Olimpo Informatico

[miz86miz]

ciao ragazzi sn nuovo del forum..
Non so cosa sia questo flec006
potreste essermi di aituo..
Grazie

[Sante62]

Ciao miz86miz e benvenuto.
Segui questa discussione
per postare un log di Hijackthis.

[miz86miz]

scusami lo seguo..ma nn capisco bene cm centra con il mio problema...

[Sante62]

Il tuo problema è un virus, e ci vuole quel log per avere maggiori informazioni...se hai letto a che cosa serve...

[miz86miz]

mi dite cm posso fare questo log passo per passo xfavore

[Sante62]

E' spiegato in quel link che ti ho postato...su che è facile..

[miz86miz]

dai aiutami...nn sono molto bravo..
dimmi passo passo ke fare...nn ci riesco se no
xfavore
grazie

[Sante62]

Allora, scarica Hijackthis da quì
Decomprimi il file che hai scaricato; devi avere Winzip o altro per farlo; Metti HJT in una cartella tutta sua (non temporanea e non sul Desktop).
Adesso avvia Hijackthis e clicca su scan; quando ha finito la scansione clicca su Save log; si aprirà il blocco note; copia tutto il suo contenuto e incollalo quì sul forum; se ti trovi alla modalità estesa clicca su Do a System scan and save a log file; aspetta che si apre il blocco note automaticamente; copia e incolla il suo contenuto quì.[/b]

[miz86miz]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19.14.28, on 25/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Belkin\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmi\Microsoft Hardware\Keyboard\type32.exe
C:\Programmi\Microsoft Hardware\Mouse\point32.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Belkin\Software Bluetooth\BTTray.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Outlook Express\msimn.exe
D:\HiJackThis_v2.exe
D:\HIACK\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/ig?hl=it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {D61D7E1A-6613-49CA-B6F9-51DB248E209D} - C:\Programmi\Video ActiveX Access\iesplg.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Programmi\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE" /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [CTStartup] C:\Programmi\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Programmi\File comuni\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ncoOSCheck] C:\Programmi\Norton Confidential\osCheck.exe
O4 - HKLM\..\Run: [ALUAlert] C:\Programmi\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Belkin\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Belkin\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183855377875
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://cid-17789c654cb6653a.spaces.live.com/PhotoUpload/MsnPUpld.cab
O20 - AppInit_DLLs:
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programmi\Belkin\Software Bluetooth\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FreePOPs - Unknown owner - C:\Programmi\FreePOPs\freepopsservice.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programmi\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Programmi\File comuni\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programmi\File comuni\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SPYWAREfighterRP - Unknown owner - C:\Programmi\SPYWAREfighter\spfprc.exe (file missing)

--
End of file - 8797 bytes

[Sante62]

Dal log non c'è traccia del malware.
Avvia HjT, seleziona queste righe, premi poi fix Checked (niente di particolare comunque):

[miz86miz]

ComboFix 08-01-23.1C - Alfieri 2008-01-25 22.09.34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.176 [GMT 1:00]
Eseguito da: C:\Documents and Settings\Alfieri\Impostazioni locali\Temporary Internet Files\Content.IE5\TTIHP2D7\ComboFix[1].exe
* Creato nuovo punto di ripristino

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Creati Da 2007-12-25 al 2008-01-25 )))))))))))))))))))))))))))))))))))
.

