da bunkka » dom mar 16, 2008 11:54 am
ecco il log:
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\bsyiagcq
*******************
Script file located at: \??\C:\WINDOWS\mdqovrts.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!
Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034
File C:\WINDOWS\system32\drivers\srosa.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\srosa.sys failed!
Could not process line:
C:\WINDOWS\system32\drivers\srosa.sys
Status: 0xc0000034
File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!
Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034
File C:\windows\system32\drivers\hldrrr.exe not found!
Deletion of file C:\windows\system32\drivers\hldrrr.exe failed!
Could not process line:
C:\windows\system32\drivers\hldrrr.exe
Status: 0xc0000034
File C:\WINDOWS\system32\mdelk.exe not found!
Deletion of file C:\WINDOWS\system32\mdelk.exe failed!
Could not process line:
C:\WINDOWS\system32\mdelk.exe
Status: 0xc0000034
File C:\avenger\backup-15.03.2008-23.56.35,07.zip deleted successfully.
File C:\Config.Msi\4a24b.rbf not found!
Deletion of file C:\Config.Msi\4a24b.rbf failed!
Could not process line:
C:\Config.Msi\4a24b.rbf
Status: 0xc0000034
File C:\Documents and Settings\Nello.NELLOPC\Impostazioni locali\Temp\svh0st.exe not found!
Deletion of file C:\Documents and Settings\Nello.NELLOPC\Impostazioni locali\Temp\svh0st.exe failed!
Could not process line:
C:\Documents and Settings\Nello.NELLOPC\Impostazioni locali\Temp\svh0st.exe
Status: 0xc0000034
File C:\dpiw5h.exe not found!
Deletion of file C:\dpiw5h.exe failed!
Could not process line:
C:\dpiw5h.exe
Status: 0xc0000034
File C:\Programmi\File comuni\Wise Installation Wizard\WIS5581E9FD99CD4BCBB9A90BCA5ACC32F4_5_1_4_0.MSI not found!
Deletion of file C:\Programmi\File comuni\Wise Installation Wizard\WIS5581E9FD99CD4BCBB9A90BCA5ACC32F4_5_1_4_0.MSI failed!
Could not process line:
C:\Programmi\File comuni\Wise Installation Wizard\WIS5581E9FD99CD4BCBB9A90BCA5ACC32F4_5_1_4_0.MSI
Status: 0xc0000034
File C:\WINDOWS\system32\Cuteqq_Cn.exe not found!
Deletion of file C:\WINDOWS\system32\Cuteqq_Cn.exe failed!
Could not process line:
C:\WINDOWS\system32\Cuteqq_Cn.exe
Status: 0xc0000034
File C:\wsusupd.exe not found!
Deletion of file C:\wsusupd.exe failed!
Could not process line:
C:\wsusupd.exe
Status: 0xc0000034
Folder C:\WINDOWS\system32\drivers\down not found!
Deletion of folder C:\WINDOWS\system32\drivers\down failed!
Could not process line:
C:\WINDOWS\system32\drivers\down
Status: 0xc0000034
Folder C:\qoobox not found!
Deletion of folder C:\qoobox failed!
Could not process line:
C:\qoobox
Status: 0xc0000034
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa failed!
Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
Status: 0xc0000034
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA failed!
Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Status: 0xc0000034
Completed script processing.
*******************
Finished! Terminate.
il problema persiste. Al riavvio mi si apre la schermata di nod32 senza che accada nulla, o meglio mi da "errore di comunicazione con il server kernel" (ovviamente cercando nel pc il programma non risulta installato). Premesso che avevo erroneamente (seguendo comunque le vostre istruzioni) provato da solo ad eliminare la minaccia, con conseguente installazione antivirus andata male, e premesso che con sono riuscito a spuntare SCAN FOR ROOTKITS perché non ho capito dove trovarlo(ho avenger versione MegaLab scaricato dal vostro forum), come posso risolvere il problema?
helpppppppppppppppppppppppppp!!!!!!!!!!!!!!!!!!!!!!!!!!!!!