L'ultimo virus bagle blocca Avenger.

[trickiness]

Purtroppo mi sono beccato un bel virus bagle....che blocca avenger.
Non riesco a cancellare quindi il file infetto, ho un disperato bisogno d'aiuto.
Ringrazio anticipatamente tutti coloro che mi daranno informazioni su come sconfiggere questo Bagle.
Allego la scansione di kaspesky:
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\OrbNetworks\Logs\CabDirectory.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\OrbNetworks\Logs\OrbErrors.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\OrbNetworks\Logs\OrbTrayIcon.log Object is locked skipped

C:\Documents and Settings\Client\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Cronologia\History.IE5\MSHist012008012320080124\index.dat Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Dati applicazioni\Ahead\Nero Home\bl.db Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Dati applicazioni\Ahead\Nero Home\is2.db Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Temp\NERO13359\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped

C:\Documents and Settings\Client\Impostazioni locali\Temp\NERO14411\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\09ERGDU7\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\ATWF6965\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\ATWF6965\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\D91BC4EK\Nero-8.2.8.0_ita_trial[1].exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\D91BC4EK\Nero-8.2.8.0_ita_trial[1].exe 7-Zip: infected - 1 skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\VM073X0X\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5\VM073X0X\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Client\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Client\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\AGEIA Technologies\TrayIcon.exe Infected: Trojan.Win32.Agent.dxh skipped

C:\Programmi\Alice ti aiuta\log\mpbtn.log Object is locked skipped

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.in skipped

C:\Programmi\Java\jre1.6.0_02\bin\jusched.exe Infected: Trojan.Win32.Agent.dxh skipped

C:\Programmi\Nero\Nero8\Nero BackItUp\BIU1.txt Object is locked skipped

C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe Infected: Trojan.Win32.Agent.dxh skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB840987$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB929338$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\SoftwareDistribution\Download\5d02aa687fced580cdb60abdb77eb075\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\6c224b18c466dffa7011b6ceb0bf0467\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

Scan process completed.

Trickiness.

[Fred]

Blocca Avenger?! Questa mi giunge nuova (e sgradita). Se provassi ad avviare il pc da un live cd e lo eliminassi manualmente? Questa è solo un'idea però potrebbe funzionare.

[ste_95]

Purtroppo è così, l'ultima variante ha questa caratteristica.

Utilizza il MegaLabCD ed elimina i seguenti file e cartelle:

C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Tutte le cartelle contenute in C:\Documents and Settings\Client\Impostazioni locali\Temporary Internet Files\Content.IE5

[giu73]

forse non riesco a caricare il file ci sono istruzioni da qualche parte?

[Fred]

domanda: da dove hai preso quelle chiavi di registro?

[crazy.cat]

domanda: da dove hai preso quelle chiavi di registro?

Infettando un pc e andando a vedere cosa faceva il virus.
La prima a scoprirle è stata Amantide, poi il virus le ha sempre mantenute uguali.

L'ultima variante crea solo queste
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

[ste_95]

Sono le chiavi inerenti al servizio di avvio del rootkit, cioè di srosa.sys.

[Fred]

ok, grazie per le esaurienti risposte