Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

Sarà Bagle? Antivirus bloccati e aggiornamenti windows pure.. Opzioni
amexis
Inviato: Wednesday, January 20, 2010 3:16:21 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
d'oh!
salve, ho aperto una discussione nuova riguardo il mio problema postato anche qui
per non creare confusione nel topic precedente.
ieri sera, mentre scaricavo un programma via emule, purtroppo per me, il mio pc ha fermato antivirus e aggiornamenti windows e si è riavviato, mi sono reso conto che il virus era Bagle, o qulcosa di simile, perchè ho provato ad avviare peerguardian e mi diceva che il file exe dello stesso non era un'applicazione valida di windows.
ho postato nell'altra discussione il log di elibagle, ma posso postarlo anche qui.
Ora uso un'altro pc, ma il mio non mi permette di avviare antivirus o antimalware, mi chiude il browser se mi ritrovo in un sito di antivirus e non mi fa scaricare o aggiornare programmi antimalware.
aspetto una vostra mano, se è possibile.
Grazie mille
Sponsor
Inviato: Wednesday, January 20, 2010 3:16:21 PM

 
r16
Inviato: Wednesday, January 20, 2010 3:18:01 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80121

Scarica Findykill:
http://pagesperso-orange.fr/NosTools/Chiquitine29/Setup.exe
installa FindyKill .
chiudi tutte le eventuali applicazioni aperte (antivirus, firewall e programmi "residenti")
disconnettiti da Internet
sconnetti, fisicamente, il modem dal computer.
avvia il tool e digita F per impostare la lingua;
clicca su 2 - Suppression des fichiers infectieux (Eliminazione dei file infetti)
al termine dell'operazione verrà rilasciato un log: salvalo sul Desktop, e postalo qui.
P.S:
Potranno esserci dei riavvii, non preoccuparti, è il programma che stà lavorando.
amexis
Inviato: Wednesday, January 20, 2010 3:19:49 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
grazie mille

allora findkill è in corso come suggerito da voi..
il ripristino di sistema è disattivato da ieri notte Anxious
r16
Inviato: Wednesday, January 20, 2010 3:22:41 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
amexis ha scritto:
grazie mille

allora findkill è in corso come suggerito da voi..
il ripristino di sistema è disattivato da ieri notte Anxious

Bene.
Naturalmente, elimina il crack che ha generato il Bagle.
E svuota il cestino.
amexis
Inviato: Wednesday, January 20, 2010 3:49:44 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
si cancellata la patch d'oh!

ecco il log di findkill:

############################## | FindyKill V5.026 |

# User : Amexis (Administrators) # UNDERGROUND
# Update on 20/01/2010 by El Desaparecido
# Start at: 15.25.59 | 20/01/2010
# Website : http://pagesperso-orange.fr/NosTools/index.html
# Contact : FindyKill.Contact@gmail.com

# Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz
# Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
# AV : COMODO Antivirus 3.9 [ Enabled | Updated ]
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
# AV : AntiVir Desktop 9.0.1.32 [ Enabled | Updated ]
# FW : COMODO Firewall[ Enabled ]3.9

# C:\ # Disco rigido locale # 232,88 Go (56,67 Go free) # NTFS
# D:\ # Disco rigido locale # 465,75 Go (132,26 Go free) [Elements] # NTFS
# E:\ # Disco rimovibile
# F:\ # Disco CD-ROM
# G:\ # Disco CD-ROM

############################## | Active Processes |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\logonui.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\CDBurnerXP\NMSAccessU.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## | C: |

Deleted ! D:\autorun.inf
Deleted ! D:\Fisio\play\[PC Game] Pes2008 ITA + Crack + Seriale by Snap87\autorun.inf
Deleted ! D:\Programmi\Nero\Nero8\Nero Burning Rom\SecurDisc\Autorun.inf

################## | C:\WINDOWS |

Deleted ! C:\WINDOWS\mdelk.exe

################## | C:\WINDOWS\Prefetch |


################## | C:\WINDOWS\system32 |

Deleted ! C:\WINDOWS\system32\srosa2.sys
Deleted ! C:\WINDOWS\system32\wfsintwq.sys

