Punto informatico Network
Login Esegui login | Non sei registrato? Iscriviti ora (è gratuito!)
Username: Password:
  • Annuncio Pubblicitario

maledetto bagle!!!

Un virus si è intromesso nel tuo computer? Vuoi navigare in tutta sicurezza? Sono sicure le transazione online? Come impedire a malintenzionati di intromettersi nel tuo pc? Come proteggere i tuoi dati? Qui trovi le risposte a queste ed altre domande

maledetto bagle!!!

Messaggioda angelo72 » mar gen 22, 2008 7:48 pm

Salve, da un paio di giorni sono alle prese con Bagle ed affini.
Non riesco ad installare alcun antivirus nè ad entrare in modalità provvisoria. Prima di formattare volevo sapere se c'è qualche speranza.
Avevo installato Nod32

questa à la scansione con kaspersky:

KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 22, 2008 6:16:29 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 21/01/2008
Kaspersky Anti-Virus database records: 525932


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\

Scan Statistics
Total number of scanned objects 34267
Number of viruses found 4
Number of infected objects 29
Number of suspicious objects 0
Duration of the scan process 13:43:48

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\angelodesalvo\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Cronologia\History.IE5\MSHist012008012120080122\index.dat Object is locked skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\54ONJFM8\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\54ONJFM8\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\54ONJFM8\b64_31[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\54ONJFM8\b64_31[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\8ISBL45O\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\8ISBL45O\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\8ISBL45O\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\91U4UR4H\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\91U4UR4H\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\NJBCDNFP\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\NJBCDNFP\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\NJBCDNFP\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\angelodesalvo\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\angelodesalvo\NTUSER.DAT.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\21cn\VGO\VGOIEBHO.dll Infected: not-a-virus:AdWare.Win32.BHO.ed skipped

C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater\Eset.Nod32.Antivirus.Username.Password.Updater.exe Infected: Trojan-Downloader.Win32.Bagle.ik skipped

C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater\Eset.Nod32.Antivirus.Username.Password.Updater.rar/Eset.Nod32.Antivirus.Username.Password.Updater.exe Infected: Trojan-Downloader.Win32.Bagle.ik skipped

C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater\Eset.Nod32.Antivirus.Username.Password.Updater.rar RAR: infected - 1 skipped

C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater.zip/Eset.Nod32.Antivirus.Username.Password.Updater.exe Infected: Trojan-Downloader.Win32.Bagle.ik skipped

C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater.zip ZIP: infected - 1 skipped

C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe Infected: Trojan-Downloader.Win32.Bagle.ik skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\dllcache\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\system32\wintems_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\106783_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\116968_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\127753_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\178456_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\843613_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\95407_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\99783_exe.vir Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\Temp\ASHeuristic\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

Scan process completed.




Grazie in anticipo e comunque vada
Avatar utente
angelo72
Neo Iscritto
Neo Iscritto
 
Messaggi: 2
Iscritto il: mar gen 22, 2008 7:33 pm

Messaggioda ste_95 » mar gen 22, 2008 8:26 pm

[ciao]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\WINDOWS\system32\mdelk.exe
C:\Programmi\21cn\VGO\VGOIEBHO.dll
C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater.zip
C:\Programmi\Java\jre1.5.0_03\bin\jusched.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\WINDOWS\Temp
C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\54ONJFM8
C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\8ISBL45O
C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\91U4UR4H
C:\Documents and Settings\angelodesalvo\Impostazioni locali\Temporary Internet Files\Content.IE5\NJBCDNFP
C:\Programmi\eMule\Incoming\Eset.Nod32.Antivirus.Username.Password.Updater


registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32


Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Messaggioda angelo72 » gio gen 24, 2008 6:24 pm

grazie mille ho risolto il problema. sei grande.

P.S. Scusa il ritardo ma non ci sono stato.
Avatar utente
angelo72
Neo Iscritto
Neo Iscritto
 
Messaggi: 2
Iscritto il: mar gen 22, 2008 7:33 pm


Messaggioda Gianluk » ven feb 01, 2008 4:29 pm

Salve innanzitutto mi presento sono Gianluca e anche io ho preso un maledetto bagle da emule...mi sembrava inutile aprire un nuovo topic tanto a quanto vedo c'è 1 epidemia [V] ...inoltre mi risulta impossibile allegare file perché all'atto di caricarli mi si blocca tutto, xciò posto tal quale la scansione di kaspersky...ora devo solo capire cosa inserire in avenger...p.S:disattivo il ripristino configurazione sistema giusto? grazie in antivipo x la risposta...

