shapiro ha scritto:ciao
se non mi sbaglio, sei la terza vittima del bagle in pochi giorni
segui attentamente i passaggi che dovrai fare
disattiva il tuo antivirus e il tuo antispywarescarica
http://www.4shared.com/file/75022994/b07bff/FindyKill.htmlDoppio click sull'icona Findykill per avviare l'installazione:
Inserisci la prima spunta per accettare la licenza e prosegui > Suivant
Clicca su "Si" per destinare una cartella al programma
Clicca su Dèmarrer > Quitter per terminare l'installazione.
Cerca l'icona del programma sul desktop o in programmi ed eseguilo
Dovrai usare prima il tasto 1 (invio) per la ricerca e successivamente il tanto 2 (invio) per la pulizia.
Il report delle operazioni effettuate lo trovarai in C:\FindyKill.txt
Allega il rapporto nella tua risposta.
Durante la pulizia ci saranno dei riavvii,e' del tutto normale
poi...
scarica questo programmino... il download lo trovi in fondo alla pagina
http://www.zonavirus.com/datos/descargas/95/elibagla.aspvai in modalita' provvisoria, visto che riesci ad andarci
lancia il programma e spunta '' ELIMINAR FICHEROS AUTOMATICAMENTE'' poi clicca sul tasto "Explorar" quando avrà finito genererà il report in file di testo C:\InfoSat.txt. che posterai qui nel forum
Per ogni chiarimento, sono qui
Ho fatto tutto quello che mi dicevi. Ecco i report:
----------------- FindyKill V4.707 ------------------
* User : Sony - PC-SONY
* executed from : C:\Program Files\FindyKill
* Update on 06/12/08 par Chiquitine29
* Start at 13:33:02 the 03/02/2009
* Windows Vista - Internet Explorer 7.0.6000.16546
((((((((((((((( *** deleting *** ))))))))))))))))))
--------------- [ Active Processes ] ----------------
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\LogonUI.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\runonce.exe
--------------- [ Infected files / folders ] ----------------
»»»» Supression files in C:
»»»» Supression files in C:\Windows
»»»» Supression files in C:\Windows\Prefetch
Deleted ! - C:\Windows\prefetch\PATCHMSI.EXE-538D92AF.pf
Deleted ! - C:\Windows\prefetch\PATCHWA.EXE-C303AE1A.pf
»»»» Supression files in C:\Windows\system32
Deleted ! - C:\Windows\system32\mdelk.exe
Deleted ! - C:\Windows\system32\wintems.exe
Deleted ! - C:\Windows\system32\ban_list.txt
»»»» Supression files in C:\Windows\system32\drivers
Deleted ! - C:\Windows\system32\drivers\srosa.sys
Deleted ! - C:\Windows\system32\drivers\srosa2.sys
Deleted ! - C:\Windows\system32\drivers\down\149979.exe
Deleted ! - C:\Windows\system32\drivers\down\239960.exe
Deleted ! - "C:\Windows\system32\drivers\down"
»»»» Supression files in C:\Users\Sony\AppData\Roaming
Deleted ! - "C:\Users\Sony\AppData\Roaming\m\flec006.exe"
Deleted ! - "C:\Users\Sony\AppData\Roaming\m\list.oct"
Deleted ! - "C:\Users\Sony\AppData\Roaming\m\data.oct"
Deleted ! - "C:\Users\Sony\AppData\Roaming\m\srvlist.oct"
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\642-352 - Cisco Storage Networking Support Specialist Practice Test Questions 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\646-229 - IP Communications Advanced Account Manager (IPCAAM) Practice Test Questions 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\A1 Jummfa Audio Converter 5.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\AB Complete Ping 3.00.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Acoobee Flash Album Builder 1.2.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Alias 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Antivir.Personal.Edition.Premium.7.Keygen.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Autohome 1.0.8.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Autumn Tree - Animated Screensaver 5.07.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Backword 2.0.0.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\BIDE 1.0.2.275.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Big Faceless Report Generator 1.1.34.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Blancco - Lite 4.6.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\boson.computer.associates.practice.tests.v5.12.jgt.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Cambodian Dictionary 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Capturix VideoSpy Control Center 1.4.61.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\CarCanRunOnWater 1.0.0.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\ClamWin 0.88 Antivir - rls 10.06.2006.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Classic Auto-Filter 1.01.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Convert For Windows 4.10.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Cucusoft iPhone Video Converter 7.08.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Cyber FLV Converter 2.0.0.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\dbzOutlookTray 1.5.32.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\DC Search 2.03.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Demi Moore 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Desktop Aqua 3D Screensaver 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Desktop Architect 2.11.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\DeviousTrillian 1.3.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Dog Screensaver.