Punto informatico Network
Login Esegui login | Non sei registrato? Iscriviti ora (è gratuito!)
Username: Password:
  • Annuncio Pubblicitario

ECCOMI QUI ANCHIO CON BAGLE ED ALTRO

Un virus si è intromesso nel tuo computer? Vuoi navigare in tutta sicurezza? Sono sicure le transazione online? Come impedire a malintenzionati di intromettersi nel tuo pc? Come proteggere i tuoi dati? Qui trovi le risposte a queste ed altre domande

ECCOMI QUI ANCHIO CON BAGLE ED ALTRO

Messaggioda mariosan » mer gen 16, 2008 9:15 am

Ringrazio anticipatamente per l'aiuto, mi rendo conto di essere conciato male oltre a bagle c'e dell'altro ma ora il problema principale è che non riesco a reinstallare un antivirus e non riesco ad avviare in provvisoria.
Avevo installato Avast.



ecco il report di kaspersky.

Wednesday, January 16, 2008 7:48:32 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 15/01/2008
Kaspersky Anti-Virus database records: 512458


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target Folders
C:\

Scan Statistics
Total number of scanned objects 80384
Number of viruses found 11
Number of infected objects 101
Number of suspicious objects 0
Duration of the scan process 04:14:58

Infected Object Name Virus Name Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\mariosan\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\mariosan\Dati applicazioni\$_hpcst$.hpc Object is locked skipped

C:\Documents and Settings\mariosan\Dati applicazioni\m\data.oct Infected: Trojan-Downloader.Win32.Bagle.ie skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7 ZIP: infected - 3 skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\statistic.jar-4be98b6c-3a436f24.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\statistic.jar-4be98b6c-3a436f24.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\statistic.jar-4be98b6c-3a436f24.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped

C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\statistic.jar-4be98b6c-3a436f24.zip ZIP: infected - 3 skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Cronologia\History.IE5\MSHist012008011520080116\index.dat Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temp\Perflib_Perfdata_65c.dat Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temp\setup.exe Infected: Trojan-Proxy.Win32.Horst.sz skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temp\WCESLog.log Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temp\_tc\eSMS 2.exe Infected: Trojan-Downloader.Win32.Bagle.hz skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temp\_tc8\Norton Utilities 2006 Portable Edition\Support\PQBOOT32.EXE Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temp\_tc8\Norton Utilities 2006 Portable Edition\Support\PTEDIT32.EXE Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_1[2].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_1[3].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[1].jpg Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M\b64_3[8].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_1[2].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_1[3].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_1[4].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_1[5].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_1[6].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_2[5].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_2[6].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_3[1].jpg Infected: Trojan-Downloader.Win32.Bagle.ho skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7\mxd[2].jpg Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_1[3].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_2[5].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_2[6].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_1[2].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_1[3].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_1[4].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\b64_3[8].jpg Infected: Email-Worm.Win32.Bagle.of skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.ia skipped

C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\mariosan\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\mariosan\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\mariosan\UserData\index.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Programmi\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped

C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe Infected: Trojan-Downloader.Win32.Bagle.hz skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB929338$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\dllcache\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\system32\drivers\atapi.sys Object is locked skipped

C:\WINDOWS\system32\drivers\down\103515.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\14715546.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\14743312.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\14759437.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\14781406.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\14790421.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\29364359.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\66265.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\66515.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\68765.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\68843.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\70734.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\71062.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\75359.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\83265.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\83718.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\85921.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\89093.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\down\90156.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\drivers\sptd7677.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

C:\WINDOWS\system32\ntkrnlpa.exe Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_7c4.dat Object is locked skipped

C:\WINDOWS\Temp\win55.tmp.exe Infected: Trojan.Win32.Dialer.rw skipped

C:\WINDOWS\Temp\win56.tmp.exe Infected: Trojan.Win32.Dialer.rw skipped
[:-H] [:-H] [:-H]
Avatar utente
mariosan
Neo Iscritto
Neo Iscritto
 
Messaggi: 14
Iscritto il: lun gen 14, 2008 11:55 am

Messaggioda crazy.cat » mer gen 16, 2008 9:37 am

Disattiva il ripristino della configurazione e riavvia il pc
http://www.MegaLab.it/2330

Poi applichi questo script ad avenger.

Codice: Seleziona tutto
Files to delete:
C:\WINDOWS\system32\drivers\hidr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\hldrrr.exe
C:\WINDOWS\system32\trusted.exe
C:\WINDOWS\system32\drivers\pci32.sys
C:\windows\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\hldrrr.ex_
C:\WINDOWS\system32\mdelk.exe
C:\Documents and Settings\mariosan\Dati applicazioni\m\flec006.exe
C:\Documents and Settings\mariosan\Dati applicazioni\m\data.oct
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/BaaaaBaa.class
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/VaaaaaaaBaa.class
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/Baaaaa.class
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\statistic.jar-4be98b6c-3a436f24.zip 
C:\Documents and Settings\mariosan\Impostazioni locali\Temp\setup.exe 
C:\Documents and Settings\mariosan\Impostazioni locali\Temp\_tc\eSMS 2.exe 
C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe 
C:\WINDOWS\Temp\win55.tmp.exe 
C:\WINDOWS\Temp\win56.tmp.exe 

folders to delete:
C:\WINDOWS\exefnd
C:\WINDOWS\exefld
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC
C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T
C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M
C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
HKLM\SYSTEM\CurrentControlSet\Services\pci32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32


Fai analizzare questi file sul sito www.virustotal.com e vediamo cosa dicono loro.
C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\system32\dllcache\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\system32\ntkrnlpa.exe Object is locked skipped