################## | C:\WINDOWS\system32\drivers |


################## | C:\Documents and Settings\Amexis\Dati applicazioni |

Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\303156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\303437.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\303609.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\303875.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\304109.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\310859.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\338281.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\338781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\339000.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\340187.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\341546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\342234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\344687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\345937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\346578.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\346828.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\347046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\348406.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\348906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\349687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\350156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\350484.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\350687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\351468.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\351890.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\352593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\352765.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\353140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\353359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\354546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\355265.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\355453.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\355625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\356046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\356375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\356968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\357437.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\359156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\359812.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\360093.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\360312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\362171.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\363484.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\364046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\364390.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\364937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\365281.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\365546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\365734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\366156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\366406.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\366625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\366828.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\367937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\368562.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\369359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\370046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\370375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\370593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\370875.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\371093.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\372781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\373968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\375500.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\376968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\378671.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\381234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\381453.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\381656.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\382890.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\383312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\383546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\383750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\383968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\384156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\384375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\384546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\385515.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\386140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\386468.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\386718.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\386890.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\429218.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\429687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\430140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\431843.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\434265.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\434828.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\435234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\436812.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\438171.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\442750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\444312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\445062.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\445515.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\446156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\446359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\446687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\489125.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\490250.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\490875.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\492015.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\492343.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\492906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\493328.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\493953.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\494359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\494656.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\495671.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\497015.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\497984.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\498218.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\498390.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\498593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\504000.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\504421.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\547406.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\549000.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\593484.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\593812.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\614265.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\614484.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\616390.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\616593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\616781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\617171.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\617390.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\618078.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\618500.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\619218.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\622734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\623390.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\623734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\624000.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\624187.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\624781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\625203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\626562.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\627203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\627468.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\627625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\627937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\628203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\628437.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\628625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\629984.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\630671.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\630859.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\631062.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\631453.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\631671.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\632671.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\633125.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\638187.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\639625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\639968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\640140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\640421.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\640656.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\641140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\641453.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\641734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\641937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\642312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\645468.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\645906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\646093.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\646984.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\647609.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\648296.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\669015.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\670640.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\671343.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\673375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\674609.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\675078.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\675296.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\675515.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\675703.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\676312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\676750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\676875.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\677046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\677609.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\678031.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\678687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\679203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\679625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\679859.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\680093.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\680312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\681625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\682531.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\682781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\682984.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\683234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\683453.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\683921.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\684093.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\684375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\684593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\685328.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\685734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\685953.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\686140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\687796.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\688750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\689906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\690859.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\691125.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\691375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\691812.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\692234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\693875.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\694796.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\699546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\700312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\701468.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\702609.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\703234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\729062.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\730125.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\730859.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\731234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\731468.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\732015.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\732437.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\733312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\734234.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\735171.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\735656.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\736656.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\737375.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\737937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\780078.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\780750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\781140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\781546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\781750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\781968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\782125.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\782328.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\782515.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\784062.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\785515.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\786000.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\786218.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\786562.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\786781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\787765.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\788437.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\788734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\788968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\789968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\790531.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\790750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\790937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\791687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\792031.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\793203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\814437.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\814750.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\815000.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\815359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\815593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\815875.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\816062.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\816421.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\816562.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\816921.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\817140.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\817406.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\817625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\818156.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\818546.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\823187.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\824796.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\825625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\826109.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\826484.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\826734.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\830406.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\833250.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\833562.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\833812.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\834109.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\834328.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\834906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\835359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\835968.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\836312.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\837421.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\838109.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\839046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\839796.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\840718.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\841390.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\842062.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\884687.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\885781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\886421.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\887109.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\899171.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\899406.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\899640.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\899890.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\900046.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\900578.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\900984.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\907906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\934203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\936781.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\936984.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\937171.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\937796.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\938328.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\938906.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\939359.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\939625.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\939796.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\951203.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\964937.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\965531.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\966015.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld\966593.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\downld
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers\winupgro.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\drivers
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\m\flec006.exe
Deleted ! C:\Documents and Settings\Amexis\Dati applicazioni\m

################## | Reference of comparaison Bagle MD5 : |

File : C:\Documents and Settings\Amexis\Dati applicazioni\drivers\winupgro.exe
-> Crc32 : 25eeea8c | Md5 : 6f45666073be0bb694c2eb6b9b541326


