Non capisco che tipo di problema è

[Luke57]

Ho eliminato il virusssssssssssssssss!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Sono riuscito a far partire avenger!
Per farlo partire bisogna rinomainare la cartella zip, aprirla e aprire il file da dentreo senza estrarlo, Solo in questo modo non fa nessun errore!!
Ora ho rimesso avg, l'ho aggiornato e sto facendo una scansione di sicurezza

Ciao, complimenti per l'iniziativa, puoi postare il report di avenger, per cortesia?

[charmedangel]

Cavolo ho visto solo ora il tuo messaggio Luke e ormai ho ripulito tutto il pc (e quindi ho cancellato anche il rapporto)
Cmq ora funziona tutto! Ho installato kaspersky e dopo la scansione mi ha detto ke non ci sono virus, infatti ora tutti i programmi funzionano perfettamente

[q6600]

e'un virus che gira su emule la causa e' che windowse'impostato di base con i nomi dei file che non comprendono l'estensione nel tuo caso exe ma puo anche essere pif oppure cab.esempio scarichi una foto homer.jpg.exe ma tu vedi solo jpg lo consideri sicuro invece nasconde un eseguibile.adesso nel concreto non so come si modifica l'opzione di xp se qualcuno sa come fare ......

[andreadanor]

salve ragazzi .....io anche ho questo tipo di problema identico...solo che ho provatp a rinominare la kartella di avenger quella ke si skarika dalla pagina numero 1 ma mi dice sempre applicazione di win 32 non valida...che devo fare ???sto c***o di virus non mi si toglie ....aiutatemi ...se volete qui ce il mio contatto di msn andry91ct@hotmail.it

[charmedangel]

salve ragazzi .....io anche ho questo tipo di problema identico...solo che ho provatp a rinominare la kartella di avenger quella ke si skarika dalla pagina numero 1 ma mi dice sempre applicazione di win 32 non valida...che devo fare ???sto c***o di virus non mi si toglie ....aiutatemi ...se volete qui ce il mio contatto di msn andry91ct@hotmail.it

Oltre a rinominare la cartella zip, devi anche rinominare il file di avenger al suo interno PRIMA di estrarlo. Prova, vedrai che funziona

[charmedangel]

Vorrei anche ringraziare tutti quelli che mi hanno gentilmente aiutato qui sul forum! Grazie di tutto!!

[andreadanor]

ma non mi si rinomina ...giuro ....boh !!!! aiutooooooooooooo

[milan]

Ciao, penso che tu abbia xp come sistema operativo, altrimenti avenger non gira.
Scarica avenger sul desktop
http://swandog46.geekstogo.com/avenger.zip
Decomprimi l'archivio
Avvia il file avenger.exe
Seleziona l'opzione "Input Script Manually"
Clicca sulla lente di ingrandimento

Ti si apre una finestra "View/edit script"
All'interno del box bianco,copia e incolla le scritte seguenti (lo script che ti ho preparato è più ampio di quanto mostri kaspersky, per sicurezza):

files to delete:
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\SYSTEM32\WINTEMS.EXE.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE

folders to delete:
C:\WINDOWS\system32\drivers\down
C:\Documents and Settings\Proprietario\Impostazioni locali\Temp
C:\windows\temp
C:\WINDOWS\exefnd
C:\WINDOWS\exefld


registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA



Registry values to replace with dummy:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs



Clicca sul pulsante Done
Clicca sull'icona del semaforo verde
Rispondi ok e poi yes.
Il pc dovrebbe riavviarsi da solo, se così non fosse riavvialo manualmente.
Allega poi il log generato da avenger, lo trovi in C:\avenger.txt è un file di testo.

Fatto ciò disattiva il ripristino configurazione di sistema (tasto dx su risorse del computer>proprietà>ripristino configurazione di sistema>metti la spunta a disattiva>OK)
Al riavvio togli la spunta precedentemente immessa.

Scusami Luke57, avendo anch'io il problema di Charmedangel, cioe' un virus mi ha disattivato il norton.
Usando avenger devo copia incollare gli stessi script che hai postato tu in precedenza, o variano per il mio caso?

[Luke57]

Ciao, variano e poi anche altri virus disattivano l'antivrus, oltre al bagle.
Esegui una scansione on-line con kaspersky.
http://www.kaspersky.com/service?chapter=161739400
1.Clicca su Kaspersky Online Scanner
2.Scarica un componente ActiveX da Kaspersky, Clicca su "Yes."
3.Attendi la fine del download
4.Clicca su "Next"
5.Clicca su "Scan Settings"
6.Assicurati che siano spuntate le seguenti voci
Scan using the following Anti-Virus database:
Extended
spunta le voci di "Scan options"
Scan Archives
Scan Mail Bases
7.Clicca su "OK"
8.Scegli "My computer"
Attendi la fine della scansione,salva il rapporto cliccando su "Save as Text"

Posta il rapporto.