Questo ti serve per sistemare la modalità provvisoria
http://www.MegaLab.it/3250

Dopo il riavvio del pc reinstalla l'antivirus
Quando i molti governano, pensano solo a contentar sé stessi, si ha allora la tirannia più balorda e più odiosa: la tirannia mascherata da libertà.
Avatar utente
crazy.cat
MLI Hero
MLI Hero
 
Messaggi: 30959
Iscritto il: lun gen 12, 2004 1:38 pm
Località: Mestre

Messaggioda mariosan » mer gen 16, 2008 5:43 pm

fatto ... riesco ad installare nod32 visto che avast mi ha tradito, ecco il report : a fine pagina posto il risultato della scansione on line su virustotal.com dei file in dubbio.
Sei un mito, grazie !!

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\huchnvem

*******************

Script file located at: \??\C:\gpkuahda.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\WINDOWS\system32\drivers\hidr.exe not found!
Deletion of file C:\WINDOWS\system32\drivers\hidr.exe failed!

Could not process line:
C:\WINDOWS\system32\drivers\hidr.exe
Status: 0xc0000034

File C:\WINDOWS\system32\drivers\srosa.sys deleted successfully.
File C:\WINDOWS\system32\wintems.exe deleted successfully.


File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



File C:\WINDOWS\system32\trusted.exe not found!
Deletion of file C:\WINDOWS\system32\trusted.exe failed!

Could not process line:
C:\WINDOWS\system32\trusted.exe
Status: 0xc0000034



File C:\WINDOWS\system32\drivers\pci32.sys not found!
Deletion of file C:\WINDOWS\system32\drivers\pci32.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\pci32.sys
Status: 0xc0000034

File C:\windows\system32\drivers\hldrrr.exe deleted successfully.


File C:\WINDOWS\system32\drivers\hldrrr.ex_ not found!
Deletion of file C:\WINDOWS\system32\drivers\hldrrr.ex_ failed!

Could not process line:
C:\WINDOWS\system32\drivers\hldrrr.ex_
Status: 0xc0000034

File C:\WINDOWS\system32\mdelk.exe deleted successfully.
File C:\Documents and Settings\mariosan\Dati applicazioni\m\flec006.exe deleted successfully.
File C:\Documents and Settings\mariosan\Dati applicazioni\m\data.oct deleted successfully.


Could not open file C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/BaaaaBaa.class for deletion
Deletion of file C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/BaaaaBaa.class failed!

Could not process line:
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/BaaaaBaa.class
Status: 0xc0000033



Could not open file C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/VaaaaaaaBaa.class for deletion
Deletion of file C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/VaaaaaaaBaa.class failed!

Could not process line:
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/VaaaaaaaBaa.class
Status: 0xc0000033



Could not open file C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/Baaaaa.class for deletion
Deletion of file C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/Baaaaa.class failed!

Could not process line:
C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7/Baaaaa.class
Status: 0xc0000033

File C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\6.0\30\5b87a59e-73e354a7 deleted successfully.
File C:\Documents and Settings\mariosan\Dati applicazioni\Sun\Java\Deployment\cache\javapi\v1.0\jar\statistic.jar-4be98b6c-3a436f24.zip deleted successfully.
File C:\Documents and Settings\mariosan\Impostazioni locali\Temp\setup.exe deleted successfully.
File C:\Documents and Settings\mariosan\Impostazioni locali\Temp\_tc\eSMS 2.exe deleted successfully.
File C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe deleted successfully.
File C:\WINDOWS\Temp\win55.tmp.exe deleted successfully.
File C:\WINDOWS\Temp\win56.tmp.exe deleted successfully.


Folder C:\WINDOWS\exefnd not found!
Deletion of folder C:\WINDOWS\exefnd failed!

Could not process line:
C:\WINDOWS\exefnd
Status: 0xc0000034



Folder C:\WINDOWS\exefld not found!
Deletion of folder C:\WINDOWS\exefld failed!

Could not process line:
C:\WINDOWS\exefld
Status: 0xc0000034

Folder C:\WINDOWS\system32\drivers\down deleted successfully.
Folder C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\E5HSDOIC deleted successfully.
Folder C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\8YGQJW1T deleted successfully.
Folder C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\0089912M deleted successfully.
Folder C:\Documents and Settings\mariosan\Impostazioni locali\Temporary Internet Files\Content.IE5\31PQSTJ7 deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\pci32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\pci32
Status: 0xc0000034



Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32 failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PCI32
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.





File ntkrnlpa.exe ricevuto il 2008.01.16 17:22:15 (CET)

Risultato: 0/32 (0%)


File ntkrnlpa.exe ricevuto il 2008.01.16 17:37:42 (CET)


Risultato: 0/32 (0%)



[/b]
Avatar utente
mariosan
Neo Iscritto
Neo Iscritto
 
Messaggi: 14
Iscritto il: lun gen 14, 2008 11:55 am


Torna a Sicurezza

Chi c’è in linea

Visitano il forum: Nessuno e 4 ospiti

Powered by phpBB © 2002, 2005, 2007, 2008 phpBB Group
Traduzione Italiana phpBB.it

megalab.it: testata telematica quotidiana registrata al Tribunale di Cosenza n. 22/09 del 13.08.2009, editore Master New Media S.r.l.; © Copyright 2008 Master New Media S.r.l. a socio unico - P.I. 02947530784. GRUPPO EDIZIONI MASTER Spa Tutti i diritti sono riservati. Per la pubblicità: Master Advertising