################## | Other deleting ... |

Deleted ! "C:\Programmi\Windows Live\Messenger\msnmsgr.exe"
-> Size : 845312 | Crc32 : 25eeea8c | Md5 : 6f45666073be0bb694c2eb6b9b541326


################## | Zip File |

################## | Temporary Internet Files |


################## | Registry |

Deleted ! [HKLM\SYSTEM\ControlSet003\Services\sK9Ou0s]
Deleted ! [HKLM\SYSTEM\ControlSet003\Services\srosa]
Deleted ! [HKLM\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S]
Deleted ! [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA]
Deleted ! [HKCU\Software\bisoft]
Deleted ! [HKCU\Software\WS4001]
Deleted ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "drvsyskit"
Deleted ! [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] "eMuleAutoStart"
Deleted ! [HKCU\Software\Local AppWizard-Generated Applications\patch]
Deleted ! [HKCU\Software\Local AppWizard-Generated Applications\winupgro]

################## | State |

# Safe boot mode restored restauré !

# Showing of hidden files : OK

# Ndisuio -> Start = 3 ( Good = 3 | Bad = 4 )
# EapHost -> Start = 2 ( Good = 2 | Bad = 4 )
# Ip6Fw -> Start = 2 ( Good = 2 | Bad = 4 )
# SharedAccess -> Start = 2 ( Good = 2 | Bad = 4 )
# wuauserv -> Start = 2 ( Good = 2 | Bad = 4 )
# wscsvc -> Start = 2 ( Good = 2 | Bad = 4 )

################## | PEH |

Corrupted : C:\Documents and Settings\Amexis\Desktop\avenger.exe
[Offset = 00000084 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Desktop\ComboFix.exe
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avenger.exe
[Offset = 00000084 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avadmin.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avcenter.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avconfig.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avgnt.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avguard.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avnotify.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\avscan.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\guardgui.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\licmgr.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\sched.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\update.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Download\avira_antivir_personal_it\basic\wsctool.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Downloads\avenger.exe
[Offset = 00000084 - Value = 0x0001]

Corrupted : C:\Documents and Settings\Amexis\Documenti\Downloads\ComboFix.exe
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Programmi\a-squared Free\a2cmd.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\a-squared Free\a2service.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\a-squared Free\a2upd.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avadmin.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avcenter.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avconfig.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avgnt.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avguard.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avnotify.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\avscan.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\guardgui.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\licmgr.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\sched.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\update.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\Avira\AntiVir Desktop\wsctool.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\COMODO\COMODO Internet Security\cfp.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\COMODO\COMODO Internet Security\repair\cfp.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : C:\Programmi\COMODO\COMODO Internet Security\repair\cmdagent.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : C:\Programmi\Mozilla Firefox\uninstall\helper.exe
[Offset = 000000E4 - Value = 0x0001]

Corrupted : C:\Programmi\Mozilla Thunderbird\uninstall\helper.exe
[Offset = 000000DC - Value = 0x0001]

Corrupted : C:\Programmi\PeerGuardian2\pg2.exe
[Offset = 000000EC - Value = 0x0001]

Corrupted : C:\Programmi\SeaMonkey\uninstall\helper.exe
[Offset = 000000E4 - Value = 0x0001]

Corrupted : C:\Programmi\Spybot - Search & Destroy\blindman.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\Spybot - Search & Destroy\Update.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
[Offset = 000000C4 - Value = 0x0001]

