virus?

[sunsword]

Ho installato AVS Audio Recorde 3.8.1.29 e poi ho scaricato con emule il file .zip chiamato AVS Audio Recorde 3.8.1.29 (Patch). Quando ho avviato l'eseguibile presente nel suddetto file al primo colpo mi ha aperto una finestra per cercare il file da patchare al secondo mi ha disattivato AVG antivirus e windows defender. Ho riavviato e il computer mi dice che ho un problema con avg e windows defender e poi si blocca. Ho riavviato in modalità provvisoria e non si è bloccato. Ho disinstallato AVG ed ho riavviato. Il computer mi dice che c'è un problema e prova a fare il ripristino, se riavvio normalmente mi dà il problema con windows defender ma non si blocca. Ho provato ha reinstallare AVG ma non ci riesco perchè durante l'installazione mi dice che c'è un errore. Cosa devo fare? In che virus sono incappato? Il mio sistema operativo è windoes vista

[Blu32]

Ciao, in attesa di consigli da parte di qualcuno più esperto di me prova con una scansione online.

[sunsword]

Ho provato con diverse scansioni online. Non so se non funzionano perchè ho vista ma penso sia il virus che me le inibisce

[sunsword]

Temo che si tratti di un virus bagle. Ho letto che si può rimuovere usando avenger ed ho dato un'occhiata alla guida di megalab, mi sembra però che sia per xp o antecedenti e io ho vista, non lo conosco bene e non vorrei combinare altri casini... Ho bisogno di una guida passo a passo. Ho letto il topic di Neofito che aveva il mio stesso problema.. Ho visto che Luke57 ha risolto..

[Luke57]

Ciao, scarica elibagla da qui http://www.zonavirus.com/datos/descarga ... ibagla.asp
in fondo alla pagina trovi Descargar Elibagla.
lancialo e fagli fare una scansione. Riporta il report in un post e dai sapere se è stato sufficiente.

[sunsword]

Sono riuscito a fare una scansione online con kaspersky, ma non mi ha potuto controllare la memoria perchè ho vista.. Comunque questo è il report
Saturday, September 08, 2007 4:50:55 PM
Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 8/09/2007
Kaspersky Anti-Virus database records: 410271


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\
L:\

Scan Statistics
Total number of scanned objects 84398
Number of viruses found 2
Number of infected objects 4
Number of suspicious objects 0
Duration of the scan process 01:51:53

Infected Object Name Virus Name Last Action
C:\Boot\BCD Object is locked skipped

C:\Boot\BCD.LOG Object is locked skipped

C:\hp\KBD\KbdStub.exe Infected: Trojan-Downloader.Win32.Bagle.dv skipped

C:\hp\support\hpsysdrv.exe Infected: Trojan-Downloader.Win32.Bagle.dv skipped

C:\Program Files\PC-Doctor 5 for Windows\Configuration\config.xml Object is locked skipped

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\5e94d20723ac0fd3235dfe1ca4a17cc3_8791edab-8acf-4d6f-8479-11554ad6c072 Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1 Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2 Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\UsrClass.dat{a38dc2d4-f282-11db-8d1e-001a92109028}.TM.blf Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\UsrClass.dat{a38dc2d4-f282-11db-8d1e-001a92109028}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows\UsrClass.dat{a38dc2d4-f282-11db-8d1e-001a92109028}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Users\Marco\AppData\Local\Microsoft\Windows Sidebar\Settings.ini Object is locked skipped

C:\Users\Marco\AppData\Roaming\Microsoft\Windows\Cookies\index.dat Object is locked skipped

C:\Users\Marco\Downloads\strutture\travilog\! travilog titanium crack.zip/travilog titanium crack.exe Infected: not-a-virus:AdWare.Win32.Stud.a skipped

C:\Users\Marco\Downloads\strutture\travilog\! travilog titanium crack.zip ZIP: infected - 1 skipped

C:\Users\Marco\ntuser.dat Object is locked skipped

C:\Users\Marco\ntuser.dat.LOG1 Object is locked skipped

C:\Users\Marco\ntuser.dat.LOG2 Object is locked skipped

C:\Users\Marco\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf Object is locked skipped

