rimozione impossibile

[simò84]

ciao a tutti,
uso regolarmente ccleaner , spyboat e kaspersky per mantenere in efficienza il pc

recentemente mi appaiono queste 3 voci

io le rimuovo, ma si ripresentano al controllo immediatamente successivo... nn c'e modo di cancellarle!

ho provato a cercare via esplora risorse ma i file nn esistono.. tra l'altro possiedono dei caratteri (???.exe) che nn sono ammessi, per cui n capisco neanche come possano esistere...

cosa può esser secondo voi?

ho scansionato con kasperski ma nn mi indica nessun virus, idem con spybot e spyware terminator non mi rileva questa anomalia.. sono file fantasma? nel pc nn rilevo comportamenti anomali in compenso...

che fare??

ciao

[Toro Scatenato]

Ciao....
Comincia postando un log di Hijackthis, vediamo se sono attivi o altro....

[simò84]

ci stavo pensando proprio nell atto di postare... eccolo qua

Logfile of HijackThis v1.99.1
Scan saved at 11.06.46, on 01/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\PROGRA~1\CACHEM~1\CachemanXP.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Programmi\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\nvraidservice.exe
C:\PROGRA~1\MICROS~3\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
C:\PROGRA~1\MOZILL~1\THUNDE~1.EXE
C:\Programmi\Opera\Opera.exe
G:\vecchi programmi\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Programmi\FlashGet\jccatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programmi\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [kis] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Programmi\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Apri in nuova scheda in primo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/230?735bdbd696564eaf9ec7334b55a8fcd7
O8 - Extra context menu item: Apri in nuova scheda in secondo piano - res://C:\Programmi\Windows Live Toolbar\Components\it-it\msntabres.dll.mui/229?735bdbd696564eaf9ec7334b55a8fcd7
O8 - Extra context menu item: Open with XmlPad - res://C:\Programmi\WMHelp Software\WMHelp XmlPad\WmhASPP.dll/101
O8 - Extra context menu item: Scarica con FlashGet - C:\Programmi\FlashGet\jc_link.htm
O8 - Extra context menu item: Scarica tutto con FlashGet - C:\Programmi\FlashGet\jc_all.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crea preferito portatile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programmi\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Programmi\FlashGet\flashget.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{623ADC98-6112-4FFE-A7CF-C593D31D6AF2}: NameServer = 85.37.17.55 85.38.28.93
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: wmh - {A1428E78-2D00-4590-A071-0CC9700A7768} - C:\Programmi\WMHelp Software\WMHelp XmlPad\WmhASPP.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - C:\PROGRA~1\CACHEM~1\CachemanXP.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[Toro Scatenato]

Il log è pulito a parte queste 2 voci, se non le conosci fixale pure.

O8 - Extra context menu item: Open with XmlPad - res://C:\Programmi\WMHelp Software\WMHelp XmlPad\WmhASPP.dll/101
O18 - Protocol: wmh - {A1428E78-2D00-4590-A071-0CC9700A7768} - C:\Programmi\WMHelp Software\WMHelp XmlPad\WmhASPP.dll

Per il resto, prova ad eliminare le voci con Avenger. Segui queste indicazioni:
-Destro su risorse del computer, proprietà, ripristino di configurazione sistema, disattivalo (Perderai tutti i punti di ripristino salvati).
-Scaricati Avenger: http://swandog46.geekstogo.com/avenger.zip
Scompatta il tutto e fallo partire.
-Clicca su Input script manuallt
-Clicca sulla lente di ingrandimento
-Copia e incolla il comando, cioè:

Files to delete:
<Ci va il percorso dei file, quindi se sono per esempio in sistem32 sarà:
C:/Windows/System32/(???).exe>

-Clicca su Done.
-Clicca sul semaforo.
-Il pc dovrebbe riavviarsi automaticamente, se non lo fa, riavvia manualmente.
-Posta il log di Avenger situato in C:\Avenger
-Posta un log di Hijackthis.

Se non hai capito, chiedi e mi spiego meglio.