Corrupted : C:\WINDOWS\$hf_mig$\KB898461\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB923561\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB925720\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB935448\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB938464-v2\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB944338-v2\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB946648\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB950762\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB950974\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB951066\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB951748\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB951978\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB952004\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB952287\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB952954\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB954600\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB955069\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB955759\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB955839\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB956572\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB956744\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB956802\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB956803\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB956844\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB957097\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB958470\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB958644\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB958687\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB959426\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB960225\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB960803\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB960859\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB961118\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB961371-v2\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB961501\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB961503\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB967715\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB968389\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB968537\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB969059\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB969947\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB970238\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB970430\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971032\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971486\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971557\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971633\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971657\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971737\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB971961-IE8\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB972260\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB972260-IE8\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB972270\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973346\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973354\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973507\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973525\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973687\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973815\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973869\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973874-IE8\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB973904\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB974112\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB974318\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB974392\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB974455-IE8\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB974571\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB975025\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB975467\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB976325-IE8\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$hf_mig$\KB976749-IE8\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\$NtServicePackUninstall$\sysinfo.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : sysinfo.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\ServicePackFiles\i386\sysinfo.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : sysinfo.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\073a8e9684d59d4923c2eb2e44aa36af\sysinfo.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : sysinfo.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\073a8e9684d59d4923c2eb2e44aa36af\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\1c57286547777ed4a1845a59f61e7d63\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\33a664f18e233a84884543a7e5985e37\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\4d40bfab1d710986709e52e1694bc807\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\621b6f22a3ca6c2a43eb12ba7900d16e\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\b365e4b89c289bd2152c22485f4bb086\update\update.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\SoftwareDistribution\Download\fd47314639ee5083d59f6093da5cf674\update\update.exe
[Offset = 000000EC - Value = 0x0001]

Attempt of repair...
Backup : update.exe.REN
[Offset = 000000EC - New value = 0x4C01]
File repaired successfully.


Corrupted : C:\WINDOWS\system32\dllcache\register.exe
[Offset = 000000E4 - Value = 0x0001]

Attempt of repair...
Backup : register.exe.REN
[Offset = 000000E4 - New value = 0x4C01]
File repaired successfully.


Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avadmin.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avcenter.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avconfig.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avgnt.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avguard.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avnotify.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\avscan.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\guardgui.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\licmgr.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\sched.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\update.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : D:\Documenti\Download\avira_antivir_personal_it\basic\wsctool.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\a-squared Anti-Dialer\a2service.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\a-squared Anti-Dialer\a2upd.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\a-squared Free\a2cmd.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\a-squared Free\a2service.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\a-squared Free\a2upd.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashAvast.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashChest.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashDisp.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashLogV.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashPopWz.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashQuick.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashServ.exe
[Offset = 0000012C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashSimp2.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashSimpl.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashSkPcc.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashSkPck.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashUpd.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\ashWebSv.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\aswRegSvr.exe
[Offset = 000000D4 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\sched.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\VisthLic.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Programmi\Alwil Software\Avast4\VisthUpd.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avadmin.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avcenter.exe
[Offset = 00000144 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avconfig.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avnotify.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\avscan.exe
[Offset = 0000012C - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\guardgui.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\licmgr.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\preupd.exe
[Offset = 00000124 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\update.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Avira\AntiVir PersonalEdition Classic\wsctool.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\ClamWin\bin\clamscan.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\ClamWin\bin\ClamTray.exe
[Offset = 000000D4 - Value = 0x0001]

Corrupted : D:\Programmi\ClamWin\bin\ClamWin.exe
[Offset = 000000D4 - Value = 0x0001]

Corrupted : D:\Programmi\ClamWin\bin\freshclam.exe
[Offset = 000000F4 - Value = 0x0001]

Corrupted : D:\Programmi\ClamWin\bin\sigtool.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\ClamWin\bin\WClose.exe
[Offset = 000000D4 - Value = 0x0001]

Corrupted : D:\Programmi\COMODO\COMODO Internet Security\cfp.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\COMODO\COMODO Internet Security\Repair\cfp.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\COMODO\COMODO Internet Security\Repair\cmdagent.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\PAC207\Monitor.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\PAC207\PXIINST32\Remover.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\PAC207\PXIINST64\Remover.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\Softwin\BitDefender Update Service\bdsubmit.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe
[Offset = 00000124 - Value = 0x0001]

Corrupted : D:\Programmi\File comuni\Softwin\BitDefender Update Service\upgrepl.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Mozilla Firefox\uninstall\helper.exe
[Offset = 000000DC - Value = 0x0001]

Corrupted : D:\Programmi\Mozilla Thunderbird\uninstall\helper.exe
[Offset = 000000DC - Value = 0x0001]

Corrupted : D:\Programmi\PeerGuardian2\pg2.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\Softwin\BitDefender10\bdagent.exe
[Offset = 000000FC - Value = 0x0001]

Corrupted : D:\Programmi\Softwin\BitDefender10\bdmcon.exe
[Offset = 00000114 - Value = 0x0001]