C:\Users\Marco\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Users\Marco\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe Object is locked skipped

C:\Windows\Debug\PASSWD.LOG Object is locked skipped

C:\Windows\Debug\sam.log Object is locked skipped

C:\Windows\Debug\WIA\wiatrace.log Object is locked skipped

C:\Windows\ehome\mcupdate.exe Object is locked skipped

C:\Windows\Installer\MSI567A.tmp Object is locked skipped

C:\Windows\Logs\CBS\CBS.log Object is locked skipped

C:\Windows\Logs\CBS\CBS.persist.log Object is locked skipped

C:\Windows\Logs\DPX\setupact.log Object is locked skipped

C:\Windows\Logs\DPX\setuperr.log Object is locked skipped

C:\Windows\MEMORY.DMP Object is locked skipped

C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config Object is locked skipped

C:\Windows\Panther\UnattendGC\diagerr.xml Object is locked skipped

C:\Windows\Panther\UnattendGC\diagwrn.xml Object is locked skipped

C:\Windows\Panther\UnattendGC\setupact.log Object is locked skipped

C:\Windows\Panther\UnattendGC\setuperr.log Object is locked skipped

C:\Windows\security\database\secedit.sdb Object is locked skipped

C:\Windows\SoftwareDistribution\Download\ea2600ac5dd0e172b500762b154fd0a7\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntoskrnl.exe Object is locked skipped

C:\Windows\SoftwareDistribution\Download\ea2600ac5dd0e172b500762b154fd0a7\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntoskrnl.exe Object is locked skipped

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 Object is locked skipped

C:\Windows\System32\catroot2\edb.log Object is locked skipped

C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb Object is locked skipped

C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb Object is locked skipped

C:\Windows\System32\chkdsk.exe Object is locked skipped

C:\Windows\System32\config\components Object is locked skipped

C:\Windows\System32\config\COMPONENTS.LOG1 Object is locked skipped

C:\Windows\System32\config\COMPONENTS.LOG2 Object is locked skipped

C:\Windows\System32\config\default Object is locked skipped

C:\Windows\System32\config\DEFAULT.LOG1 Object is locked skipped

C:\Windows\System32\config\DEFAULT.LOG2 Object is locked skipped

C:\Windows\System32\config\sam Object is locked skipped

C:\Windows\System32\config\SAM.LOG1 Object is locked skipped

C:\Windows\System32\config\SAM.LOG2 Object is locked skipped

C:\Windows\System32\config\security Object is locked skipped

C:\Windows\System32\config\SECURITY.LOG1 Object is locked skipped

C:\Windows\System32\config\SECURITY.LOG2 Object is locked skipped

C:\Windows\System32\config\software Object is locked skipped

C:\Windows\System32\config\SOFTWARE.LOG1 Object is locked skipped

C:\Windows\System32\config\SOFTWARE.LOG2 Object is locked skipped

C:\Windows\System32\config\system Object is locked skipped

C:\Windows\System32\config\SYSTEM.LOG1 Object is locked skipped

C:\Windows\System32\config\SYSTEM.LOG2 Object is locked skipped

C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.0.regtrans-ms Object is locked skipped

C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.1.regtrans-ms Object is locked skipped

C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.2.regtrans-ms Object is locked skipped

C:\Windows\System32\config\TxR\{250834b7-750c-494d-bdc3-da86b6e2101a}.TxR.blf Object is locked skipped

C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TM.blf Object is locked skipped

C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000001.regtrans-ms Object is locked skipped

C:\Windows\System32\config\TxR\{250834B7-750C-494d-BDC3-DA86B6E2101B}.TMContainer00000000000000000002.regtrans-ms Object is locked skipped

C:\Windows\System32\drivers\sptd.sys Object is locked skipped

C:\Windows\System32\LogFiles\Scm\SCM.EVM Object is locked skipped

C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\Windows\System32\ntoskrnl.exe Object is locked skipped

