mi ha dato dei messaggi di errore alla fine.
Ora provo a reinstallare un antivirus.

----------------------------------------

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\xvuuwvun

*******************

Script file located at: \??\C:\Program Files\mhvacipj.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.


File C:\WINDOWS\system32\drivers\hldrrr.ex_ not found!
Deletion of file C:\WINDOWS\system32\drivers\hldrrr.ex_ failed!

Could not process line:
C:\WINDOWS\system32\drivers\hldrrr.ex_
Status: 0xc0000034

File C:\Documents and Settings\HP_Proprietario\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\file\omfg.class-5aa38e03-197fc209.class deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\file\omfge.class-11116b8e-2cf68aad.class deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_1[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_3[2].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\B12Y1MXX\b64_3[3].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\DKCVZ2D4\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_1[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_1[2].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_1[3].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[2].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[3].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_2[4].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[2].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[3].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\KH3CDWY7\b64_3[4].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_2[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_3[1].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_3[2].jpg deleted successfully.
File C:\Documents and Settings\HP_Proprietario\Impostazioni locali\Temporary Internet Files\Content.IE5\T1TO6SQ9\b64_3[3].jpg deleted successfully.


File C:\Muestras\WINTEMS.EXE.Muestra EliBagle v10.85 Infected: Email-Worm.Win32.Bagle.of skipped not found!
Deletion of file C:\Muestras\WINTEMS.EXE.Muestra EliBagle v10.85 Infected: Email-Worm.Win32.Bagle.of skipped failed!

Could not process line:
C:\Muestras\WINTEMS.EXE.Muestra EliBagle v10.85 Infected: Email-Worm.Win32.Bagle.of skipped
Status: 0xc0000034

File C:\Programmi\Help and Support Additions\Pavilion\XPHWWBF4\plugin\bin\PCHButton.exe deleted successfully.
File C:\WINDOWS\S626F7868.tmp deleted successfully.
File C:\WINDOWS\system32\mdelk.exe deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[Chalys]

AVAST sono riuscito a reinstallarlo, ma ora che sto facendo un nuovo SCAN on line, Kaspersky continua a trovare numerosi file infetti e vari virus.

Purtroppo io sto partendo per l'estero e tornerò solo giovedì sera: appena arrivo a casa allego di nuovo l'ultimo scan completo di Kaspersky.

Incomincio a perdere le speranze: ce ne sono?

Un saluto e un ringraziamento a tutto lo staff di un forum eccezionale.

Enzo

[crazy.cat]

se i file infetti sono nella cartella c:\avenger li puoi cancellare tutti senza problemi.

Se hai reinstallato l'antivirus bagle non c'è più.

[ste_95]

Ti troverai comunque con la modalità provvisoria disabilitata:

Per ripristinare la modalità provvisoria scarica ed esegui questo file:

http://www.MegaLab.it/3250