Corrupted : D:\Programmi\Softwin\BitDefender10\bdsubmit.exe
[Offset = 0000010C - Value = 0x0001]

Corrupted : D:\Programmi\Softwin\BitDefender10\bdwizreg.exe
[Offset = 0000011C - Value = 0x0001]

Corrupted : D:\Programmi\Softwin\BitDefender10\vsserv.exe
[Offset = 0000012C - Value = 0x0001]

Corrupted : D:\Programmi\Spybot - Search & Destroy\blindman.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\Spybot - Search & Destroy\Update.exe
[Offset = 00000104 - Value = 0x0001]

Corrupted : D:\Programmi\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
[Offset = 0000012C - Value = 0x0001]

Corrupted : D:\Programmi\Trend Micro\HijackThis\HijackThis.exe
[Offset = 000000C4 - Value = 0x0001]


################## | End of Report # FindyKill V5.026 ! |

paolopa
Inviato: Wednesday, January 20, 2010 3:57:03 PM

Rank: AiutAmico

Iscritto dal : 10/14/2008
Posts: 2,777
se avevi pendrive o hd esterni collegati sara' il caso che non li ricolleghi...
amexis
Inviato: Wednesday, January 20, 2010 3:58:46 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
ho un disco esterno collegato, ma c'era la momento dell'infezione, quindi vorrei disinfettare anche quello se è possibile
grazie ancora per l'aiuto
r16
Inviato: Wednesday, January 20, 2010 4:01:31 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Disistalla questi software in quanto danneggiati:
Avira
a-squared
COMODO
Mozilla Firefox
Mozilla Thunderbird
PeerGuardian2
Spybot - Search & Destroy
Combofix
Avenger
Avast4
ClamWin
PAC207
Softwin\BitDefender Update
SUPERAntiSpyware
HijackThis

Per favore, non stò scherzando, DEVI rimuoverli TUTTI, in quanto sono stati corrotti dal Beagle.
Poi:

Dai una pulita (registro compreso)con CCleaner: http://www.aiutamici.com/software?ID=11223
Nella schermata iniziale di CCleaner, clicca su Opzioni e poi Avanzate, togli il segno di spunta a: Cancella i file in Windows Temp solo se più vecchi di 48 ore. (poi esegui le pulizie)

Scarica ed installa MalwareBytes:
clicca qui per il download : http://www.aiutamici.com/software?id=80346
Prima di fare la scansione AGGIORNALO. (è molto importante)
Esegui una scansione completa del sistema.
Elimina gli eventuali file infetti che trova, e riavvia il pc.
Posta il log.

P.S:
NON collegare l'HD esterno.
Ci penseremo dopo.
amexis
Inviato: Wednesday, January 20, 2010 4:03:57 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
Applause
faccio tutto come dici tu, speriamo che il mio pc mi faccia scaricare MalwareBytes

appena facci vi do notizia Anxious
r16
Inviato: Wednesday, January 20, 2010 4:06:49 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
amexis ha scritto:
Applause
faccio tutto come dici tu, speriamo che il mio pc mi faccia scaricare MalwareBytes
appena facci vi do notizia Anxious

Non preoccuparti, vedrai che lo scarichi.
L'importante,è che tu esegua alla lettera le indicazioni che ti dò.

Quando è finita la scansione con Malwarebytes, fai questi controlli:

Start\Esegui\ digita: services.msc
Si apre la pagina dei "Servizi"
Controlla se TUTTI questi "Servizi" siano avviati, e siano in Automatico:
Avvisi, Centro sicurezza PC, Aggiornamenti automatici, Connessioni di rete, Zero Configuration reti senza fili e Windows Firewall/ Condivisione connessione Internet (ICS).
Se ne trovi qualcuno in "Manuale, o Disabilitato, lo riporti in Automatico, ricorda di RIAVVIARE il pc.
Per avviare un servizio, clicca con il tasto destro sul servizio, Proprietà >Automatico > Ok > Avvia > Ok.
paolopa
Inviato: Wednesday, January 20, 2010 4:11:41 PM

Rank: AiutAmico

Iscritto dal : 10/14/2008
Posts: 2,777
@r16:tanto che aspetti...questi virus si attivano semplicemente scaricandoli o devi aprire cio che hai scaricato?approfitto sempre,scusami.
r16
Inviato: Wednesday, January 20, 2010 4:25:48 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
paolopa ha scritto:
@r16:tanto che aspetti...questi virus si attivano semplicemente scaricandoli o devi aprire cio che hai scaricato?approfitto sempre,scusami.