C:\Windows\System32\restore\MachineGuid.txt Object is locked skipped

C:\Windows\System32\spool\SpoolerETW.etl Object is locked skipped

C:\Windows\System32\sysprep\Panther\diagerr.xml Object is locked skipped

C:\Windows\System32\sysprep\Panther\diagwrn.xml Object is locked skipped

C:\Windows\System32\sysprep\Panther\setupact.log Object is locked skipped

C:\Windows\System32\sysprep\Panther\setuperr.log Object is locked skipped

C:\Windows\System32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof Object is locked skipped

C:\Windows\System32\wbem\Logs\WMITracing.log Object is locked skipped

C:\Windows\System32\wbem\repository\INDEX.BTR Object is locked skipped

C:\Windows\System32\wbem\repository\MAPPING1.MAP Object is locked skipped

C:\Windows\System32\wbem\repository\MAPPING2.MAP Object is locked skipped

C:\Windows\System32\wbem\repository\OBJECTS.DATA Object is locked skipped

C:\Windows\System32\winevt\Logs\ACEEventLog.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Application.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\DFS Replication.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\HardwareEvents.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Internet Explorer.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Key Management Service.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Media Center.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Networking%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Help%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-International%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LanguagePackSetup%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkAccessProtection%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReliabilityAnalysisComponent%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Leak-Diagnostic%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\ODiag.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\OSession.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Security.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\Setup.evtx Object is locked skipped

C:\Windows\System32\winevt\Logs\System.evtx Object is locked skipped

C:\Windows\Tasks\SCHEDLGU.TXT Object is locked skipped

C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6000.16386_none_c6660fc3aee34dc4\mcupdate.exe Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-chkdsk_31bf3856ad364e35_6.0.6000.16386_none_bfaf97e48fc56cbc\chkdsk.exe Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.0.6000.16386_none_cef7ceb03914a67f\dnary.xsd Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16386_none_69f99fa4b7380194\ntoskrnl.exe Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.16514_none_6a435250b701059d\ntoskrnl.exe Object is locked skipped

C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.0.6000.20629_none_6ac720a1d022400b\ntoskrnl.exe Object is locked skipped

Scan process completed.

[sunsword]

Questo il log di elibagle


Sat Sep 08 17:14:21 2007
EliBagle v10.51 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
Por favor, envienos una muestra del fichero
C:\Muestras\HIDR.EXE.Muestra EliBagle v10.51
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HIDR.EXE --> Eliminado Bagle

Sat Sep 08 17:14:27 2007
EliBagle v10.51 (c)2007 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\



Non ha però risolto niente, sembra che il virus si rigeneri automaticamente, inoltre non riuscva ad intervenire su alcuni file perchè vista gli negava l'accesso

[Luke57]

Scarica systemscan da qui:
http://www.suspectfile.com/systemscan
estrailo, avvialo, metti la spunta a tutte le voci e premi "Scan". poi vai su http://www.easy-share.com e metti lì il suo log (che trovi in C:\suspectfile\report.txt). POi dacci il link per scaricarlo (solo quello per scaricarlo, il primo che ti sarà fornito)


qualora systemscan non si avviasse per la mancanza di alcuni privilegi (il SeDebugPrivilege) scarica anche questo tool

http://download.bleepingcomputer.com/sU ... estore.exe

e usalo. poi riavvia il pc, dopo di che potrai usare systemscan

[sunsword]

Quando provo a scaricare systemscan mi dà questo messaggio:

Warning! You should have already downloaded the last Systemscan version (sys76375.exe).
If you can't download it probably your browser or your firewall is blocking popups.
Please enable popup on your PC and try again.
If you have already popup enabled, hold down the CTRL key and click on this link

Systemscan will be available within 53 seconds.

[sunsword]

Ho provato anche a disattivare il clocco pop up ma non riesco a scaricare il file

[sunsword]

Sono riuscito a scaricare il file usando il tasto destro.. adesso provo

[sunsword]

Ecco il link:

http://w13.easy-share.com/4992171.html

[sunsword]

Durante l'esecuzione systemscan mi ha dato i seguenti messaggi:

http://w13.easy-share.com/4992251.html

[Luke57]

Ecco il link:

http://w13.easy-share.com/4992171.html

Ciao, il report è venuto tutto alla rinfusa, praticamente illeggibile.
Carica nel medesimo sito il file .zip (data+ora+.zip) che troverai in C:\suspectfile e indica il relativo link per scaricarlo.