[Luke57]

Ciao, scarica systemscan da qui:
http://www.suspectfile.com/systemscan
lo metti sul desktop, lo pari, spunta solamente l'opzione "recent files, day old", impostando a 60 gg, deseleziona tutte le altre, premi scan now.
Incolla in un post il risultato dello scan che ti apparirà in formato testo nella cartella c:\suspectfile.

[simò84]

volevo segnalare un altra cosa: durante la normale connessione adsl (ho alice flat) , capita sovente che smette di navigare: i siti non si caricano piu, msn rimanda indietro i messaggi inviati, insomma pare paralizzato...

alchè io scollego il modem, ma rimane l'icona dei 2 computer invece di sparire.. rimane una connessione fantasma insomma... posso ricollegare il modem, riconnettermi ad alice, ma niente... nn si riesce piu a navigare. i 2 computerini sono li nella tray fissi.

l unica cosa è riavviare il pc.. e quando si riavvia, appare la voce "termina programma" chiamata Connections tray , con la barra di progresso prima della chiusura forzata del programma (il classico programma che rimane bloccato alla chiusura del pc e viene forzatamente terminato)

non so quale sia queel processo, nella lista di avvio nn appare.. credo sia del sistema! non capisco perchè si blocca in questo modo..

[Luke57]

Ciao, ma se non prendi in considerazione i suggerimenti dati come facciamo ad aiutarti?

[simò84]

sto cercando di fare!

[simò84]

il log di systemscan. piu in basso trovate anche avenger, che non ha potuto cancellare quei file, in quanto NON esistenti!!


SystemScan - http://www.suspectfile.com - ver. 3.2.0
Running on: Windows XP PROFESSIONAL Edition, Service Pack 2 (2600.5.1)
System directory: C:\WINDOWS

Date: 02/09/2007
Time: 13.43.27

Output limited to:
-Recent files

===================== Recent files (60 days old)=====================

----- recent files in C:\
18/07/2007 23.45.18 (DIR) 0 byte 46 days old -- System Volume Information
01/08/2007 13.36.46 (DIR) 0 byte 32 days old -- btinbox
02/08/2007 20.02.38 1609801728 byte 31 days old -- pagefile.sys
26/08/2007 13.48.19 211 byte 7 days old -- boot.ini
01/09/2007 01.43.13 (DIR) 0 byte 1 days old -- WINDOWS
02/09/2007 12.09.15 (DIR) 0 byte 0 days old -- Programmi
02/09/2007 13.16.57 (DIR)1073270784 byte 0 days old -- hiberfil.sys
02/09/2007 13.29.25 126976 byte 0 days old -- zip.exe
02/09/2007 13.29.25 (DIR) 0 byte 0 days old -- Avenger
02/09/2007 13.29.25 1080 byte 0 days old -- jsuytewd.bat
02/09/2007 13.43.27 (DIR) 0 byte 0 days old -- suspectfile

----- recent files in C:\WINDOWS\
09/07/2007 22.53.42 (DIR) 0 byte 55 days old -- Help
13/07/2007 00.00.32 1109 byte 51 days old -- CDWSEAT.INI
15/07/2007 19.43.36 54 byte 49 days old -- JascCmdFile.INI
19/07/2007 15.02.33 (DIR) 0 byte 45 days old -- Fonts
01/08/2007 13.22.01 (DIR) 0 byte 32 days old -- BTFXTEMP
01/08/2007 13.24.34 (DIR) 0 byte 32 days old -- security
03/08/2007 14.34.16 (DIR) 0 byte 30 days old -- Downloaded Program Files
14/08/2007 00.37.02 0 byte 19 days old -- Sti_Trace.log
18/08/2007 11.58.49 (DIR) 0 byte 15 days old -- inf
19/08/2007 13.05.51 (DIR) 0 byte 14 days old -- Installer
26/08/2007 13.48.19 258 byte 7 days old -- system.ini
31/08/2007 21.27.34 805 byte 2 days old -- win.ini
31/08/2007 21.38.47 74752 byte 2 days old -- ST6UNST.EXE
31/08/2007 21.38.48 253952 byte 2 days old -- Setup1.exe
01/09/2007 01.43.13 54156 byte 1 days old -- QTFont.qfn
01/09/2007 01.43.13 1409 byte 1 days old -- QTFont.for
01/09/2007 13.40.20 32428 byte 1 days old -- SchedLgU.Txt
02/09/2007 11.57.34 116 byte 0 days old -- NeroDigital.ini
02/09/2007 13.06.04 155 byte 0 days old -- winamp.ini
02/09/2007 13.07.11 1778 byte 0 days old -- ModemLog_Windigo Bluetooth DUN Modem.txt
02/09/2007 13.07.33 3649 byte 0 days old -- mozver.dat
02/09/2007 13.17.03 2048 byte 0 days old -- bootstat.dat
02/09/2007 13.17.07 (DIR) 0 byte 0 days old -- Temp
02/09/2007 13.17.10 159 byte 0 days old -- wiadebug.log
02/09/2007 13.17.10 50 byte 0 days old -- wiaservc.log
02/09/2007 13.17.11 0 byte 0 days old -- 0.log
02/09/2007 13.18.40 (DIR) 0 byte 0 days old -- Internet Logs
02/09/2007 13.29.25 (DIR) 0 byte 0 days old -- system32
02/09/2007 13.32.00 11052 byte 0 days old -- WindowsUpdate.log
02/09/2007 13.39.26 (DIR) 0 byte 0 days old -- Prefetch