2008-01-25 22:08 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-25 17:16 . 2008-01-25 18:32 <DIR> d-------- C:\Programmi\COMODO
2008-01-25 17:16 . 2008-01-25 17:16 139,008 --a------ C:\WINDOWS\system32\guard32.dll
2008-01-25 16:32 . 2008-01-25 16:32 440,794 --a------ C:\WINDOWS\system32\prfh0410.dat
2008-01-25 16:32 . 2008-01-25 16:32 71,076 --a------ C:\WINDOWS\system32\prfc0410.dat
2008-01-16 20:31 . 2008-01-25 15:29 70,660 --a------ C:\WINDOWS\system32\mdelk.exe
2008-01-16 20:29 . 2008-01-25 18:33 <DIR> d-------- C:\WINDOWS\system32\drivers\down
2008-01-01 23:09 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe
2008-01-01 23:09 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf
2007-12-29 20:25 . 2006-03-13 00:14 95,232 -ra------ C:\WINDOWS\system32\HPcam_03.dll
2007-12-29 20:09 . 2007-12-29 20:24 101,293 --a------ C:\WINDOWS\hpiins04.dat
2007-12-29 20:09 . 2006-11-28 08:34 0 --------- C:\WINDOWS\hpimdl04.dat
2007-12-29 20:03 . 2004-08-19 15:39 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2007-12-29 20:03 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-29 20:03 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-29 20:03 . 2001-08-30 23:07 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 20:57 --------- d-----w C:\Programmi\eMule
2008-01-05 16:22 --------- d-----w C:\Programmi\MSN Messenger
2008-01-05 16:22 --------- d-----w C:\Programmi\Messenger Plus! Live
2007-12-16 16:09 --------- d-----w C:\Programmi\MagicISO
2007-12-13 13:58 --------- d-----w C:\Programmi\File comuni\Nero
2007-12-13 13:54 --------- d-----w C:\Programmi\Nero
2007-12-13 13:43 --------- d-----w C:\Programmi\File comuni\Ahead
2007-12-09 14:20 --------- d--h--w C:\Programmi\InstallShield Installation Information
2007-12-09 13:18 --------- d-----w C:\Programmi\Windows Live Toolbar
2007-12-08 23:26 --------- d-----w C:\Programmi\Windows Live
2007-12-08 22:56 --------- d-----w C:\Programmi\Microsoft SQL Server Compact Edition
2007-12-08 22:50 --------- dcsh--w C:\Programmi\File comuni\WindowsLiveInstaller
2007-12-07 10:52 --------- d-----w C:\Programmi\KONAMI
2007-12-02 11:44 --------- d-----w C:\Programmi\File comuni\Macrovision Shared
2007-12-02 11:44 --------- d-----w C:\Programmi\File comuni\Adobe
2007-12-01 20:23 290,816 ------w C:\WINDOWS\Setup1.exe
2007-11-16 15:09 65,536 ----a-w C:\WINDOWS\DUMP58be.tmp
2007-11-16 15:05 65,536 ----a-w C:\WINDOWS\DUMP6764.tmp
2007-07-01 12:36 88 --sh--r C:\WINDOWS\system32\E9514C1569.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 14:39 15360]
"SpybotSD TeaTimer"="C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe" [2007-07-10 21:47 1459024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliType"="C:\Programmi\Microsoft Hardware\Keyboard\type32.exe" [2001-06-12 09:20 69632]
"POINTER"="point32.exe" []
"EPSON Stylus Photo R200 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.exe" [2003-09-11 04:00 99840]
"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 10:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 00:00 90112]
"Jet Detection"="C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 00:00 28672]
"CTStartup"="C:\Programmi\Creative\Splash Screen\CTEaxSpl.exe" [2001-12-20 00:00 28672]
"Motive SmartBridge"="C:\PROGRA~1\ALICET~1\SMARTB~1\MotiveSB.exe" [2006-04-21 14:41 438359]
"ISUSPM Startup"="C:\Programmi\File comuni\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30 249856]
"ISUSScheduler"="C:\Programmi\File comuni\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920]
"TkBellExe"="C:\Programmi\File comuni\Real\Update_OB\realsched.exe" [2007-07-24 19:15 180269]
"ncoOSCheck"="C:\Programmi\Norton Confidential\osCheck.exe" [ ]
"ALUAlert"="C:\Programmi\Symantec\LiveUpdate\ALuNotify.exe" [ ]
"WinampAgent"="C:\Programmi\Winamp\winampa.exe" [2007-10-10 06:28 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 14:39 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"

