help script per vairus !!

[dremura]

Ciao a tutti, sono stato contagiato (credo) dal virus bagle o comunque da una sua variante.

Adesso sto eseguendo la scansione online con kaspersky, e successivamente dovrei usare avanger (credo...).

L'unico problema è che nn saprei come costruire lo script.

Mi potreste dare una mano voi??

Vi ringrazio in anticipo.

ciao

[ste_95]

Posta il risultato della scansione e noi ti forniremo lo script adatto.

[dremura]

ciao, ho appena finito lo scan con kaspersky...questo è il risultato:

Tuesday, January 22, 2008 11:12:20 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 22/01/2008
Kaspersky Anti-Virus database records: 492642


Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true

Scan Target Folders
C:\

Scan Statistics
Total number of scanned objects 24551
Number of viruses found 3
Number of infected objects 9
Number of suspicious objects 0
Duration of the scan process 01:24:19

Infected Object Name Virus Name Last Action
C:\Documents and Settings\AbboZ_1\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\cert8.db Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\formhistory.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\history.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\key3.db Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\parent.lock Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\search.sqlite Object is locked skipped

C:\Documents and Settings\AbboZ_1\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\urlclassifier2.sqlite Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Cronologia\History.IE5\MSHist012008012220080123\index.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Dati applicazioni\Mozilla\Firefox\Profiles\kh5vvrpv.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temp\~DF5053.tmp Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\4DAZ4LMF\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\W9EBKHAR\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\W9EBKHAR\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\W9IVOXI3\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\WDI749AZ\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\WDI749AZ\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\WDI749AZ\b64_31[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\AbboZ_1\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\AbboZ_1\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\Realtek\InstallShield\AzMixerSel.exe Infected: Trojan-Downloader.Win32.Bagle.in skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\CSC\00000001 Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\Download\2aa8f55e8af02052cea14cdae13ee2d9\sp2qfe\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd6477.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

Scan process completed.


Aspetto con ansia vostre notizie.

Grazie e ciao

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\WINDOWS\system32\mdelk.exe
C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\4DAZ4LMF\b64_31[2].jpg
C:\Programmi\Realtek\InstallShield\AzMixerSel.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\W9EBKHAR
C:\Documents and Settings\AbboZ_1\Impostazioni locali\Temporary Internet Files\Content.IE5\WDI749AZ

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.

[dremura]

Ciao, prima di tutto grazie per lo script.

Però ho ancora dei problemi....scarico avenger, lo estraggo dove voglio, ma quando poi cerco di aprirlo, la finestra della cartella si blocca (nn risponde) e mi appare un messaggio che dice che l'applicazione nn è una applicazione di win32 valida...


Cosa posso fare??

Li devo cancellare a mano quei file??

Grazie ciao

[crazy.cat]

Cosa posso fare??

Scarica questo http://www.mediafire.com/?6ngcjidswbt

Codice: Seleziona tutto

Li devo cancellare a mano quei file??

Non ci riusciresti, anche perché alcuni sono invisibili da windows.

[dremura]

Sono disperato !!!

Nn funziona manco quell'eseguibile li !!!

Cosa devo fare??? HELPPPP

[crazy.cat]

Sei il secondo che ha questo problema.....che sia arrivato un bagle più furbo?

Prova a rinominare il file avenger.exe in pippo.exe.

[dremura]

Ciao, alla fine sono riuscito a risolvere....ho fatto partire avenger da un pc in lan.

Tutto ok, antivirus installato !!

un super grazie a tutti !!

ByeZ