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.134.Crwl Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.134.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010001.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010003.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010004.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010005.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010006.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010007.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010009.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000A.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000B.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000C.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000D.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000E.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001000F.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010010.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010011.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010015.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010019.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001A.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010023.ci Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010023.wid Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010023.wsb Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Crwl244.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Crwl245.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy161.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy162.gthr Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Temp\usgthrsvc\Ntf1.tmp Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Temp\usgthrsvc\Ntf2.tmp Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_784.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Desktop\avenger.exe Object is locked skipped

C:\Documents and Settings\Gianlukino\Desktop\LingvoSoft Talking Dictionary 2007 English - Japanese Kanji Romaji 4.0.22.zip/LingvoSoft Talking Dictionary 2007 English - Japanese Kanji Romaji 4.0.22.exe Infected: Trojan-Downloader.Win32.Bagle.iv skipped

C:\Documents and Settings\Gianlukino\Desktop\LingvoSoft Talking Dictionary 2007 English - Japanese Kanji Romaji 4.0.22.zip ZIP: infected - 1 skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Cronologia\History.IE5\MSHist012008020120080202\index.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Dati applicazioni\Microsoft\Desktop Search\Logs\OTFSMonLog.txt Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temp\~DF6EF5.tmp Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temp\~DF6F02.tmp Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\6IRFGINE\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\6IRFGINE\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\6IRFGINE\b64_31[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\A66600GO\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\B86A4JSN\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\B86A4JSN\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\B86A4JSN\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\B86A4JSN\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\ZD62F0A9\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\ZD62F0A9\b64_1[2].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\ZD62F0A9\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\ZD62F0A9\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\Gianlukino\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Gianlukino\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Gianlukino\UserData\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\eMule\Temp\001.part/LingvoSoft.Talking.Dictionary.2007.English.Japanese.Romaji.Kanji.v4.0.22.WinALL-CHiCNCREAM/LD2007.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped

C:\Programmi\eMule\Temp\001.part/LingvoSoft.Talking.Dictionary.2007.English.Japanese.Romaji.Kanji.v4.0.22.WinALL-CHiCNCREAM/lingvosoft-dictionary-wind-engjpn(romo-kanji)-t.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped

C:\Programmi\eMule\Temp\001.part RAR: infected - 2 skipped

C:\Programmi\File comuni\System\com1.exe Object is locked skipped

C:\Programmi\Toshiba\TOSCDSPD\TOSCDSPD.exe Infected: Trojan-Downloader.Win32.Bagle.iv skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0074945.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0074946.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0074954.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0074979.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0074988.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0074989.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0075010.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0075011.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0075058.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0075077.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0075086.exe Infected: Trojan-Downloader.Win32.Bagle.iv skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0075097.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0076099.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP412\A0076100.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076156.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076171.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076172.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076173.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076184.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076201.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076209.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP413\A0076210.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076417.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076419.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076444.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076445.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076557.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076561.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076572.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0076573.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0077572.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0077574.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0078572.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0078574.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0078777.sys Infected: Trojan-Downloader.Win32.Bagle.iu skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\A0078778.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\System Volume Information\_restore{B5D84D74-1FE7-4DBF-89BF-34A77346AF82}\RP416\change.log Object is locked skipped

C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\dllcache\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\ddgj1.exe Infected: Trojan.Win32.Agent.xj skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log
Avatar utente
Gianluk
Neo Iscritto
Neo Iscritto
 
Messaggi: 2
Iscritto il: ven feb 01, 2008 3:52 pm

Messaggioda ste_95 » ven feb 01, 2008 4:51 pm

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\Documents and Settings\Gianlukino\Desktop\LingvoSoft Talking Dictionary 2007 English - Japanese Kanji Romaji 4.0.22.zip
C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\A66600GO\b64_1[1].jpg
C:\Programmi\eMule\Temp\001.part
C:\Programmi\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\WINDOWS\Temp\ddgj1.exe

Folders to delete:
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\6IRFGINE
C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\B86A4JSN
C:\Documents and Settings\Gianlukino\Impostazioni locali\Temporary Internet Files\Content.IE5\ZD62F0A9

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA


Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am

Messaggioda Gianluk » ven feb 01, 2008 5:17 pm

grazie mille l'antivirus ora mi parte...sei un grande!
Avatar utente
Gianluk
Neo Iscritto
Neo Iscritto
 
Messaggi: 2
Iscritto il: ven feb 01, 2008 3:52 pm

Messaggioda ste_95 » ven feb 01, 2008 5:37 pm

Ripristina la modalità provvisoria utilizzando questo file.
«A volte è meglio tacere e sembrare stupidi che aprir bocca e togliere ogni dubbio.» Oscar Wilde
Avatar utente
ste_95
Membro Ufficiale (Gold)
Membro Ufficiale (Gold)
 
Messaggi: 17271
Iscritto il: lun ago 06, 2007 11:19 am


Torna a Sicurezza

Chi c’è in linea

Visitano il forum: Nessuno e 7 ospiti

Powered by phpBB © 2002, 2005, 2007, 2008 phpBB Group
Traduzione Italiana phpBB.it

megalab.it: testata telematica quotidiana registrata al Tribunale di Cosenza n. 22/09 del 13.08.2009, editore Master New Media S.r.l.; © Copyright 2008 Master New Media S.r.l. a socio unico - P.I. 02947530784. GRUPPO EDIZIONI MASTER Spa Tutti i diritti sono riservati. Per la pubblicità: Master Advertising