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Dr Parse 2.5.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Drive Explorer 1.01.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\DriveHQ Batch PhotoEditor 1.8.026.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Dynamics 0.9.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\DynWebLink 1.5.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\EasyPad 2007 Express Editor 2.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Enigma Browser 3.8.8.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Error Killer 2.6.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\eXPress Collage Album 5.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\ExpressionCalc 1.000.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Extended Clipboard 1.4.21.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\F1 2007 Countdown 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Forex Signal Live Alert System 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\FraudEliminator 2.4.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\GIF to AVI SWF Converter 1.9.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\HamCalc 1.3b.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Hide Tab Bar 0.2.2.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Holiday Recycle Bins 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\HyperLink Label 1.02.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\IECookiesView 1.73.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\InB Spy 6.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\ISRC Music Database 1.00.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\iStacker 1.0.301.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Jabir 3.0.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Jaguar X-Type Screensaver 1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\kaspersky internet security6.0.0.299 final+key.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Kaspersky.AntiVirus.Personal.5.0.156.Ita.+.manuale.+.licenza.scad.3.sett.07.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Keyword Live 2.20.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\KILY Lotto 2.06.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Lalim Compact Player 2.3.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\LingvoSoft Talking Dictionary 2006 English German 3.1.41.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Matrix Spatialiser 1422.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\MB Free Palmistry Compatibility 1.20.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Mcafee.Epolicy.Orchestrator.3.0.2A.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\MemAccess Library 1.3.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\MembDataPLUS 3.5.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\MiniBmpReader 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Monitor Folder For Changes Software 7.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\MRU-Blaster 1.5.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Multiple Applicator 6.8.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\My Personal Inventory 1.4.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\NewBlue 3D Transformations 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\nod32.2.5.espaÇñol.+.crack.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Nod32.v2.12.4.Crack.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Nokia Test Pattern Generator 2.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\OutWit Hub 0.8.1.172.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Particles 2.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\PasswordMaker Firefox Add-on 1.7.2.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\PC Link 1.00.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\PcRock 1.0 Beta 2.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\PDF Editor 2.6.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Pentacle In-Out Board 6.10.0.1211.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Phone 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\PingLookUp 2.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Playlistmaker 1.5.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Prevx1-R.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Publish Table to Word for SQL Server Standard 1.05.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Rainmakers Stream 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Random Cartoons 1.0.0.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Rapid Tag 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Reindeer Poop Screen Saver 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Relatives 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Remove Access Passwords 2.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\SciTE4D 1.74.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Sea Dog 1.2.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\SequBeat Pro 7.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Setup Studio 1.0.9.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\SigFree 1 Build 695.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Simply School US 3.0.