www.MegaLab.it

da **grazioni2000** » ven mar 07, 2008 8:35 pm

ciao penso di avere virus nel mio pc perche perche non sono piu protetto da antivirus non si apre piu avast ho fatto scansione on line KASPERSKY ONLINE SCANNER REPORT
Friday, March 07, 2008 8:11:07 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 7/03/2008
Kaspersky Anti-Virus database records: 610492

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 76390
Number of viruses found 1
Number of infected objects 3
Number of suspicious objects 0
Duration of the scan process 02:26:00

Infected Object Name Virus Name Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\utente\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\utente\Dati applicazioni\Datalayer\354349008613054\CalendarDB\vcalDB.dta Object is locked skipped

C:\Documents and Settings\utente\Dati applicazioni\Datalayer\354349008613054\ContactsDB\vcardDB.dta Object is locked skipped

C:\Documents and Settings\utente\Dati applicazioni\Datalayer\354349008613054\notesDB\notesDB.dta Object is locked skipped

C:\Documents and Settings\utente\Dati applicazioni\Datalayer\354349008613054\SMSDB\smsDB.dta Object is locked skipped

C:\Documents and Settings\utente\Dati applicazioni\Datalayer\354564012052145\CalendarDB\vcalDB.dta Object is locked skipped

C:\Documents and Settings\utente\Dati applicazioni\Datalayer\354564012052145\ContactsDB\vcardDB.dta Object is locked skipped

C:\Documents and Settings\utente\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\utente\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\utente\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\utente\Impostazioni locali\Temp\NDLC6 Object is locked skipped

C:\Documents and Settings\utente\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\utente\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\utente\ntuser.dat Object is locked skipped

C:\Documents and Settings\utente\ntuser.dat.LOG Object is locked skipped

C:\Programmi\eMule\Temp\001.part Object is locked skipped

C:\Programmi\eMule\Temp\002.part Object is locked skipped

C:\Programmi\eMule\Temp\005.part Object is locked skipped

C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc164.exe Infected: Trojan-Downloader.Win32.Bagle.jh skipped

C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc165.zip/Banner Maker Pro for Flash 2.07 [Crack].exe Infected: Trojan-Downloader.Win32.Bagle.jh skipped

C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc165.zip ZIP: infected - 1 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{30D27D73-9852-49BE-BCB0-1D6F1F5BD8C1}\RP11\change.log Object is locked skipped

C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped

C:\WINDOWS\ModemLog_Nokia 6630 USB Modem.txt Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

da **ste_95** » ven mar 07, 2008 8:37 pm

Disabilita il ripristino configurazione di sistema.

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto: Files to delete: C:\WINDOWS\system32\drivers\hidr.exe C:\WINDOWS\system32\drivers\srosa.sys C:\WINDOWS\system32\wintems.exe C:\windows\system32\drivers\hldrrr.exe C:\WINDOWS\system32\mdelk.exe C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc164.exe C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc165.zip Folders to delete: C:\WINDOWS\system32\drivers\down Registry keys to delete: HKLM\SYSTEM\CurrentControlSet\Services\srosa HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Riscarica gli installer dei programmi di sicurezza e prova a reinstallare un antivirus.

da **grazioni2000** » sab mar 08, 2008 12:56 pm

ho eseguito la procedura ma quando scarico avenger mi dice "avenger.exe non e' un applicazione di win32 valida" quindi non posso andare avanti cosa faccio???

da **ste_95** » sab mar 08, 2008 12:57 pm

Prova a non estrarla e ad aprirla direttamente.

da **crazy.cat** » sab mar 08, 2008 1:08 pm

grazioni2000 ha scritto:ho eseguito la procedura ma quando scarico avenger mi dice "avenger.exe non e' un applicazione di win32 valida" quindi non posso andare avanti cosa faccio???

Usa questi
http://www.MegaLab.it/forum/viewtopic.p ... 172#325172

da **grazioni2000** » sab mar 08, 2008 1:37 pm

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:25:25 2008

13:25:25: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:37:07 2008

13:37:07: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

da **crazy.cat** » sab mar 08, 2008 1:40 pm

Se hai usato la nuova versione prendi quella vecchia di aveger

da **ste_95** » sab mar 08, 2008 1:40 pm

Incolla correttamente lo script:

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc164.exe
C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc165.zip

Folders to delete:
C:\WINDOWS\system32\drivers\down

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

da **grazioni2000** » sab mar 08, 2008 1:51 pm

Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:25:25 2008

13:25:25: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:37:07 2008

13:37:07: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:38:22 2008

13:38:22: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:41:50 2008

13:41:50: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:41:56 2008

13:41:56: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:51:03 2008

13:51:03: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:52:11 2008

13:52:11: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sat Mar 08 13:52:53 2008

13:52:53: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////non va!!!!!!!!!! lo sto copiando per intero

da **crazy.cat** » sab mar 08, 2008 1:56 pm

Quale versione di avenger stai usando?

grazioni2000 ha scritto:non va!!!!!!!!!! lo sto copiando per intero

da **grazioni2000** » sab mar 08, 2008 2:00 pm

sto usando la nuova versione e mi da messaggio di errore!! invece la vecchia non si apre mi da errore win 32 non valida!!!!!aiutami

da **ste_95** » sab mar 08, 2008 2:21 pm

Disabilita il ripristino configurazione di sistema.

Crea il MegaLabCD e fai il boot da quello all'avvio. Dopo che lo hai avviato apri il menù Start -> Gestione Risorse -> A43 Management. Elimina ora i seguenti file e cartelle dal disco C:\ come se fossi nel tuo computer:

C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\mdelk.exe
C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc164.exe
C:\RECYCLER\S-1-5-21-1708537768-113007714-1060284298-1004\Dc165.zip
C:\WINDOWS\system32\drivers\down

Miraccomando, non tralasciarne nessuno, altrimenti al riavvio sarai punto da capo!
NB: Alcuni file potrebbero non essere presenti.

Poi da Start -> Registro -> Remote Regedit e cancella le seguenti chiavi come se fossi all'interno del registro configurazione di Windows:

HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA

Torna in modalità normale e prova a installare un antivirus.

da **grazioni2000** » lun mar 10, 2008 3:23 pm

tutto ok !!!risolto !!!!!! grazie come sempre !!!

da **ste_95** » lun mar 10, 2008 3:25 pm

Ripristina anche la modalità provvisoria utilizzando questo file.

www.MegaLab.it

virus !!!!! aiuto

virus !!!!! aiuto

Chi c’è in linea