----- recent files in C:\WINDOWS\Downloaded Program Files\

----- recent files in C:\WINDOWS\system\

----- recent files in C:\WINDOWS\system32\
09/07/2007 22.54.16 (DIR) 0 byte 55 days old -- CatRoot
18/07/2007 23.45.18 (DIR) 0 byte 46 days old -- Restore
20/07/2007 20.31.11 216064 byte 44 days old -- FNTCACHE.DAT
03/08/2007 14.34.07 (DIR) 0 byte 30 days old -- Macromed
24/08/2007 15.30.52 (DIR) 0 byte 9 days old -- dllcache
24/08/2007 15.31.12 62286 byte 9 days old -- perfc009.dat
24/08/2007 15.31.12 994406 byte 9 days old -- PerfStringBackup.INI
24/08/2007 15.31.13 447046 byte 9 days old -- perfh010.dat
24/08/2007 15.31.13 400624 byte 9 days old -- perfh009.dat
24/08/2007 15.31.13 74296 byte 9 days old -- perfc010.dat
28/08/2007 11.00.45 2206 byte 5 days old -- wpa.dbl
29/08/2007 14.08.59 (DIR) 0 byte 4 days old -- CatRoot2
02/09/2007 13.17.13 54112 byte 0 days old -- vsconfig.xml
02/09/2007 13.29.25 (DIR) 0 byte 0 days old -- drivers
02/09/2007 13.29.25 152 byte 0 days old -- sbqcqswa.txt

----- recent files in C:\WINDOWS\system32\drivers\
01/09/2007 13.40.22 206480 byte 1 days old -- fidbox2.idx
01/09/2007 13.40.22 818276 byte 1 days old -- fidbox.idx
02/09/2007 13.14.57 60331296 byte 0 days old -- fidbox.dat
02/09/2007 13.15.17 2073376 byte 0 days old -- fidbox2.dat
02/09/2007 13.29.25 60416 byte 0 days old -- mvuqlumg.sys

