virus bagle

[elmito]

ciao a tutti mi sono beccato un bable ( nn so che versione) so solo che non mi fa andare avenger hijackthis l'antivirus e ogli volta che cerco di installere una cosa mi esce come errore win32 non valica io posto delle scansioni che ho fatto non so quanto siano utili grazie mille

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, February 02, 2008 8:21:04 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/02/2008
Kaspersky Anti-Virus database records: 507291
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\

Scan Statistics:
Total number of scanned objects: 58425
Number of viruses found: 5
Number of infected objects: 17
Number of suspicious objects: 0
Duration of the scan process: 05:03:39

Infected Object Name / Virus Name / Last Action
C:\.Trash-luca\MountPointManagerRemoteDatabase Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\luca\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\cert8.db Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\history.dat Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\key3.db Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\parent.lock Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\search.sqlite Object is locked skipped
C:\Documents and Settings\luca\Dati applicazioni\Mozilla\Firefox\Profiles\r2ptrpvn.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\luca\Documenti\Le mie Conversazioni\febbraio 2008\abionda@live.it.html Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Messenger\luca120@hotmail.it\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Messenger\luca120@hotmail.it\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Messenger\luca120@hotmail.it\SharingMetadata\Working\database_2C14_4B67_144B_32DE\dfsr.db Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Messenger\luca120@hotmail.it\SharingMetadata\Working\database_2C14_4B67_144B_32DE\fsr.log Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Messenger\luca120@hotmail.it\SharingMetadata\Working\database_2C14_4B67_144B_32DE\fsrtmp.log Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Messenger\luca120@hotmail.it\SharingMetadata\Working\database_2C14_4B67_144B_32DE\tmp.edb Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\luca120@hotmail.it\real\members.stg Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\luca120@hotmail.it\shadow\members.stg Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temp\~DF5DC5.tmp Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temp\~DF5DF0.tmp Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temp\~DFDBA5.tmp Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temp\~DFDBB1.tmp Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\24HXW2EK\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\24HXW2EK\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\3MF49UZL\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\3MF49UZL\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\3MF49UZL\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\3MF49UZL\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\D0OYJMZ0\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\D0OYJMZ0\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\D0OYJMZ0\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\GIHTAJGO\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\GIHTAJGO\b64_31[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\TDBKZUBB\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\TDBKZUBB\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped
C:\Documents and Settings\luca\Menu Avvio\Programmi\filmati\flin4pay No serial(crack).zip/setup.exe Infected: Backdoor.Win32.Agent.aou skipped
C:\Documents and Settings\luca\Menu Avvio\Programmi\filmati\flin4pay No serial(crack).zip ZIP: infected - 1 skipped
C:\Documents and Settings\luca\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\luca\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Programmi\Labtec\Mouse\2.1\moffice.exe Infected: Trojan-Downloader.Win32.Bagle.iw skipped
C:\Programmi\Nero\Nero8\Nero BackItUp\BIU5.txt Object is locked skipped
C:\Programmi\RSSoft\redswoosh.log Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped

Scan process completed.

[ste_95]

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\TDBKZUBB\b64_31[1].jpg
C:\Documents and Settings\luca\Menu Avvio\Programmi\filmati\flin4pay No serial(crack).zip
C:\Programmi\Labtec\Mouse\2.1\moffice.exe

Folders to delete:
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\luca\Impostazioni locali\Temp
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\24HXW2EK
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\3MF49UZL
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\D0OYJMZ0
C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\GIHTAJGO\

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.

[elmito]

grazie per avermi risposto ecco il log

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nuq^yqig

*******************

Script file located at: \??\C:\Program Files\wkugpxkl.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at c:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.
File C:\windows\system32\drivers\hldrrr.exe deleted successfully.
File C:\WINDOWS\system32\mdelk.exe deleted successfully.
File C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\TDBKZUBB\b64_31[1].jpg deleted successfully.


File C:\Documents and Settings\luca\Menu Avvio\Programmi\filmati\flin4pay No serial(crack).zip not found!
Deletion of file C:\Documents and Settings\luca\Menu Avvio\Programmi\filmati\flin4pay No serial(crack).zip failed!

Could not process line:
C:\Documents and Settings\luca\Menu Avvio\Programmi\filmati\flin4pay No serial(crack).zip
Status: 0xc0000034

File C:\Programmi\Labtec\Mouse\2.1\moffice.exe deleted successfully.
Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Folder C:\Documents and Settings\luca\Impostazioni locali\Temp deleted successfully.
Folder C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\24HXW2EK deleted successfully.
Folder C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\3MF49UZL deleted successfully.
Folder C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\D0OYJMZ0 deleted successfully.
Folder C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\GIHTAJGO deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

il problema rimane comunque mi dice win32 non valda

[ste_95]

Devi riscaricare gli installer dei programmi di sicurezza, poiché il trojan li ha corrotti e resi inutilizzabili.

Ripristina la modalità provvisoria utilizzando questo file.

[elmito]

a oki grazie mille per l'aiuto

[ste_95]

Se ancora dovessi avere problemi, non esitare a postare

[elmito]

grassie mille adex funziona tutto

[elmito]

dopo aver disattivato il ripristino configurazione mi è tornto di nuovo l'errore win32

[ste_95]

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\avenger\backup.zip
H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh10.zip
H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh9.exe

Folders to delete:
C:\WINDOWS\system32\drivers\down

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Ora, se tutto è andato a buon fine, dovresti riuscire a reinstallare un valido antivirus.

[elmito]

io come antivirus ho antivir aia tempi era buono penso che lo sia ancora adesso no?

[ste_95]

Si, è tra i migliori

[elmito]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\bngswkpn

*******************

Script file located at: \??\C:\WINDOWS\system32\jcxqheji.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\srosa.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\srosa.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\srosa.sys
Status: 0xc0000034



File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\windows\system32\drivers\hldrrr.exe not found!
Deletion of file C:\windows\system32\drivers\hldrrr.exe failed!

Could not process line:
C:\windows\system32\drivers\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\mdelk.exe not found!
Deletion of file C:\WINDOWS\system32\mdelk.exe failed!

Could not process line:
C:\WINDOWS\system32\mdelk.exe
Status: 0xc0000034

File C:\avenger\backup.zip deleted successfully.


Could not open file H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh10.zip for deletion
Deletion of file H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh10.zip failed!

Could not process line:
H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh10.zip
Status: 0xc000003a



Could not open file H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh9.exe for deletion
Deletion of file H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh9.exe failed!

Could not process line:
H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh9.exe
Status: 0xc000003a



Folder C:\WINDOWS\system32\drivers\down not found!
Deletion of folder C:\WINDOWS\system32\drivers\down failed!

Could not process line:
C:\WINDOWS\system32\drivers\down
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

leggedo mi sa che non è andato a buon fine

[ste_95]

Elimina manualmente questi file:

H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh10.zip
H:\.Trash-luca\S-1-5-21-1229272821-688789844-725345543-1003\Dh9.exe

Sei proprio sicuro di non riuscire a installare nessun antivirus?

[elmito]

questa cartella .Trash-luca si crea ogni volta che uso linux (ubuntu) non è che me li ricrea lui i virus?

[ste_95]

No, non credo. Li avrà creati il virus all'interno della cartella.

[elmito]

il problema che l'errore win32 rimane anche se disistallo e reinstallo l'antivirus

[ste_95]

Devi riscaricare l'installer dei programmi di sicurezza, perché il virus li ha corrotti rendendoli inutilizzabili...

[elmito]

uff dinuovo tuttooo nooo ok rivaro il tutto grazie mille ancora