Ma non preoccuparti, non è un disturbo.....Drool
No, lo devi aprire. (a meno che non si apra in automatico)
Il Beagle si prende quando apri il file.
Prima di aprirlo, si deve scansionarlo, con TUTTI i software di difesa che si ha installato.
Può NON essere rilevato, ma è difficile che sfugga a tutti.
paolopa
Inviato: Wednesday, January 20, 2010 4:31:56 PM

Rank: AiutAmico

Iscritto dal : 10/14/2008
Posts: 2,777
grazie infinite,piano piano mi chiarisco un po le idee!!!era anche il mio pensiero,ma avendo letto all inizio:"mentre scaricavo un programma..."
mi sono venuti dei dubbi
r16
Inviato: Wednesday, January 20, 2010 4:38:56 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Commenta:
:"mentre scaricavo un programma..."

Non lo stava scaricando......
Lo aveva già scaricato e aperto.
Il Beagle, per eseguire "pienamente" le sue funzioni, ci impiega una media di 10-15 minuti.
Questo è uno dei motivi, per cui, è quasi sempre, "Accompagnato" da altre infezioni. (per prendere tempo)
Quindi, lo ha scaricato e aperto.
Che poi in quel momento, stesse scaricando da E-Mule, non ha importanza.

@Per amexis
Devo scappare....
Quando hai finito di eliminare i file che trova Malwarebytes (posta il log ):

Fai:
Scarica Combofix

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


Salvalo sul desktop.

Importante: Disabilita il tuo antivirus e chiudi TUTTI i programmi aperti,(Firewall compreso) e dopo aver scaricato COMBOFIX, chiudi la connessione.

Doppio click su combofix.exe (comparirà una videata.)
Se ti verrà chiesto se vuoi Installare LA CONSOLE DI RIPRISTINO DI EMERGENZA, clicca NO.
E' probabile che ti siano inviati messaggi dall'antivirus, tu ignorali.
Durante l'operazione di scansione è importante non usare il PC (neanche il mouse) e attendere pazientemente la fine delle operazioni.
Al termine, verrà creato un file log sul Desktop, chiamato C:\ComboFix.txt. Postalo qui.
amexis
Inviato: Wednesday, January 20, 2010 5:07:41 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
scusa posso spostare i messaggi di posta di thunderbird? o sono infetti anche loro?

si stavo scaricando è un sardismo che non riesco a togliermi d'oh!
chiedo scusa...
lo avevo scaricato, fatto scansione con comodo e avira, non c'era nulla di sospetto ed allora sono partito!
log di malwarebytes:

Malwarebytes' Anti-Malware 1.44
Versione del database: 3603
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

20/01/2010 20.09.47
mbam-log-2010-01-20 (20-09-47).txt

Tipo di scansione: Scansione completa (C:\|)
Elementi scansionati: 286160
Tempo trascorso: 1 hour(s), 5 minute(s), 34 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 4

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\32788R22FWJFW\Combo-Fix.sys (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amexis\Desktop\Fisio\patch connessioni\EvID4226Patch.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amexis\Documenti\EvID4226Patch.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amexis\Documenti\Download\EvID4226Patch.exe (Malware.Tool) -> Quarantined and deleted successfully.

r16
Inviato: Wednesday, January 20, 2010 8:12:07 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Non lo sò se sono infetti anche i messaggi di thunderbird.
Il Beagle di solito attacca gli eseguibili. (.exe)
Non credo siano infetti, ma......
Aspetto la scansione con Combofix.
amexis
Inviato: Wednesday, January 20, 2010 8:25:32 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
una cosa strana, ho disinstallato avira e comodo, eppure Combofix dice che sono attivi Anxious
r16
Inviato: Wednesday, January 20, 2010 8:27:50 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Fregatene.
Continua per la tua strada.
amexis
Inviato: Wednesday, January 20, 2010 9:07:04 PM
Rank: AiutAmico