[andreadanor]

RAGAZZI IO HO FORMATTATO BEN 3 VOLTE IL PC ... NELLE PRIME DUE IL VIRUS ANKORA CAMPAVA MENTRE NELLA TERZA L'HO FOTTUTO ....ORA HO MONTATO L'AVAST KE MI DICE KE NON SONO PRESENTI VIRUS ...MA MI POTRESTE DARE UN ANTIVIRUS PIU POTENTE DELL'AVAST ??? ...E POI HO PAURA HA INSTALLARE EMULE VISTO KE IL VIRUS LO PRESO DA LI ---- KE MI KONSIGLIATE ???

[SkunkWorks 68]

RAGAZZI IO HO FORMATTATO BEN 3 VOLTE IL PC ... NELLE PRIME DUE IL VIRUS ANKORA CAMPAVA MENTRE NELLA TERZA L'HO FOTTUTO ....ORA HO MONTATO L'AVAST KE MI DICE KE NON SONO PRESENTI VIRUS ...MA MI POTRESTE DARE UN ANTIVIRUS PIU POTENTE DELL'AVAST ??? ...E POI HO PAURA HA INSTALLARE EMULE VISTO KE IL VIRUS LO PRESO DA LI ---- KE MI KONSIGLIATE ???

Appunto di lasciare perdere e-Mule(ovvio che se ti scarichi tutto il mondo ed .exe strani-ci siamo capiti ti becchi i virus).
-NON utilizzare Internet Explorer per navigare.
-Antivir PE come antivirus,Superantispyware e A-Squared free come antispyware sono ottimi.A pagamento direi Kaspersky.
-Sistema aggiornatissimo.
-Un router con tutte le porte del firewall "stealth" e buttare il modem USB(se hai l'USB).
-Riflettere sempre su quello che si fa e dove si clicca.
il 99% del lavoro è fatto
Ciao

[andreadanor]

beh io uso mozilla firefox , il sistema ce lo sempre aggiornato skarico sempre gli aggiornamenti , io ho il modem dell'alice purtroppo via usb ...ma se non uso quello il telefono di casa non funziona ...xcio ...

[salvo00786]

Ciao a tutti.
Mi sono appena iscritto.
Ho avuto anche io questo problema e l'ho risolto grazie ad Avenger.
Neanche a me partiva Avenger, però ho pensato che magari andando nel prompt dei comandi poteva partire, pechè il virus mi poteva bloccare esplora risorse ma non il prompt dei comandi.
Così sono andato nel prompt dei comandi e l'ho fatto partire da lì ed ha funzionato alla perfezione.
Spero che ciò vi aiuti.
Fatemi sapere.

[milan]

Ecco il report Luke57, enciclopedico

Infected Object Name Virus Name Last Action
H:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Object is locked skipped

H:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped

H:\Documents and Settings\Campi\Cookies\index.dat Object is locked skipped

H:\Documents and Settings\Campi\Dati applicazioni\m\data.oct Infected: Trojan-Downloader.Win32.Bagle.in skipped

H:\Documents and Settings\Campi\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Cronologia\History.IE5\MSHist012008012920080130\index.dat Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Dati applicazioni\Microsoft\Feeds Cache\index.dat Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Dati applicazioni\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temp\~DF2FC2.tmp Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temp\~DF2FCE.tmp Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_1[3].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_2[5].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\b64_3[8].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\2DKN05XP\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.ii skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_31[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.iv skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\mxd[2].jpg Infected: Trojan-Downloader.Win32.Bagle.ir skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\mxd[3].jpg Infected: Trojan-Downloader.Win32.Bagle.it skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\3V688RD0\mxd[4].jpg Infected: Trojan-Downloader.Win32.Bagle.iv skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\b64_3[9].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\67W55M30\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.ii skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_1[1].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\FF9W75CO\mxd[2].jpg Infected: Trojan-Downloader.Win32.Bagle.it skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\G9790HQZ\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[3].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[4].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[5].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[6].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_1[7].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_3[5].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_3[6].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\M97W7KMN\b64_3[7].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_2[2].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_2[3].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_2[4].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_2[5].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_2[6].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\QMA1NM7G\b64_3[8].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_1[3].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_1[4].jpg Infected: Trojan-PSW.Win32.LdPinch.ewq skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T33XWKXN\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.in skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\T52BLCW1\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64_1[1].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64_1[2].jpg Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64_3[1].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64_3[2].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64_3[3].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\b64_3[4].jpg Infected: Email-Worm.Win32.Bagle.of skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\VDHVXC2E\mxd[1].jpg Infected: Trojan-Downloader.Win32.Bagle.iv skipped

