I problemi che ho notato sono i seguenti: costante uso della cpu al 50/60% (se utilizzo qualche applicazione sale al 100% e sta fissa!), scomparsa dei file nascosti (non è nemmeno possibile andare su impostazioni cartella -> visualizza file nascosti, in quanto non esiste più questa voce!), ovviamente l'antivirus non mi si avvia più, nè l'antispyware.. lo stesso vale se provo a reinstallarli o installarne di altri.. non si avvia nulla. Ho provato a seguire varie guide qui e lì, ma non ho risolto il problema in quanto spesso non riesco ad esempio ad eliminare alcune voci dal registro di sistema, oppure non le trovo affatto. Il programma Avenger non riesco ad eseguirlo in quanto mi esce fuori un messaggio dove dice che non è un'applicazione di win32 valida. Ho fatto le scansioni online con Panda e Kaspersky. Ecco i log:
Log di panda:
Incidente Stato Percorso
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@atdmt[2].txt
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@atwola[1].txt
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@bs.serving-sys[2].txt
Spyware:Cookie/Com.com Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@com[1].txt
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@doubleclick[2].txt
Spyware:Cookie/Mediaplex Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@mediaplex[1].txt
Spyware:Cookie/Overture Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@overture[1].txt
Spyware:Cookie/Searchportal Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@searchportal.information[1].txt
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@serving-sys[2].txt
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@tradedoubler[2].txt
Spyware:Cookie/Tribalfusion Non Disinfettato C:\Documents and Settings\j4ck86\Cookies\j4ck86@tribalfusion[1].txt
Spyware:Cookie/Weborama Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Tradedoubler Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Xiti Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Doubleclick Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Atwola Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Advertising Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Adtech Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Hitbox Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Overture Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.overture.com/]
Spyware:Cookie/QuestionMarket Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Atlas DMT Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/adultfriendfinder Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/YieldManager Non Disinfettato C:\Documents and Settings\j4ck86\Dati applicazioni\Mozilla\Firefox\Profiles\52mmis2d.default\cookies.txt[ad.yieldmanager.com/]
Virus:W32/Bagle.RP.worm Disinfettato C:\WINDOWS\system32\drivers\srosa.sys
Log di Kaspersky:
KASPERSKY ONLINE SCANNER REPORT
Saturday, April 05, 2008 1:38:31 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 5/04/2008
Kaspersky Anti-Virus database records: 683559
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
G:\
Scan Statistics
Total number of scanned objects 29849
Number of viruses found 4
Number of infected objects 16
Number of suspicious objects 0
Duration of the scan process 02:52:32
Infected Object Name Virus Name Last Action
C:\Documents and Settings\j4ck86\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\mirc631.exe/stream/data0001/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\mirc631.exe/stream/data0001/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\mirc631.exe/stream/data0001 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\mirc631.exe NSIS: infected - 4 skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\Nero-8.3.2.1_ita_trial.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Documents and Settings\j4ck86\Desktop\sw\installati\Nero-8.3.2.1_ita_trial.exe 7-Zip: infected - 1 skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Cronologia\History.IE5\MSHist012008040520080406\index.dat Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\j4ck86@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\j4ck86@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\mirc631.exe/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\mirc631.exe NSIS: infected - 2 skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\NERO14777\Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\~DF430E.tmp Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\~DF43AB.tmp Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\~DF4BC5.tmp Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temp\~DF4C43.tmp Object is locked skipped
C:\Documents and Settings\j4ck86\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\j4ck86\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\j4ck86\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\j4ck86\mIRC\logs\#j4ck86.IRCnet.log Object is locked skipped
C:\j4ck86\mIRC\logs\#thebest.IRCnet.log Object is locked skipped
C:\j4ck86\mIRC\logs\DaRk_L4dY.IRCnet.log Object is locked skipped
C:\j4ck86\mIRC\logs\status.IRCnet.log Object is locked skipped
C:\j4ck86\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
C:\j4ck86\Programmi\RealVNC\WinVNC\othread2.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\j4ck86\Programmi\RealVNC\WinVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\j4ck86\Programmi\RealVNC\WinVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c skipped
C:\Programmi\File comuni\Nero\Lib\NeroCheck.exe Infected: Trojan-Downloader.Win32.Bagle.mn skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
Scan process completed.
Spero che riusciate ad aiutarmi in quanto vorrei non dover formattare (l'ho fatto 2 settimane fa!) Grazie! :)