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Sketch Effect 1.00.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Sketches of Egypt Screensaver 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Smart Card ToolSet PRO 3.4 Build 2.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Soft Power ShutDown 2.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\SoftPepper DVD to Zune Video Suite 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\SP ST 3.20.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\SP Tiny Notes 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Spartan Multi Clipboard 3.10.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Stellar Phoenix CDRom 2.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Stix n Stonz 1.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Sun.Mobile.Dictionary.And.Notebook.v3.5.S60.Java.Cracked-BiNPDA.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\symantec_ghost_solution_suite_2.0.part1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\the doors screensaver 01.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Transfer Calculator 1.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Trend Micro RUBotted Beta.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\ultratool toolbar for IE 4.5.132.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Unlocker 1.8.7.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Usenet Radio 1 build 25.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\VerMan's Art Converter 1.5.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Visual Video Converter 4.4.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\VolumeLock 2.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\WebCab Bonds for .NET 2.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Webniac 1.4.15.70.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\WebSeeker 6.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Win32Pad 1.5.10.4.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\WinTools.net Extra Edition 8.8.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Wireless Meter 1.0.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\XMen 2 3D Screensaver 2.01.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\XP Home Permissions Manager 2.3.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\Xteq GetDriveType 1.1.zip
Deleted ! - C:\Users\Sony\AppData\Roaming\m\shared\[0].seriale.+.crack.Panda.Platinum.e.Titanium.antivirus.2006.updated-fixed.06-2006.zip
Deleted ! - "C:\Users\Sony\AppData\Roaming\m\shared"
Deleted ! - "C:\Users\Sony\AppData\Roaming\m"
»»»» Supression files in C:\Users\Sony\AppData\Local\Temp
»»»» Supression files in C:\Users\Sony\Local Settings\Temporary Internet Files\Content.IE5
Deleted ! - C:\ProgramData\Skype\Plugins\Local Cache\7B5560BB781B40259A06350E9B643B6E_more.jpg
Deleted ! - C:\Users\All Users\Skype\Plugins\Local Cache\7B5560BB781B40259A06350E9B643B6E_more.jpg
Deleted ! - C:\Users\Sony\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OIUZ4RD3\b64_2[1].jpg
Deleted ! - C:\Users\Sony\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P0NZTMR6\b64_1[1].jpg
Deleted ! - C:\Users\Sony\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\P0NZTMR6\b64_3[1].jpg
Deleted ! - C:\Users\Sony\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PY28WAGY\b64_1[1].jpg
Deleted ! - C:\Users\Sony\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z9EAX0BF\b64[1].jpg
Deleted ! - C:\Users\Sony\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z9EAX0BF\b64_6[1].jpg
--------------- [ Registry / Infected keys ] ----------------
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S
--------------- [ States / Restarting of services ] ----------------
+- Services : [ Auto=2 / Request=3 / Disable=4 ]
Ndisuio - Type of startup = 3
EapHost - Type of startup = 2
Wlansvc - Type of startup = 2
SharedAccess - Type of startup = 2
wuauserv - Type of startup = 2
wscsvc - Type of startup = 2
WinDefend - Type of startup = 2
--------------- [ Cleaning removable drives ] ----------------
+- Informations :
C: - Unit… fissa
+- deleting files :
--------------- [ Registry / Mountpoint2 ] ----------------
-> Not found !
--------------- [ Searching Cracks / Keygen ] ----------------
---------------- ! End of report ! ------------------
Tue Feb 03 13:40:16 2009
EliBagle v12.17 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 2 de Febrero del 2009)
Lista de Acciones (por Acción Directa):
Tue Feb 03 13:40:21 2009
EliBagle v12.17 (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 2 de Febrero del 2009)
Lista de Acciones (por Exploración):
Explorando "C:\"
C:\$Recycle.Bin\S-1-5-21-1487980511-2100154818-2611834082-1003\$RW5CYIP.88\INSTALL.EXE --> Eliminado Bagle.dldr
C:\Program Files\Picasa2\PICASAMEDIADETECTOR.EXE --> Eliminado Bagle.dldr
C:\Users\Sony\AppData\Roaming\drivers\SROSA2.SYS --> Eliminado Bagle(rootkit)
C:\Users\Sony\AppData\Roaming\drivers\WINUPGRO.EXE --> Eliminado Bagle.dldr
C:\Users\Sony\AppData\Roaming\drivers\downld\291862.EXE --> Eliminado Bagle.dldr
C:\Users\Sony\AppData\Roaming\drivers\downld\429720.EXE --> Eliminado Bagle
Nº Total de Directorios: 11995
Nº Total de Ficheros: 76447
Nº de Ficheros Analizados: 13127
Nº de Ficheros Infectados: 6
Nº de Ficheros Limpiados: 6