H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files\Content.IE5\Y94059U9\b64_2[1].jpg Infected: Trojan.Win32.Pakes.bwy skipped

H:\Documents and Settings\Campi\NTUSER.DAT Object is locked skipped

H:\Documents and Settings\Campi\ntuser.dat.LOG Object is locked skipped

H:\Documents and Settings\Campi\UserData\index.dat Object is locked skipped

H:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

H:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

H:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

H:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

H:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

H:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

H:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

H:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped

H:\Documents and Settings\NetworkService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped

H:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped

H:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

H:\Documents and Settings\NetworkService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

H:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

H:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

H:\Programmi\Windows Media Player\wmpnscfg.exe Infected: Trojan-Downloader.Win32.Bagle.ig skipped

H:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP411\A0283426.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP411\A0283427.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP411\A0283453.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP411\A0283454.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP411\A0284453.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0284487.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0284490.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0285487.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0285488.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0286489.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0286503.exe Infected: Trojan-Downloader.Win32.Bagle.ig skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0286504.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0286509.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0287504.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0287505.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0287543.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP412\A0287544.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287567.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287568.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287592.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287593.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287656.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287657.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287683.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP413\A0287684.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP414\A0287697.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP414\A0287698.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP415\A0287810.exe Infected: Trojan-Downloader.Win32.Bagle.ig skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP415\A0287815.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP416\A0291457.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP417\A0291485.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP417\A0291494.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP417\A0291495.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291500.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291501.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291502.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291643.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291644.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291645.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0291646.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0292643.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0292644.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP418\A0292645.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP419\A0292647.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP419\A0292651.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP419\A0292652.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP419\A0292794.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP421\A0292896.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP421\A0292897.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP421\A0292898.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP421\A0293065.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP421\A0293068.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP421\A0293069.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP423\A0293173.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP423\A0293174.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP423\A0293175.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP424\A0293183.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP424\A0293184.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP424\A0293185.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\A0293312.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\A0293313.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\A0293314.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\A0293334.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\A0293335.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\A0293336.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\System Volume Information\_restore{36CDCF7F-B98F-4F56-8BFC-780058BDA502}\RP426\change.log Object is locked skipped

H:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\$NtUninstallKB929338$\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

H:\WINDOWS\Driver Cache\i386\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\SchedLgU.Txt Object is locked skipped

H:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\Sti_Trace.log Object is locked skipped

H:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

H:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

H:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

H:\WINDOWS\system32\config\default Object is locked skipped

H:\WINDOWS\system32\config\default.LOG Object is locked skipped

H:\WINDOWS\system32\config\Internet.evt Object is locked skipped

H:\WINDOWS\system32\config\Paramete.evt Object is locked skipped

H:\WINDOWS\system32\config\SAM Object is locked skipped

H:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

H:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

H:\WINDOWS\system32\config\SECURITY Object is locked skipped

H:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

H:\WINDOWS\system32\config\software Object is locked skipped

H:\WINDOWS\system32\config\software.LOG Object is locked skipped

H:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

H:\WINDOWS\system32\config\system Object is locked skipped

H:\WINDOWS\system32\config\system.LOG Object is locked skipped

H:\WINDOWS\system32\dllcache\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\system32\drivers\down\103843.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14438781.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14442546.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14450656.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14456890.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14456921.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14464062.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14467281.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14561312.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14573625.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14574375.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14578265.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14579031.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14580484.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\14581250.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14584078.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14584218.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14589328.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14593968.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14596125.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14601109.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14609968.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14659578.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14670312.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14674765.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14676515.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14726281.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\14773437.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\14988531.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\15016562.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\19454343.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\19458687.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\19490687.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\23506671.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\23514968.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29129031.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29150031.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\29164859.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29345421.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29381328.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\29383875.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29756796.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29784906.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\29791453.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\29799843.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\43687.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\43935625.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\43959296.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\43963531.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\43966750.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\44609.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\44671.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\44750.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\44825328.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\44871671.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\44879093.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\48078.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\48421.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\49937.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\50531.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\50546.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\52109.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\53093.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\54343.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\54484.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\54890.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\55687.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\56187.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\56453.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\56828.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\56984.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\57093.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\58187.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\58328.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\58703.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\58968.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\59984.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\60078.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\60125.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\60578.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\61062.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\61500.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\61687.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\62437.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\62812.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\63328.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\63406.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\64531.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\64781.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\64906.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\65125.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\65281.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\65687.exe Infected: Trojan.Win32.Pakes.bwy skipped

H:\WINDOWS\system32\drivers\down\65812.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\66171.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\66265.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\67328.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\67593.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\68437.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\69125.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\69406.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\69437.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\69578.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\70734.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\70859.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\71781.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\71906.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\73046.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\73109.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\73296.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\73656.exe Infected: Trojan-PSW.Win32.Agent.xd skipped

