Bagle, report Kaspersky

[Rob_]

salve a tutto, primo post qui
evito tutta la storiella sugli effetti del virus che ho beccato, tanto sono quelli e sono sicuro che sia un bagle..
ci combatto già da 2 giorni, il problema era anche avenger che non partiva (ho ovviato modificando il nome del file exe).
allora vi posto il report qui in allegato.

qualcuno darebbe un occhiata e mi sottoporrebbe uno script per avenger?
che poi quando ho provato a scriverne uno io mi ha dato uno strano errore, mah...

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Fatal error: could not create new script file.
Error code: 0
Error logged to errorlog.txt. Aborting now!

spero che sia stato un errore nella scrittura dello script...

grazie a tutti...

[ste_95]

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto

Files to delete:
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Folders to delete:
C:\WINDOWS\system32\drivers\down

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Riscarica gli installer dei programmi di sicurezza e prova a reinstallare un antivirus.

[Rob_]

questo l'avevo gia letto... e tutti gli altri file trovati da kaspersky?

[ste_95]

Sono "Object Locked Skipped", significa che sono usati da un altro processo, e che comunque non sono infetti.

[Rob_]

fatto.. c'è pure il trojan comunque.. che si fa con quello?

[ste_95]

Segui le mie istruzioni del post precedente.

[Rob_]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nkk^qqbm

*******************

Script file located at: \??\C:\WINDOWS\pfoly^jr.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.


File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.


File C:\WINDOWS\system32\mdelk.exe not found!
Deletion of file C:\WINDOWS\system32\mdelk.exe failed!

Could not process line:
C:\WINDOWS\system32\mdelk.exe
Status: 0xc0000034

File C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe deleted successfully.
Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

devo reinstallare norton? oppure prima faccio la prova a far epartire la modalità provvisoria (che non partiva più causa bagle)?

[ste_95]

Reinstalla un antivirus decente, come Avira Antivir e vedi se si installa correttamente.

[Rob_]

scaricato, installato.. ho dei problemi nell'update.. non riesco a farlo..

[Rob_]

che faccio? sto facendo una scansione, ma non ho aggiornato l'antivirus, non ci riesco perkè mi da un mex di errore.. però mi ha trovato un trojan..

[ste_95]

Dove rileva il trojan? Che errore restituisce all'aggiornamento?

[Rob_]

27.02.2008 18:27:38 - Installation Directory: C:\Programmi\Avira\AntiVir PersonalEdition Classic\
27.02.2008 18:27:38 - Backup Directory: C:\Documents and Settings\All Users\Dati applicazioni\Avira\AntiVir PersonalEdition Classic\BACKUP\
27.02.2008 18:27:38 - Temp Directory: C:\Documents and Settings\All Users\Dati applicazioni\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47c59d8a\
27.02.2008 18:27:38 - Start the Update GUI... Displaymode: 0

27.02.2008 18:27:38 - Installation Directory: C:\Programmi\Avira\AntiVir PersonalEdition Classic\
27.02.2008 18:27:38 - Backup Directory: C:\Documents and Settings\All Users\Dati applicazioni\Avira\AntiVir PersonalEdition Classic\BACKUP\
27.02.2008 18:27:38 - Temp Directory: C:\Documents and Settings\All Users\Dati applicazioni\Avira\AntiVir PersonalEdition Classic\Update\AVUPDATE_47c59d8a\
27.02.2008 18:27:38 - Start the Update GUI... Displaymode: 0

27.02.2008 18:27:40 - Keyfile: OK [FULL Mode]

27.02.2008 18:27:40 - Avira AntiVir PersonalEdition Classic

27.02.2008 18:27:42 - Connection failed while downloading the file http://dl5.avgate.net/upd/idx/master.idx.
27.02.2008 18:27:42 - Switching to next update server
27.02.2008 18:27:43 - Connection failed while downloading the file http://dl3.avgate.net/upd/idx/master.idx.
27.02.2008 18:27:43 - Switching to next update server
27.02.2008 18:27:43 - Connection failed while downloading the file http://dl6.avgate.net/upd/idx/master.idx.
27.02.2008 18:27:43 - Switching to next update server
27.02.2008 18:27:44 - Connection failed while downloading the file http://dl2.avgate.net/upd/idx/master.idx.
27.02.2008 18:27:44 - Switching to next update server
27.02.2008 18:27:50 - Registry entry created successfully: Software\Avira\AntiVir PersonalEdition Classic |UpdateInProgress

27.02.2008 18:27:50 - Critical error: Connection failed while downloading the file http://dl1.avgate.net/upd/idx/master.idx.


e, provandolo a fare al riavvio, mi dava un errore che parlava di "schedule" e roba simile. il Log che ho riportato comunque lo dà sia ora che prima..

il Trojan si trova nella cartella di backup di avenger, in c:\avenger.. è un file zip...
può essere interessante sapere anche che AntiVIr non ha alcuna connesisone a internet, non solo per l'aggiornamento..

finita la scansione darò dettagli sui trojan, anche perkè sono 2..