R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2007-07-22 10:29]
R3 axvbusx;axvbusx;C:\WINDOWS\system32\DRIVERS\axvbusx.sys [2003-01-31 20:43]
R3 axvscsi;axvscsi;C:\WINDOWS\system32\DRIVERS\axvscsi.sys [2003-01-31 20:43]
S3 PPJoyBus;Parallel Port Joystick Bus device driver;C:\WINDOWS\system32\drivers\PPJoyBus.sys [2004-10-24 08:11]
S3 PPortJoystick;Parallel Port Joystick device driver;C:\WINDOWS\system32\drivers\PPortJoy.sys [2004-10-24 08:11]
S3 SpyFighter;SpyFighter Guard Device;C:\Programmi\SPYWAREfighter\spyfighter.sys []
S3 SPYWAREfighterRP;SPYWAREfighterRP;"C:\Programmi\SPYWAREfighter\spfprc.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61a2d7d6-95c0-11dc-8739-00507052436d}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{70607b39-6b83-11dc-869f-00507052436d}]
\Shell\Auto\command - UFO.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 22:16:21
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTStartup = C:\Programmi\Creative\Splash Screen\CTEaxSpl.EXE /run???????h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4???R???d:2????wd??wR???????\???\??????????????w-??w\???\???????(l`??????C@?\???\??????sR???\??????s\???H:2?A??sH:2??C@?x???`|?w\?????@

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-01-25 22:19:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-25 21:19:16

[Sante62]

Neanche Combofix ha trovato nulla...
Fai la scansione con Systemscan e posta il log generato come
indicato quì

[miz86miz]

vi ringrazio....ho risolto ora mi funzionano di nuovo gli antivirus...e quel flec006 nn mi compare più..
grazie

[Sante62]

Contento che hai risolto, però all'inizio non hai detto che non ti funzionava l'antivirus. Hai fatto qualche operazione? Se la vuoi riferire, magari può essere utile a qualche altro utente...

[miz86miz]

scusate....cmq mi è bastato usare il programma eabealge...così mi sembra che si kiama!

[miz86miz]

Ragazzi mi torna a dire quando apro SpyBot applicazione nn valida di Win32

[Sante62]

Probabilmente c'è ancora qualcosa del Bagle. Puoi postare il log di EliBagla?.

[miz86miz]

Certo...
Mi dite una cosa...Ma devo farlo prima in modalità normale e poi in modalità provvisoria??
e poi devo mettere la x sulla cancellazione automatica?

[miz86miz]

Sat Jan 26 14:11:44 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\SROSA.SYS.Muestra EliBagle v10.92
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.92
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"

Sat Jan 26 14:11:56 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios: 4893
Nº Total de Ficheros: 70639
Nº de Ficheros Analizados: 8934
Nº de Ficheros Infectados: 1
Nº de Ficheros Limpiados: 0

Sat Jan 26 14:20:22 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\SROSA.SYS.Muestra EliBagle v10.92
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.92
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle Acceso Denegado.

Sat Jan 26 14:20:28 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 327
Nº Total de Ficheros: 5054
Nº de Ficheros Analizados: 5
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 26 14:23:45 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\SROSA.SYS.Muestra EliBagle v10.92
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Eliminado Bagle
Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.92
a "virus@satinfo.es". Gracias.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Eliminado Bagle

Sat Jan 26 14:23:52 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\WINDOWS\system32\MDELK.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\down\153250.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\down\175687.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\down\67046.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\down\8112812.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\down\8121515.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\down\86750.EXE --> Eliminado Bagle

Nº Total de Directorios: 4903
Nº Total de Ficheros: 70909
Nº de Ficheros Analizados: 8962
Nº de Ficheros Infectados: 7
Nº de Ficheros Limpiados: 7

Sat Jan 26 14:31:01 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios: 327
Nº Total de Ficheros: 5054
Nº de Ficheros Analizados: 5
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados: 0

Sat Jan 26 14:33:35 2008
EliBagle v10.92 (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

[bdoriano]

Rifai la scansione con Combofix.