Punto informatico Network
Login Esegui login | Non sei registrato? Iscriviti ora (è gratuito!)
Username: Password:
  • Annuncio Pubblicitario

Worm bagle

Un virus si è intromesso nel tuo computer? Vuoi navigare in tutta sicurezza? Sono sicure le transazione online? Come impedire a malintenzionati di intromettersi nel tuo pc? Come proteggere i tuoi dati? Qui trovi le risposte a queste ed altre domande

Worm bagle

Messaggioda zipp141 » ven set 14, 2007 5:40 am

Ciao a tutti.

Qulacuno mi potrebbe aiutare a trovare lo script giusto per eliminare dal mio sistema il worm in oggetto?

Di seguito vi posto il log dopo la scansione con Kaspersky.
Vi ringrazio anticipatamente.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, September 14, 2007 5:51:35 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 13/09/2007
Kaspersky Anti-Virus database records: 418120
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 152258
Number of viruses found: 4
Number of infected objects: 14
Number of suspicious objects: 0
Duration of the scan process: 04:47:28

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\utente\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\utente\Dati applicazioni\m\flec006.exe Infected: Trojan-Downloader.Win32.Bagle.df skipped
C:\Documents and Settings\utente\Dati applicazioni\Mozilla\Firefox\Profiles\znwinyvk.default\cert8.db Object is locked skipped
C:\Programmi\eMule\Incoming\View armadillo ran with the ultimate player.zip/PlayerToolSetup05.exe/WISE0007.BIN/file8 Infected: Trojan.Win32.Obfuscated.en skipped
C:\Programmi\eMule\Incoming\View armadillo ran with the ultimate player.zip/PlayerToolSetup05.exe/WISE0007.BIN Infected: Trojan.Win32.Obfuscated.en skipped
C:\Programmi\eMule\Incoming\View armadillo ran with the ultimate player.zip/PlayerToolSetup05.exe Infected: Trojan.Win32.Obfuscated.en skipped
C:\Programmi\eMule\Incoming\View armadillo ran with the ultimate player.zip ZIP: infected - 3 skipped
C:\Programmi\Free Download Manager\fdm.exe -autorun Infected: Trojan-Downloader.Win32.Bagle.dx skipped
C:\Programmi\PeerGuardian2\pg2.exe Infected: Trojan-Downloader.Win32.Bagle.dx skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\exefld\110406.exe Infected: Trojan-Downloader.Win32.Bagle.df skipped
C:\WINDOWS\exefld\117468.exe Infected: Trojan-Downloader.Win32.Bagle.dy skipped
C:\WINDOWS\exefld\2163843.exe Infected: Trojan-Downloader.Win32.Bagle.dy skipped
C:\WINDOWS\exefld\29000703.exe Infected: Trojan-Downloader.Win32.Bagle.dy skipped
C:\WINDOWS\exefld\43418421.exe Infected: Trojan-Downloader.Win32.Bagle.dy skipped
C:\WINDOWS\exefld\57862984.exe Infected: Trojan-Downloader.Win32.Bagle.df skipped
C:\WINDOWS\exefld\710515.exe Infected: Trojan-Downloader.Win32.Bagle.dy skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
Scan process completed.
Avatar utente
zipp141
Neo Iscritto
Neo Iscritto
 
Messaggi: 3
Iscritto il: ven set 14, 2007 5:32 am

Messaggioda crazy.cat » ven set 14, 2007 7:17 am

Posta poi il txt che esce dopo il riavvio del pc e poi reinstallati Free download manager e peerguardian, oltre all'antivirus

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\Documents and Settings\utente\Dati applicazioni\m\flec006.exe
C:\Programmi\eMule\Incoming\View armadillo ran with the ultimate player.zip
C:\Programmi\Free Download Manager\fdm.exe
C:\Programmi\PeerGuardian2\pg2.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Avatar utente
crazy.cat
MLI Hero
MLI Hero
 
Messaggi: 30959
Iscritto il: lun gen 12, 2004 1:38 pm
Località: Mestre

Messaggioda zipp141 » ven set 14, 2007 5:15 pm

Ciao a tutti.

Non riesco a cancellare i file.

Con Avenger mi compare il seguente messaggio:

Error: selected file does not appear to be a valid script.

Se volessi rimuovere i file con il tasto "canc" della tastiera, il sistema di dice che non può cancellare il file in quanto è attivo.

Che fare?....
Avatar utente
zipp141
Neo Iscritto
Neo Iscritto
 
Messaggi: 3
Iscritto il: ven set 14, 2007 5:32 am

Messaggioda crazy.cat » ven set 14, 2007 5:43 pm

Riprova con questo, insisti anche due o tre volte chiudendo avenger e riaprendolo.

Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\Documents and Settings\utente\Dati applicazioni\m\flec006.exe
C:\Programmi\Free Download Manager\fdm.exe
C:\Programmi\PeerGuardian2\pg2.exe

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32

Non cancellare cose a mano si rischia di fare peggio.
Quando i molti governano, pensano solo a contentar sé stessi, si ha allora la tirannia più balorda e più odiosa: la tirannia mascherata da libertà.
Avatar utente
crazy.cat
MLI Hero
MLI Hero
 
Messaggi: 30959
Iscritto il: lun gen 12, 2004 1:38 pm
Località: Mestre

Messaggioda zipp141 » ven set 14, 2007 5:56 pm

Tutto risolto.

Non copiavo bene li script.

Sono riuscito ad installare nuovamente l'antivirus ed il firewall.

Di seguito post il log di Avenger.

Grazie tante per la disponibilità.

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\valumbme

*******************

Script file located at: \??\C:\Documents and Settings\qgklflvq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\drivers\hidr.exe deleted successfully.
File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\Documents and Settings\utente\Dati applicazioni\m\flec006.exe deleted successfully.
File C:\Programmi\eMule\Incoming\View armadillo ran with the ultimate player.zip deleted successfully.
File C:\Programmi\Free Download Manager\fdm.exe deleted successfully.
File C:\Programmi\PeerGuardian2\pg2.exe deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034

Folder C:\WINDOWS\exefld deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.
Avatar utente
zipp141
Neo Iscritto
Neo Iscritto
 
Messaggi: 3
Iscritto il: ven set 14, 2007 5:32 am


Torna a Sicurezza

Chi c’è in linea

Visitano il forum: Nessuno e 1 ospite

Powered by phpBB © 2002, 2005, 2007, 2008 phpBB Group
Traduzione Italiana phpBB.it

megalab.it: testata telematica quotidiana registrata al Tribunale di Cosenza n. 22/09 del 13.08.2009, editore Master New Media S.r.l.; © Copyright 2008 Master New Media S.r.l. a socio unico - P.I. 02947530784. GRUPPO EDIZIONI MASTER Spa Tutti i diritti sono riservati. Per la pubblicità: Master Advertising