bagle for ever

[Jack_84]

Salve sono un nuovo utente di questa community! Mi associo alla richiesta di aiuto del post. Allego già il report di Kaspersky, con la speranza che mi aiutate a risolvere il problema
Ho letto e riletto le vostre guide, ma sono incapace di fare esattamente gli script: quindi per favore ditemi tutto passo passo.

KASPERSKY ONLINE SCANNER REPORT
Monday, February 18, 2008 8:23:35 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 18/02/2008
Kaspersky Anti-Virus database records: 570716


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
L:\

Scan Statistics
Total number of scanned objects 53184
Number of viruses found 10
Number of infected objects 38
Number of suspicious objects 0
Duration of the scan process 01:09:11

Infected Object Name Virus Name Last Action
C:\avenger\backup.zip/avenger/down/44375.exe Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\avenger\backup.zip/avenger/down/47781.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/48812.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/49156.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup.zip/avenger/down/50671.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/50984.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/51312.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup.zip/avenger/down/54109.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/55796.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/55953.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/57656.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/58171.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/58578.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/58687.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/58953.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/60187.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/62750.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/66265.exe Infected: Trojan.Win32.Pakes.bwy skipped

C:\avenger\backup.zip/avenger/down/69156.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/70796.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/78000.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/84781.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/down/85328.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

C:\avenger\backup.zip/avenger/down/90656.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.jw skipped

C:\avenger\backup.zip/avenger/mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip/avenger/wintems.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\avenger\backup.zip ZIP: infected - 27 skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Dati applicazioni\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\Ficco\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Ficco\Dati applicazioni\Microsoft\Templates\Normal.dotm Object is locked skipped

C:\Documents and Settings\Ficco\Desktop\Tecniche Avanzate.docx Object is locked skipped

C:\Documents and Settings\Ficco\Documenti\File ricevuti\Serv-U.rar/Serv-U/ServUAdmin.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.5201 skipped

C:\Documents and Settings\Ficco\Documenti\File ricevuti\Serv-U.rar/Serv-U/ServUDaemon.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.gen skipped

C:\Documents and Settings\Ficco\Documenti\File ricevuti\Serv-U.rar/Serv-U/ServUTray.exe Infected: not-a-virus:Server-FTP.Win32.Serv-U.5201 skipped

C:\Documents and Settings\Ficco\Documenti\File ricevuti\Serv-U.rar RAR: infected - 3 skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Cronologia\History.IE5\MSHist012008021820080219\index.dat Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Dati applicazioni\Ahead\Nero Home\bl.db Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Dati applicazioni\Ahead\Nero Home\is2.db Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temp\Free Download Manager\ticA.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temp\Free Download Manager\ticB.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temp\~DF6A74.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temp\~DFF880.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.MSO\mso18.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.MSO\mso19.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.MSO\mso1D.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.MSO\mso1E.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.MSO\mso1F.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.MSO\mso9.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.Word\~WRF{584E944A-6E86-40E6-8520-C47AD3997295}.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{1B035916-98C2-4789-9C0D-F9DD6953C6E1}.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{36FEC1BE-B093-4ABC-B285-8769D55A3800}.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{9112DC91-0B4F-4B3C-BDB9-345D305F5E96}.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{E6BAC090-58B9-45BF-A3A1-3854B6C02FBA}.tmp Object is locked skipped

C:\Documents and Settings\Ficco\Impostazioni locali\Temporary Internet Files\Content.Word\~WRS{EDB5ACD9-E37E-47B4-94E5-C65F5DBE4D35}.tmp Object is locked skipped

C:\Documents and Settings\Ficco\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Ficco\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\PeerGuardian2\history.db Object is locked skipped

C:\Programmi\WebMediaPlayer\uninst.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.NaviPromo.cc skipped

C:\Programmi\WebMediaPlayer\uninst.exe/stream Infected: not-a-virus:AdWare.Win32.NaviPromo.cc skipped

C:\Programmi\WebMediaPlayer\uninst.exe NSIS: infected - 2 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\BACKINF.TAB Infected: Worm.Win32.AutoRun.sb skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Session.exe Infected: Trojan.Win32.VB.atg skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\FileKan.exe Infected: Trojan.Win32.VB.atg skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

Scan process completed.


Attendo vostre risposte, che mi aiutino anche a risparmiare qualche oldino da regalare al tecnico! Grazie per l'aiuo! A presto!

[ste_95]

@ Jack_84

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\avenger\backup.zip
C:\WINDOWS\BACKINF.TAB
C:\WINDOWS\Session.exe
C:\WINDOWS\system32\FileKan.exe

Folders to delete:
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\Ficco\Impostazioni locali\Temp

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Riscarica gli installer dei programmi di sicurezza e prova a reinstallare un antivirus.

[Jack_84]

Grazie mille, grazie alle indicazioni descritte sono riuscito a risolvere il problema! Vi sono molto grato!
Spero un giorno di poter aiutare anche io qualcuno! A presto!

[ste_95]

Ripristina anche la modalità provvisoria utilizzando questo file.