Olimpo Informatico

[lori63]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\qfcsajwh

*******************

Script file located at: \??\C:\suhbugnl.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\Programmi\eMule\Incoming\file scaricatiemule\Ron & Friends - Ma Quando Dici Amore.rar deleted successfully.
File C:\Programmi\eMule\Incoming\file scaricatiemule\Discografia completa - Samuele Bersani.rar deleted successfully.
File C:\Documents and Settings\Vasile\Dati applicazioni\Microsoft\Internet Explorer\Quick Launch\Mostra Desktop.rar deleted successfully.
File C:\Documents and Settings\Vasile\RGShell.dll deleted successfully.
File C:\Documents and Settings\Vasile\todd.exe deleted successfully.
File C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[2].exe deleted successfully.
File C:\WINDOWS\abf41.txt deleted successfully.
File C:\WINDOWS\system32\tapi34.dll deleted successfully.
File C:\WINDOWS\system32\unyf09.dll deleted successfully.
File C:\WINDOWS\system32\041.dll deleted successfully.
File C:\WINDOWS\system32\53481.exe deleted successfully.
File C:\WINDOWS\system32\RGShell.dll deleted successfully.
Folder C:\Documents and Settings\Vasile\Impostazioni locali\Temp deleted successfully.
Folder C:\WINDOWS\Temp deleted successfully.


Could not open file D:\fle completati emule\BRASIL la grande musica brasiliana (completa n.8 CDs).rarC:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[3].exe for deletion
Deletion of file D:\fle completati emule\BRASIL la grande musica brasiliana (completa n.8 CDs).rarC:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[3].exe failed!
Status: 0xc0000033

Completed script processing.

*******************

Finished! Terminate.

--------------------------------

ECCO IL LOG!

GRAZIE..

[ste_95]

c'era un piccolo errore nello script precedente...esegui ancora questo:

Files to delete:
D:\fle completati emule\BRASIL la grande musica brasiliana (completa n.8 CDs).rar
C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[3].exe
C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[2].exe

[lori63]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\giqhvwtd

*******************

Script file located at: \??\C:\WINDOWS\system32\tqlhvtac.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at c:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[3].exe for deletion
Deletion of file C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[3].exe failed!

Could not process line:
C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[3].exe
Status: 0xc000003a



Could not open file C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[2].exe for deletion
Deletion of file C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[2].exe failed!

Could not process line:
C:\Documents and Settings\Vasile\Impostazioni locali\Temp\Temporary Internet Files\Content.IE5\IZSLJFUD\miniup[2].exe
Status: 0xc000003a

File D:\fle completati emule\BRASIL la grande musica brasiliana (completa n.8 CDs).rar deleted successfully.

Completed script processing.

*******************

Finished! Terminate.
-----------------------------------------------------------

Ecco fatto.

come va? è grave?

[Orange]

Aggiungi anche questo:

[lori63]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\gaistext

*******************

Script file located at: \??\C:\Documents and Settings\fnaujqyi.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\system32\drivers\xggsq.sys deleted successfully.
File C:\WINDOWS\system32\drivers\iak43w.sys deleted successfully.
File C:\WINDOWS\system32\imrur.dll deleted successfully.
File C:\WINDOWS\system32\w1ctyqqkk.dll deleted successfully.
Registry key HKLM\system\currentcontrolset\services\spoo1v deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

senti.. ogni volta che riavvio mi partono in automatico due ANTIVIRUS(noad32 e virit) e un antispyware..

danno fastidio ?
inoltre in riaccensione non riesce a trovare un file dll
---
grazie

[Orange]

[lori63]

ok disinstallo virit, ma ad ogni scansione del registro continua a dirmi che è INFETTO DA
BHO.AGENT.FC

[ste_95]

puoi postarne il log...fatto in due volte diverse?

[lori63]

ha trovato la bellezza di 2322 problems da repaiting..

proseguo.

[lori63]

[lori63]

da questo errore
ox90c5qi.dll
impossibile trovare il modulo specificato.

per il resto ho resettato il browser iexplorer, alla configurazione iniziale e sembra funzionare..

non so..credi sia finita qui?

cioe' non ho piu' virus?

[ste_95]

chi lo dice? IE?

[lori63]

una cosa ancora..la lentezza esasperante all'apertura (circa 5 10 minuti) del sistema operativo, non è attribuibile ad un virus vero? (il disco C: ha 1 giga e mezzo di spazio libero )

:

[ste_95]

quanta RAM hai installata nel computer?
posta i nuovo logs di gmer....

[lori63]

oh santo cielo..ok

gmer figlio di Kmur!

scusa ma vaneggio.

[lori63]

ecco i fie dei due passaggi con gmer


1) http://www.freefilehosting.net/download/NDAyOTA=

2) http://www.freefilehosting.net/download/NDAyOTE=


fatto!

[ste_95]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Metti il pallino su input script manually
Quindi scegli la lente e cliccaci
Ora incolla queste righe nella box bianca che si è aperta:

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | ox90c5qi


Adesso devi cliccare su Done in basso nella box
Seleziona il semaforino in alto a destra
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

[lori63]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\fqmceblk

*******************

Script file located at: \??\C:\Program Files\hnvayqfy.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|ox90c5qi deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

__________________________________

fatto.

[Orange]

e il file in questione C:\WINDOWS\Downlo~1\ox90c5qi.dll non gli fai cancellare??

che confusione....

[lori63]

cosa non gli farei cancellare??