----- recent files in C:\WINDOWS\temp\
28/08/2007 11.00.46 16384 byte 5 days old -- ~DFF2F.tmp
28/08/2007 19.10.04 16384 byte 5 days old -- ~DF1A3D.tmp
29/08/2007 12.35.48 16384 byte 4 days old -- ~DF1840.tmp
29/08/2007 19.45.05 16384 byte 4 days old -- ~DF1740.tmp
29/08/2007 22.18.59 16384 byte 4 days old -- ~DF18F4.tmp
30/08/2007 12.11.34 16384 byte 3 days old -- ~DF14EC.tmp
30/08/2007 20.30.18 16384 byte 3 days old -- ~DF1AAA.tmp
31/08/2007 11.45.16 16384 byte 2 days old -- ~DF1CA0.tmp
31/08/2007 19.56.29 16384 byte 2 days old -- ~DF1949.tmp
31/08/2007 19.56.31 256 byte 2 days old -- ZLT02577.TMP
31/08/2007 19.56.31 256 byte 2 days old -- ZLT01b96.TMP
31/08/2007 20.17.01 16384 byte 2 days old -- ~DF153A.tmp
01/09/2007 01.34.30 16384 byte 1 days old -- ~DF18A4.tmp
01/09/2007 11.04.51 16384 byte 1 days old -- ~DF194B.tmp
01/09/2007 11.04.53 256 byte 1 days old -- ZLT05a83.TMP
01/09/2007 11.04.53 256 byte 1 days old -- ZLT05cb4.TMP
01/09/2007 13.06.00 16384 byte 1 days old -- ~DF18A5.tmp
02/09/2007 11.15.44 16384 byte 0 days old -- ~DF1754.tmp
02/09/2007 11.15.46 256 byte 0 days old -- ZLT0332a.TMP
02/09/2007 11.15.46 256 byte 0 days old -- ZLT03680.TMP
02/09/2007 13.17.04 16384 byte 0 days old -- ~DF180A.tmp
02/09/2007 13.17.06 256 byte 0 days old -- ZLT01008.TMP
02/09/2007 13.17.07 256 byte 0 days old -- ZLT0100b.TMP

----- recent files in C:\Programmi\
10/07/2007 22.13.49 (DIR) 0 byte 54 days old -- Kaspersky Lab
13/07/2007 09.39.10 (DIR) 0 byte 51 days old -- Last.fm
13/07/2007 19.11.55 (DIR) 0 byte 51 days old -- Drive Rescue
14/07/2007 13.43.05 (DIR) 0 byte 50 days old -- pcc
14/07/2007 14.37.52 (DIR) 0 byte 50 days old -- Microsoft ActiveSync
15/07/2007 14.07.15 (DIR) 0 byte 49 days old -- PPC
19/07/2007 15.01.11 (DIR) 0 byte 45 days old -- Common Files
19/07/2007 15.01.11 (DIR) 0 byte 45 days old -- Xara
29/07/2007 15.22.14 (DIR) 0 byte 35 days old -- AWS
29/07/2007 15.22.50 (DIR) 0 byte 35 days old -- GameSpy Arcade
01/08/2007 13.23.29 (DIR) 0 byte 32 days old -- XTNDConnect Blue Manager
03/08/2007 12.58.22 (DIR) 0 byte 30 days old -- InstallShield Installation Information
03/08/2007 12.58.23 (DIR) 0 byte 30 days old -- Nokia
07/08/2007 21.12.19 (DIR) 0 byte 26 days old -- Winamp
10/08/2007 11.29.48 (DIR) 0 byte 23 days old -- Spybot - Search & Destroy
10/08/2007 21.01.14 (DIR) 0 byte 23 days old -- MSN Messenger
11/08/2007 14.33.53 (DIR) 0 byte 22 days old -- Raxco
18/08/2007 13.31.46 (DIR) 0 byte 15 days old -- SpeedFan
24/08/2007 15.30.45 (DIR) 0 byte 9 days old -- IDoser v4
30/08/2007 13.23.11 (DIR) 0 byte 3 days old -- Opera
30/08/2007 13.27.51 (DIR) 0 byte 3 days old -- Unlocker
31/08/2007 21.41.04 (DIR) 0 byte 2 days old -- Multi_Media_Italy
31/08/2007 21.42.19 (DIR) 0 byte 2 days old -- Spyware Terminator
01/09/2007 11.52.53 (DIR) 0 byte 1 days old -- Jacksms
02/09/2007 13.18.01 (DIR) 0 byte 0 days old -- Mozilla Thunderbird
02/09/2007 13.25.46 (DIR) 0 byte 0 days old -- FlashGet

----- recent files in C:\Programmi\File comuni\
10/07/2007 23.02.20 (DIR) 0 byte 54 days old -- Microsoft Shared

----- recent files in C:\Documents and Settings\Administrator\Dati applicazioni\
26/07/2007 17.06.05 (DIR) 0 byte 38 days old -- Skype
01/08/2007 13.30.10 (DIR) 0 byte 32 days old -- XTND_BTUIObjects