[sunsword]

http://w13.easy-share.com/4995771.html

[Luke57]

Ciao, con vissta avenger non può essere utilizzato.

Scarica Gmer da qui:
http://gmer.net/gmer.zip

Scarica ATF cleaner
http://www.atribune.org/ccount/click.php?id=1

Scompatta il file gmer.exe, chiudi applicazioni e antivirus, avvia il file, premi il tab>>>>, poi il tab.Rootkit, fra le voci presenti metti la spunta a files e a Services, premi scan. Al termine dello scan
se individui questo servizio:
srosa
click tasto dx e scegli delete
se individui questo file
C:\Windows\System32\drivers\srosa.sys
click tasto dx e scegli delete.

Apri il registro di sistema (start>esegui>regedit (lo scrivi nello spazio)>OK, clicchi sul segno + accanto alle singole voci e segui
questo percorso:
HKLM\SYSTEM\CurrentControlSet\Services individui il servizio
srosa
click tasto dx e scegli elimina (se non si facesse eliminare, click tasto dx Autorizzazioni>avanzate>proprietario, imposti la proprietà all'utente del computer>OK, metti la spunta a controllo completo e in lettura>OK.
A questo punto provi a eliminare la voce.

Utilizza ATF cleaner per la pulizia dei file temporane, lo apri, premi select all e empty selected. Alla fine arriva un messagio che il lavoro è concluso.
Riutilizza anche elibagla.

[sunsword]

Ciao! Scusa il ritardo nella risposta, ma era venuto quello dell'assistenza e dopo qualche tentativo di rimuovere il virus mi aveva ritirato il computer. Oggi sono passato al negozio: il tecnico è andato in congedo matrimoniale ed il padrone stava per spianarmi tutto con una bella formattazione... Così mi sono ripreso il pc e ho detto che avrei fatto qualche tentativo io... Ho seguito le tue dritte. Ho avviato Gmer e mi ha trovato diversi files srosa fino a che ad un certo punto si è bloccato... Ho resettato e riavviato in modalità provvisoria ed ho fatto girare di nuovo Gmer, funziona correttamente ma non trova nulla di anomalo, cerco srosa tra i servizi e cerco di rimuoverlo ma mi dà un errore. Faccio ancora un po' di giri anche con elibagle e ATF cleaner e poi riavvio in modalità normale; vado nella cartella dove c'è srosa (quando lo facevo prima mi si bloccava tutto e dovevo resettare) e lo elimino manualmente, evviva! Poi apro task manager e funziona! Prima si bloccava tutto! Riesco anche a reinstallare AVG, faccio una scansione completa, mi identifica i bagle e me li cancella. Tutto sembra tornato a posto quasi tutto tranne il centro di sicurezza del pc che non riesco a riattivare, così come windows defender, ho paura che il virus mi abbia cancellato degli eseguibili.. un'altra cosa, poi, anche la simpatica sidebar di vista non mi si carica più all'avvio... Come posso risolvere?
Ho letto che bagle cambia qualcosa nel registro e non fa funzionare le schede wireless, io la mia non la uso, ma devo fare qualcosa per non avere problemi in futuro?

[sunsword]

Ok.. lascia stare il discorso della sidebar... l'ho messa a posto... Il centro di sicurezza e windows defender invece non funzionano proprio

[sunsword]

Ok! Centro di sicurezza e windows defender riattivati, bastava andare nelle impostazioni e riavviare il computer... mi rimane il dubbio solo sulle schede wireless e poi un'altro dubbio, forse sono io che sto esagerando, quando compare la finestra che mi chiede se sono sicuro di procedere in vista, ad esempio quando apro una cartella protetta, è normale che mi compaia una finestra con le impostazioni ITA o ENG?