worm bagle un aiuto x lo script

[simonedd]

ciao a tutti, e' da ieri che cerco di togliere sto worm dal mio pc, ho seguito alla lettera le vostre istruzioni su come eliminarlo ma ci sono riuscito solo in parte. questo e' il report della scansione del pc con kaspersky. grazie anticipatemte

KASPERSKY ONLINE SCANNER REPORT
Wednesday, January 30, 2008 8:56:48 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 30/01/2008
Kaspersky Anti-Virus database records: 538462


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\

Scan Statistics
Total number of scanned objects 52660
Number of viruses found 5
Number of infected objects 32
Number of suspicious objects 0
Duration of the scan process 02:55:23

Infected Object Name Virus Name Last Action
C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/103661937.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/103691210.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/103798524.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/118579688.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/118621498.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/14525116.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/14551644.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/14574246.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/29388959.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/29425431.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/44275414.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/44309283.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/59149272.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/59181568.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/59210059.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/678934105.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/678962486.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/74038071.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/74049767.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/74088052.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/88825263.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/88910186.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip/avenger/down/88933289.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008- 3.06.38,63.zip ZIP: infected - 23 skipped

C:\avenger\backup-30.01.2008-15.33.27,76.zip/avenger/hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.iv skipped

C:\avenger\backup-30.01.2008-15.33.27,76.zip/avenger/mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008-15.33.27,76.zip/avenger/srosa.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\avenger\backup-30.01.2008-15.33.27,76.zip/avenger/wintems.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup-30.01.2008-15.33.27,76.zip ZIP: infected - 4 skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\HPPAppActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\HPPHomePageActivity.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\LiveUpdate\2008-01-30_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\0022557A.tmp Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine\542001E8.jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\simone\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\simone\Dati applicazioni\Symantec\PendingAlertsQueue.log Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Temp\wz2e59\Tinnitus Masker Pro 5.exe Infected: Trojan-Downloader.Win32.Bagle.iv skipped

C:\Documents and Settings\simone\Impostazioni locali\Temp\~DF2994.tmp Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Temp\~DF29D9.tmp Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Temp\~DFCC87.tmp Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Temp\~DFCC92.tmp Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\simone\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\simone\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\simone\ntuser.dat.LOG Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDCON.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDFW.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped

C:\Programmi\File comuni\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped

C:\Programmi\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Programmi\Norton AntiVirus\AVError.log Object is locked skipped

C:\Programmi\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Programmi\Norton AntiVirus\Savrt\0029NAV~.TMP Object is locked skipped

C:\Programmi\Norton AntiVirus\Savrt\0774NAV~.TMP Object is locked skipped

C:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skipped

C:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skipped

C:\System Volume Information\catalog.wci\cicat.fid Object is locked skipped

C:\System Volume Information\catalog.wci\cicat.hsh Object is locked skipped

C:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skipped

C:\System Volume Information\catalog.wci\INDEX.000 Object is locked skipped

C:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skipped

C:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\avenger\backup-30.01.2008-15.33.27,76.zip
C:\avenger\backup-30.01.2008- 3.06.38,63.zip

Folders to delete:
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\simone\Impostazioni locali\Temp
C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.

[simonedd]

leggendo le istruzioni sul vostro articolo ero gia' riuscito ad istallare nuovamente l'antivirus (norton) il problema e' che norton nn rileva nessun virus. kaspersky invece li ha rilevati. ti ringrazio per lo script, l'ho eseguito ma dal log di avenger vedo che il cancellamento di alcuni file e' fallito. secondo te cosa devo fare? rifare una scansione con kaspersky?

questo e' il log di avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\halmcwya

*******************

Script file located at: \??\C:\Program Files\dglrhiav.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\srosa.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\srosa.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\srosa.sys
Status: 0xc0000034



File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\windows\system32\drivers\hldrrr.exe not found!
Deletion of file C:\windows\system32\drivers\hldrrr.exe failed!

Could not process line:
C:\windows\system32\drivers\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\mdelk.exe not found!
Deletion of file C:\WINDOWS\system32\mdelk.exe failed!

Could not process line:
C:\WINDOWS\system32\mdelk.exe
Status: 0xc0000034

File C:\avenger\backup-30.01.2008-15.33.27,76.zip deleted successfully.
File C:\avenger\backup-30.01.2008- 3.06.38,63.zip deleted successfully.


Folder C:\WINDOWS\system32\drivers\down not found!
Deletion of folder C:\WINDOWS\system32\drivers\down failed!

Could not process line:
C:\WINDOWS\system32\drivers\down
Status: 0xc0000034

Folder C:\Documents and Settings\simone\Impostazioni locali\Temp deleted successfully.
Folder C:\Documents and Settings\All Users\Dati applicazioni\Symantec\Norton AntiVirus\Quarantine deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[ste_95]

Reinstalla un antivirus.

Ripristina la modalità provvisoria utilizzando questo file.