Iscritto dal : 1/20/2010
Posts: 31
allora istruzioni eseguite alla lettera, ecco il log di combofix:
ComboFix 10-01-19.08 - Amexis 20/01/2010 20.55.56.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.39.1040.18.2046.1690 [GMT 1:00]
Eseguito da: c:\documents and settings\Amexis\Documenti\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {00000002-0002-0000-14EF-9D7C08000A00}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {001300D4-0000-0000-1000-00006C4D927C}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {001300D4-0000-0000-1000-00007454927C}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {001300D4-0000-0000-1000-00007C52927C}
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\InfoSat.txt
C:\LOG.TXT
C:\Muestras
c:\muestras\WINUPGRO.EXE.Muestra EliBagle v13.44
c:\windows\system32\advapi32new.dll
c:\windows\system32\apphelpnew.dll
c:\windows\system32\crypt32new.dll
c:\windows\system32\d3d10core.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\dxgi.dll
c:\windows\system32\kernel32new.dll
c:\windows\system32\msvcrtnew.dll
c:\windows\system32\ntdsapinew.dll
c:\windows\system32\powrprofnew.dll
c:\windows\system32\secur32new.dll
c:\windows\system32\user32new.dll
c:\windows\system32\winstanew.dll

.
((((((((((((((((((((((((( Files Creati Da 2009-12-20 al 2010-01-20 )))))))))))))))))))))))))))))))))))
.