----- recent files in C:\DOCUME~1\ADMINI~1\IMPOST~1\Temp\
28/08/2007 19.11.47 156174 byte 5 days old -- TFR1.tmp
28/08/2007 19.11.48 55262 byte 5 days old -- TFR2.tmp
28/08/2007 19.11.48 107070 byte 5 days old -- TFR6.tmp
28/08/2007 19.11.48 22168 byte 5 days old -- TFR9.tmp
29/08/2007 12.37.10 163840 byte 4 days old -- ~DF93B2.tmp
29/08/2007 15.15.36 16384 byte 4 days old -- E5.tmp
29/08/2007 15.17.31 16384 byte 4 days old -- E6.tmp
29/08/2007 15.17.39 16384 byte 4 days old -- E7.tmp
29/08/2007 15.18.09 0 byte 4 days old -- TWAIN.LOG
29/08/2007 20.28.42 156174 byte 4 days old -- TFRA5.tmp
29/08/2007 20.28.42 107070 byte 4 days old -- TFRAA.tmp
29/08/2007 20.28.42 22168 byte 4 days old -- TFRAF.tmp
29/08/2007 20.28.42 55262 byte 4 days old -- TFRA6.tmp
29/08/2007 20.28.42 155781 byte 4 days old -- TFRA8.tmp
30/08/2007 20.59.33 163840 byte 3 days old -- ~DF481D.tmp
31/08/2007 20.04.55 0 byte 2 days old -- 07u14.tmp
31/08/2007 20.06.17 0 byte 2 days old -- ot218.tmp
31/08/2007 21.38.15 (DIR) 0 byte 2 days old -- CTJBNS
31/08/2007 21.38.31 56320 byte 2 days old -- ginst0.dll
01/09/2007 01.51.31 (DIR) 0 byte 1 days old -- File temporanei
01/09/2007 01.51.32 2 byte 1 days old -- Twain001.Mtx
01/09/2007 12.53.42 (DIR) 0 byte 1 days old -- hsperfdata_Administrator
01/09/2007 12.53.44 0 byte 1 days old -- sfe16A.tmp
02/09/2007 13.07.06 0 byte 0 days old -- jdf1B5.tmp
02/09/2007 13.07.07 0 byte 0 days old -- aug1B6.tmp
02/09/2007 13.07.33 0 byte 0 days old -- o761BF.tmp
02/09/2007 13.09.14 0 byte 0 days old -- 7rx1C1.tmp
02/09/2007 13.09.14 74 byte 0 days old -- 7rx1C1.htm
02/09/2007 13.09.17 0 byte 0 days old -- t0z1C5.tmp
02/09/2007 13.11.55 74 byte 0 days old -- x0920D.htm
02/09/2007 13.11.55 0 byte 0 days old -- x0920D.tmp
02/09/2007 13.22.45 4916 byte 0 days old -- WcesView.log
02/09/2007 13.22.48 69722 byte 0 days old -- WCESMgr.log
02/09/2007 13.22.49 26406 byte 0 days old -- WCESLog.log
02/09/2007 13.38.30 16384 byte 0 days old -- ~DF84E4.tmp
02/09/2007 13.39.26 (DIR) 0 byte 0 days old -- nsz38.tmp
02/09/2007 13.42.01 (DIR) 0 byte 0 days old -- MessengerCache
02/09/2007 13.42.33 6892 byte 0 days old -- WCESCOMM.LOG
02/09/2007 13.43.13 234 byte 0 days old -- dw.log

e avenger

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\rwjhjmev

*******************

Script file located at: \??\C:\WINDOWS\system32\sbqcqswa.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:/DOCUME~1/ADMINI~1/IMPOST~1/Temp/Rar$EX00.282/???.exe> not found!
Deletion of file C:/DOCUME~1/ADMINI~1/IMPOST~1/Temp/Rar$EX00.282/???.exe> failed!

Could not process line:
C:/DOCUME~1/ADMINI~1/IMPOST~1/Temp/Rar$EX00.282/???.exe>
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.

[simò84]

ho seguito i suggermenti. che faccio ora?

[simò84]

nulla?? si è aggiunta pure un altra voce...

ma intanto questi file, visto che nn esistono, come li tolgooo