[Rob_]

riguardo ai due trojan

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\avenger\backup-27.02.2008-17.48.51,53.zip
[0] Archive type: ZIP
avenger/down/191361984.exe
[DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
avenger/srosa.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was deleted!


per il resto ancora la scansione non è finita..

[ste_95]

Elimina manualmente la cartella C:\Avenger.

[Rob_]

ecco il report finale:.

ntiVir PersonalEdition Classic
Report file date: mercoledì 27 febbraio 2008 17:49

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Peppe
Computer name: PEPPE-DXZWZP

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 17:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\programmi\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercoledì 27 febbraio 2008 17:49

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'LightScribeControlPanel.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'Reader_SL.exe' - '1' Module(s) have been scanned
Scan process 'kbd.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'ccSvcHst.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
29 processes with 29 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '37' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\avenger\backup-27.02.2008-17.48.51,53.zip
[0] Archive type: ZIP
avenger/down/191361984.exe
[DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
avenger/srosa.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[WARNING] The file could not be deleted!
C:\Documents and Settings\Peppe\Desktop\file da mettere su dvd\emule file scaricati\giochi\Tomb_Raider_-_Anniversary_Saved_Games.ace
[0] Archive type: ACE
Tomb Raider - Anniversary\Paul\Profile.TRAProfile
[WARNING] Error creating the file
Tomb Raider - Anniversary\Paul\Atlas.TRASave
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!


End of the scan: mercoledì 27 febbraio 2008 20:01
Used time: 2:11:46 min

The scan has been done completely.

10396 Scanning directories
587560 Files were scanned
2 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
587558 Files not concerned
5877 Archives were scanned
6 Warnings
6 Notes


Ste, aiutami tu

[Rob_]

ecco il report finale:.

ntiVir PersonalEdition Classic
Report file date: mercoledì 27 febbraio 2008 17:49

Scanning for 835736 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Peppe
Computer name: PEPPE-DXZWZP

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.1 2048 Bytes 13/09/2007 14:27:04
ANTIVIR3.VDF : 7.0.0.2 2048 Bytes 13/09/2007 14:27:13
AVEWIN32.DLL : 7.6.0.15 2806272 Bytes 17/09/2007 17:43:56
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\programmi\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: mercoledì 27 febbraio 2008 17:49

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'LightScribeControlPanel.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'Reader_SL.exe' - '1' Module(s) have been scanned
Scan process 'kbd.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'InCD.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'PIFSvc.exe' - '1' Module(s) have been scanned
Scan process 'ccSvcHst.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
29 processes with 29 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '37' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\avenger\backup-27.02.2008-17.48.51,53.zip
[0] Archive type: ZIP
avenger/down/191361984.exe
[DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
avenger/srosa.sys
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[WARNING] The file could not be deleted!
C:\Documents and Settings\Peppe\Desktop\file da mettere su dvd\emule file scaricati\giochi\Tomb_Raider_-_Anniversary_Saved_Games.ace
[0] Archive type: ACE
Tomb Raider - Anniversary\Paul\Profile.TRAProfile
[WARNING] Error creating the file
Tomb Raider - Anniversary\Paul\Atlas.TRASave
[WARNING] No further files can be extracted from this archive. The archive will be closed
[WARNING] No further files can be extracted from this archive. The archive will be closed
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!


End of the scan: mercoledì 27 febbraio 2008 20:01
Used time: 2:11:46 min

The scan has been done completely.

10396 Scanning directories
587560 Files were scanned
2 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
587558 Files not concerned
5877 Archives were scanned
6 Warnings
6 Notes


Ste, aiutami tu

[ste_95]

Elimina la cartella C:\Avenger.

[Rob_]

fatto... ora che si fa?

[ste_95]

Elimina anche questo file:

C:\Documents and Settings\Peppe\Desktop\file da mettere su dvd\emule file scaricati\giochi\Tomb_Raider_-_Anniversary_Saved_Games.ace

A questo punto i problemi dovrebbero essere svaniti.

[Rob_]

fatto... però ho notato che i programmi di sicurezza ancora non partono ("attenzione .... non è un applicazione win32 valida"), non ho visto se parte la modalità provvisoria...
che si fà?

ci credi se ti dico che mi sto stancando di sto bagle?? neanche quello della mia vicina (beagle) fa tutto sto casino...

ok, basta battute stupide...