2010-01-20 19:15 . 2010-01-20 19:15 -------- d-----w- c:\documents and settings\Amexis\Impostazioni locali\Dati applicazioni\Scansoft
2010-01-20 17:59 . 2010-01-20 17:59 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\Malwarebytes
2010-01-20 17:59 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 17:59 . 2010-01-20 17:59 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-20 17:59 . 2010-01-20 19:09 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2010-01-20 17:59 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 14:47 . 2010-01-20 01:10 14848 -c--a-w- c:\windows\system32\dllcache\register.exe.REN
2010-01-20 13:59 . 2010-01-20 14:48 -------- d-----w- C:\FindyKill
2010-01-20 00:23 . 2010-01-20 00:23 -------- d-----w- C:\SOPHTEMP
2010-01-16 16:17 . 2010-01-16 16:17 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\Artisteer
2010-01-12 18:42 . 2009-11-21 15:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-20 16:07 . 2009-08-29 11:33 -------- d-----w- c:\programmi\a-squared Free
2010-01-20 01:39 . 2009-08-21 08:36 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-01-20 01:03 . 2009-08-22 18:32 -------- d-----w- c:\programmi\SeaMonkey
2010-01-20 00:04 . 2009-08-22 12:55 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\FileZilla
2010-01-19 23:48 . 2009-08-22 13:23 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\vlc
2010-01-19 14:49 . 2009-09-03 11:07 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\uTorrent
2010-01-16 16:36 . 2009-08-26 15:58 1 ----a-w- c:\documents and settings\Amexis\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-13 01:29 . 2009-08-21 12:33 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\Skype
2010-01-12 23:00 . 2009-08-21 12:34 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\skypePM
2010-01-08 00:16 . 2009-11-27 16:13 -------- d-----w- c:\documents and settings\Amexis\Dati applicazioni\gtk-2.0
2010-01-07 16:13 . 2009-08-22 12:55 -------- d-----w- c:\programmi\FileZilla FTP Client
2009-12-21 14:26 . 2009-12-21 14:25 -------- d-----w- c:\programmi\File comuni\Concord
2009-12-20 11:28 . 2001-08-31 15:00 79514 ----a-w- c:\windows\system32\perfc010.dat
2009-12-20 11:28 . 2001-08-31 15:00 479180 ----a-w- c:\windows\system32\perfh010.dat
2009-12-10 13:28 . 2009-08-20 22:24 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-07 00:23 . 2009-08-22 15:21 -------- d-----w- c:\programmi\DivX
2009-12-07 00:21 . 2009-08-22 15:21 -------- d-----w- c:\programmi\File comuni\DivX Shared
2009-11-30 14:36 . 2009-11-30 14:36 -------- d-----w- c:\programmi\Risorse di Windows Mobile
2009-11-30 14:26 . 2009-11-30 14:26 -------- d-----w- c:\programmi\Microsoft ActiveSync
2009-11-29 14:50 . 2009-11-29 14:50 -------- d-----w- c:\programmi\Password Recovery for FileZilla
2009-11-27 16:09 . 2009-11-27 16:09 -------- d-----w- c:\programmi\GIMP-2.0
2009-11-21 15:54 . 2004-08-19 13:39 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx0c.dll
2009-11-14 00:47 . 2009-11-14 00:47 856064 ----a-w- c:\windows\system32\divx_xx07.dll
2009-11-14 00:47 . 2009-11-14 00:47 847872 ----a-w- c:\windows\system32\divx_xx0a.dll
2009-11-14 00:47 . 2009-11-14 00:47 843776 ----a-w- c:\windows\system32\divx_xx16.dll
2009-11-14 00:47 . 2009-11-14 00:47 839680 ----a-w- c:\windows\system32\divx_xx11.dll
2009-11-14 00:47 . 2009-11-14 00:47 696320 ----a-w- c:\windows\system32\DivX.dll
2009-11-05 12:15 . 2009-11-05 12:15 152576 ----a-w- c:\documents and settings\Amexis\Dati applicazioni\Sun\Java\jre1.6.0_17\lzma.dll
2009-10-29 07:40 . 2004-08-19 13:39 916480 ----a-w- c:\windows\system32\wininet.dll
2008-03-09 05:25 . 2009-08-24 10:26 236 ---ha-w- c:\programmi\File comuni\dx.reg
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 16116224]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"nwiz"="c:\programmi\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"googletalk"="c:\programmi\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SSBkgdUpdate"="c:\programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\programmi\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="c:\programmi\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PPort11reminder"="c:\programmi\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528]
"BrMfcWnd"="c:\programmi\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552]
"ControlCenter3"="c:\programmi\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Amexis\Menu Avvio\Programmi\Esecuzione automatica\
OpenOffice.org 3.1.lnk - c:\programmi\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Alcmtr"=ALCMTR.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\SiSoftware\\SiSoftware Sandra Lite 2009.SP4\\RpcAgentSrv.exe"=
"c:\\Programmi\\SiSoftware\\SiSoftware Sandra Lite 2009.SP4\\WNt500x86\\RpcSandraSrv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\Google\\Google Talk\\googletalk.exe"=
"c:\\Programmi\\KONAMI\\Pro Evolution Soccer 2009\\pes2009.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\programmi\Microsoft ActiveSync\rapimgr.exe"= c:\programmi\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programmi\Microsoft ActiveSync\wcescomm.exe"= c:\programmi\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programmi\Microsoft ActiveSync\WCESMgr.exe"= c:\programmi\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [24/08/2009 20.01.33 721904]
S2 gupdate1ca233c3878e55c;Servizio di Google Update (gupdate1ca233c3878e55c);c:\programmi\Google\Update\GoogleUpdate.exe [22/08/2009 16.21.24 133104]
S3 ABIT-IO;ABIT-IO;c:\programmi\U-ABIT\abitEQ\ABIT-IO.sys [14/09/2009 11.14.29 4608]
S3 PhSerUsb;PHILOG USB Serial Driver;c:\windows\system32\drivers\PhSerUsb.sys [22/08/2009 13.27.34 48896]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\programmi\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe [22/08/2009 18.49.33 99176]
S4 a2free;a-squared Free Service;"c:\programmi\a-squared Free\a2service.exe" --> c:\programmi\a-squared Free\a2service.exe [?]
.
Contenuto della cartella 'Scheduled Tasks'

2010-01-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-08-22 15:21]

2010-01-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programmi\Google\Update\GoogleUpdate.exe [2009-08-22 15:21]

2010-01-20 c:\windows\Tasks\User_Feed_Synchronization-{163A85C3-4C29-4F5E-8D57-4889DE3E5F0D}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 02:31]
.
.
------- Scansione supplementare -------
.
TCP: {DF490776-D897-4C9C-BB4F-699105337E78} = 208.67.222.222,208.67.220.220
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-20 21:02
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2010-01-20 21:03:59
ComboFix-quarantined-files.txt 2010-01-20 20:03

Pre-Run: 72.390.643.712 byte disponibili
Post-Run: 72.375.328.768 byte disponibili

- - End Of File - - 9D1A1CBB76C2A99A2ECFA99EE10B1961
Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.