H:\WINDOWS\system32\drivers\down\74140.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\74390.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\75484.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\75875.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\75921.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\77562.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\77671.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\79109.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\79640.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\80906.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\81781.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\down\86109.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\drivers\hldrrr.exe.vir Infected: Trojan-Downloader.Win32.Bagle.ig skipped

H:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

H:\WINDOWS\system32\h323log.txt Object is locked skipped

H:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped

H:\WINDOWS\system32\mdelk.exe Infected: Email-Worm.Win32.Bagle.of skipped

H:\WINDOWS\system32\ntoskrnl.exe Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

H:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

H:\WINDOWS\wiadebug.log Object is locked skipped

H:\WINDOWS\wiaservc.log Object is locked skipped

[Luke57]

Ciao, Scarica avenger sul desktop
http://swandog46.geekstogo.com/avenger.zip
Decomprimi l'archivio
Avvia il file avenger.exe
Seleziona l'opzione "Input Script Manually"
Clicca sulla lente di ingrandimento

Ti si apre una finestra "View/edit script"
All'interno del box bianco,copia e incolla le scritte seguenti :

files to delete:
H:\WINDOWS\system32\drivers\hldrrr.exe.
H:\WINDOWS\system32\mdelk.exe
H:\WINDOWS\SYSTEM32\WINTEMS.EXE.
H:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS

folders to delete:
H:\Documents and Settings\Campi\Dati applicazioni\m
H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files
H:\WINDOWS\system32\drivers\down
H:\windows\temp
H:\WINDOWS\exefnd
H:\WINDOWS\exefld


registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\srosa
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA



Registry values to replace with dummy:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs



Clicca sul pulsante Done
Clicca sull'icona del semaforo verde
Rispondi ok e poi yes.
Il pc dovrebbe riavviarsi da solo, se così non fosse riavvialo manualmente.
Allega poi il log generato da avenger, lo trovi in C:\avenger.txt è un file di testo.

Fatto ciò disattiva il ripristino configurazione di sistema (tasto dx su risorse del computer>proprietà>ripristino configurazione di sistema>metti la spunta a disattiva>OK)
Al riavvio togli la spunta precedentemente immessa.

[milan]

Scusa Luke57, abbi pazienza cosa vuol dire la frase:
Allega poi il log generato da avenger, lo trovi in C:\avenger.txt è un file di testo.

[Luke57]

Ciao, ho sbagliato, intendevo dire "copia e incolla il contenuto del file in un post" per verificare com'è andata.

[milan]

Ecco quello che mi hai chiesto Luke, da quel poco che ne capisco mi sembra di aver risolto ben poco o sbaglio.
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vetkuoko

*******************

Script file located at: \??\H:\WINDOWS\xmojyeiq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at H:\Avenger

*******************

Beginning to process script file:



File H:\WINDOWS\system32\drivers\hldrrr.exe. not found!
Deletion of file H:\WINDOWS\system32\drivers\hldrrr.exe. failed!

Could not process line:
H:\WINDOWS\system32\drivers\hldrrr.exe.
Status: 0xc0000034

File H:\WINDOWS\system32\mdelk.exe deleted successfully.


File H:\WINDOWS\SYSTEM32\WINTEMS.EXE. not found!
Deletion of file H:\WINDOWS\SYSTEM32\WINTEMS.EXE. failed!

Could not process line:
H:\WINDOWS\SYSTEM32\WINTEMS.EXE.
Status: 0xc0000034

File H:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS deleted successfully.
Folder H:\Documents and Settings\Campi\Dati applicazioni\m deleted successfully.
Folder H:\Documents and Settings\Campi\Impostazioni locali\Temporary Internet Files deleted successfully.
Folder H:\WINDOWS\system32\drivers\down deleted successfully.
Folder H:\windows\temp deleted successfully.


Folder H:\WINDOWS\exefnd not found!
Deletion of folder H:\WINDOWS\exefnd failed!

Could not process line:
H:\WINDOWS\exefnd
Status: 0xc0000034



Folder H:\WINDOWS\exefld not found!
Deletion of folder H:\WINDOWS\exefld failed!

Could not process line:
H:\WINDOWS\exefld
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Services\srosa deleted successfully.
Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA deleted successfully.
Registry value HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs replaced with dummy successfully.

Completed script processing.

*******************

Finished! Terminate.

[Luke57]

Ciao, alcuni file non c'erano, ma io li avevo inseriti nello script per sicurezza e, ovviamente, avenger non li ha trovati.
Tutti gli altri sono stati eliminati. Prova a reinstallare l'antivirus.

[milan]

Non riesco ad installarlo, mi dice che non e' un'applicazione Win 32 valida, solito discorso