www.MegaLab.it

da **Kron** » sab giu 28, 2008 1:10 pm

Salve a tutti, ho un problema da ieri sera Avast mi segnala continuamente la presenza di un virus di nome Bagle (che spunta anche sotto diversi nomi : hdlrrr.exe,srosa.exe ecc )
ho provato a fare un controllo con HijackThis e dopo aver cancellato i file spuntano continuamente.
Ho usato anche CCleaner e Spyware Doctor,ma nulla!
Ho cercato di fare una scansione on line con Kaspersky ma mi da degli errori e non mi fa procedere con la scansione!
Cos'altro posso fare? [8)]

Grazie in anticipo

da **KILLERQUEEN87** » sab giu 28, 2008 1:22 pm

Kron ha scritto:Salve a tutti, ho un problema da ieri sera Avast mi segnala continuamente la presenza di un virus di nome Bagle (che spunta anche sotto diversi nomi : hdlrrr.exe,srosa.exe ecc )
ho provato a fare un controllo con HijackThis e dopo aver cancellato i file spuntano continuamente.
Ho usato anche CCleaner e Spyware Doctor,ma nulla!
Ho cercato di fare una scansione on line con Kaspersky ma mi da degli errori e non mi fa procedere con la scansione!
Cos'altro posso fare?

Grazie in anticipo

guarda anche io ci sono passato scaricati HijackThis, poi posta il log che si creera' alla fine della scansione e postalo nel forum, poi il supporto ti dirà come procedere [^]

da **ste_95** » sab giu 28, 2008 1:54 pm

Quali sono gli errori che Kaspersky rilascia?

da **Kron** » sab giu 28, 2008 2:14 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:19, on 2008-06-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\CyberLink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\internet explorer\iexplore.exe
C:\Programmi\Internet Explorer\IEXPLORE.EXE
C:\Programmi\eMule\Incoming\Pastry Passion Deluxe\pastrypassion.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmi\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b56986.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 5999597375
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b56986.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programmi\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programmi\CyberLink\Shared files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe

--
End of file - 7066 bytes

ecco il log! grazie delle risposte [:)]

da **Kron** » sab giu 28, 2008 2:16 pm

ste_95 ha scritto:Quali sono gli errori che Kaspersky rilascia?

adesso la scansione on line di Kaspersky funziona! [uhm]

da **ste_95** » sab giu 28, 2008 2:16 pm

HijackThis è inutile.

ste_95 ha scritto:Quali sono gli errori che Kaspersky rilascia?

da **Kron** » sab giu 28, 2008 2:21 pm

ste_95 ha scritto:HijackThis è inutile.

ste_95 ha scritto:Quali sono gli errori che Kaspersky rilascia?

Adesso sto facendo la scansione con Kaspersky on line!

da **Kron** » sab giu 28, 2008 6:11 pm

C:\Avenger\downld\113843.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\Avenger\downld\1170609.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\1194515.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\131343.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\Avenger\downld\147843.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\1530328.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\154609.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\33558125.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\33903015.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\34173062.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\34191234.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\Avenger\downld\34305593.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\34431921.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\34616296.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\Avenger\downld\35059546.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\35153687.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\35248031.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\35319187.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\35540593.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\35572437.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\Avenger\downld\3607031.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\3690171.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\528468.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\569640.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\700343.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\788843.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\85590218.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\86888062.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\87546156.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\87627546.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\downld\909812.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\Avenger\hldrrr.exe Infected: Trojan-Downloader.Win32.Bagle.ta 1

C:\Avenger\mdelk.exe Infected: Trojan-Downloader.Win32.Bagle.ta 1

C:\Documents and Settings\Cri.FORMATTINO\Dati applicazioni\m\flec006.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\Programmi\Alwil Software\Avast4\DATA\moved\87703.exe Infected: Email-Worm.Win32.Bagle.vr 1

C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Infected: Trojan-Downloader.Win32.Bagle.ta 1

C:\Programmi\mIRC\backups\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1

C:\Programmi\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1

C:\WINDOWS\system32\drivers\downld\334390.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\WINDOWS\system32\drivers\downld\3641625.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\WINDOWS\system32\drivers\downld\590562.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\WINDOWS\system32\drivers\downld\815765.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\WINDOWS\system32\drivers\downld\879640.exe Infected: Backdoor.Win32.Hupigon.cjai 1

C:\WINDOWS\system32\drivers\downld\897703.exe Infected: Email-Worm.Win32.Bagle.of 1

C:\WINDOWS\system32\drivers\downld\91437.exe Infected: Backdoor.Win32.Hupigon.cjai 1

da **ste_95** » sab giu 28, 2008 8:45 pm

Questo è il tuo script:

Codice: Seleziona tutto: Files to delete: C:\WINDOWS\System32\drivers\hldrrr.exe C:\WINDOWS\System32\drivers\mdelk.exe C:\WINDOWS\System32\drivers\srosa.sys C:\WINDOWS\System32\hldrrr.exe C:\WINDOWS\System32\mdelk.exe C:\WINDOWS\System32\wintems.exe C:\Avenger\hldrrr.exe C:\Avenger\mdelk.exe C:\Avenger\srosa.sys C:\Programmi\Alwil Software\Avast4\DATA\moved\87703.exe C:\Programmi\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Folders to delete: C:\Documents and Settings\Cri.FORMATTINO\Dati applicazioni\m C:\Avenger\downld C:\WINDOWS\System32\drivers\downld