zeuzera

ComboFix 07-11-05.1 - luca 2007-11-05 18.39.20.1 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1040.18.143 [GMT 1:00] Eseguito da: C:\Documents and Settings\luca\Impostazioni locali\Temporary Internet Files\Content.IE5\4JN8RRIV\ComboFix[1].exe * Creato nuovo punto di ripristino . ((((((((((((((((((((((((((((((((((((( Altre eliminazioni ))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\ykcibmgrkv.dat c:\documents and settings\luca\impostazioni locali\dati applicazioni\ykcibmgrkv.exe c:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\ykcibmgrkv_nav.dat c:\Documents and Settings\luca\Impostazioni locali\Dati applicazioni\ykcibmgrkv_navps.dat C:\Documents and Settings\luca\ravmonlog C:\WINDOWS\system32\nvs2.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_SROSA ((((((((((((((((((((((((( Files Creati Da 2007-10-05 al 2007-11-05 ))))))))))))))))))))))))))))))))))) . 2007-11-05 18:37 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-11-04 23:32 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-04 23:32 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Kaspersky Lab 2007-11-04 19:19 107,361 --a------ C:\Muestras.zip 2007-11-03 21:37 <DIR> d-------- C:\Programmi\TVAnts 2007-11-01 19:04 <DIR> d-------- C:\Programmi\Alwil Software 2007-11-01 13:12 161 --a------ C:\Delme.bat 2007-10-31 21:03 2,184,064 --a------ C:\WINDOWS\system32\ntoskrnl.exe 2007-10-31 21:03 2,184,064 --a------ C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2007-10-24 12:55 <DIR> d-------- C:\Programmi\@Last Software 2007-10-24 12:55 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe 2007-10-15 12:49 <DIR> d-------- C:\Documents and Settings\All Users\Dati applicazioni\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-29 18:20 20 ---h--w C:\Documents and Settings\All Users\Dati applicazioni\PKP_DLbz.DAT 2007-10-24 11:55 --------- d-----w C:\Programmi\@Last Software 2007-10-05 14:33 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2007-10-02 19:26 --------- d-----w C:\Programmi\SopCast 2007-10-02 19:26 --------- d-----w C:\Documents and Settings\luca\Dati applicazioni\SopCast 2007-09-18 12:46 --------- d-----w C:\Documents and Settings\luca\Dati applicazioni\Canon 2007-09-06 11:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-09-06 11:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-08-21 06:16 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:16 683,520 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-08-20 09:57 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-20 09:57 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 09:57 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-08-20 09:57 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-08-20 09:57 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-08-20 09:57 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 09:57 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-08-20 09:57 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 09:57 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 09:57 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-08-20 09:57 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 09:57 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 09:57 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-08-20 09:57 232,960 ----a-w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-08-20 09:57 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 09:57 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 09:57 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 09:57 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 09:57 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 09:57 124,928 ----a-w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-20 09:57 105,984 ----a-w C:\WINDOWS\system32\dllcache\url.dll 2007-08-20 09:57 102,400 ----a-w C:\WINDOWS\system32\dllcache\occache.dll 2007-08-20 09:57 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-17 10:23 625,152 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 10:22 63,488 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:22 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-06-26 13:58 114,712 ----a-w C:\Documents and Settings\luca\Dati applicazioni\GDIPFONTCACHEV1.DAT 2007-04-20 13:31 2,274,815 ----a-w C:\Programmi\Setup-SopCast-1.1.2-2007-04-20.exe 2007-02-24 16:19 0 ---h--w C:\Documents and Settings\All Users\Dati applicazioni\PKP_DLea.DAT . ((((((((((((((((((((((((((((((((((((( Punti Reg Caricati )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Nota* i valori vuoti & legittimi/default non sono visualizzati. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "preload"="C:\Windows\RUNXMLPL.exe" [2004-04-20 16:49] "SynTPEnh"="C:\Programmi\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 10:49] "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2004-08-06 14:04] "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02] "LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2004-07-15 17:24] "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2004-01-28 17:48] "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-09-08 11:28] "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2004-08-13 22:40] "PCMService"="C:\Program Files\Aspire Arcade\PCMService.exe" [2004-03-25 18:41] "VTTrayp"="VTtrayp.exe" [2004-06-22 02:57 C:\WINDOWS\system32\VTTrayp.exe] "VTTimer"="VTTimer.exe" [2004-09-01 16:28 C:\WINDOWS\system32\VTTimer.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-07-13 14:48] "nwiz"="nwiz.exe" [2004-07-13 14:48 C:\WINDOWS\system32\nwiz.exe] "AGRSMMSG"="AGRSMMSG.exe" [2003-07-25 11:22 C:\WINDOWS\AGRSMMSG.exe] "LtMoh"="C:\Programmi\ltmoh\Ltmoh.exe" [2002-11-25 10:23] "SlipStream"="C:\Programmi\Web Accelerator\slipcore.exe" [] "AutoLogi"="C:\WINDOWS\AutoLogin.exe" [2004-11-26 19:38] "FLMOFFICE4DMOUSE"="C:\Programmi\Trust\MI-2550XP OPTICAL MINI MOUSE\Mouse32a.exe" [2007-04-06 19:48] "QuickTime Task"="C:\Programmi\QuickTime\qttask.exe" [2007-06-29 06:24] "SSBkgdUpdate"="C:\Programmi\File comuni\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 13:16] "OpwareSE4"="C:\Programmi\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 12:45] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 20:00] "Skype"="C:\Programmi\Skype\Phone\Skype.exe" [2007-05-28 14:52] "AlcoholAutomount"="C:\Programmi\Alcohol Soft\Alcohol 120\axcmd.exe" [] C:\Documents and Settings\luca\Menu Avvio\Programmi\Esecuzione automatica\ Adobe Gamma.lnk - C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50] C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\ EPSON Status Monitor 3 Environment Check 2.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE [2005-03-22 14:42:55] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys] @="Driver" R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys R3 POWERKEY;POWERKEY;\??\C:\Program Files\Launch Manager\POWERKEY.sys S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys S3 IPN2220;acer IPN2220 Wireless LAN Card Driver;C:\WINDOWS\system32\DRIVERS\i2220ntx.sys S3 Wdm1;Vivanco USB Link Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{77c77d1e-52a7-11d9-a661-000e9b5381d4}] \Shell\Auto\command - bittorrent.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{997b4395-2c5e-11dc-aa6b-000ae4a2741c}] \Shell\Auto\command - bittorrent.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3e00da1-1ca7-11dc-aa56-000ae4a2741c}] \Shell\Auto\command - G:\bittorrent.exe e \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL bittorrent.exe e [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea598ba8-059c-11da-a793-000e9b5381d4}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe . Contenuto della cartella 'Scheduled Tasks' "2007-11-05 17:01:02 C:\WINDOWS\Tasks\Verifica aggiornamenti per Windows Live Toolbar.job" - C:\Programmi\Windows Live Toolbar\MSNTBUP.EXE "2007-10-15 11:49:48 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Programmi\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-05 18:44:55 Windows 5.1.2600 Service Pack 2 FAT NTAPI scansione processi nascosti ... scansione entrate autostart nascoste ... Scansione files nascosti ... Scansione completata con successo Files nascosti: 0 ************************************************************************** . Ora fine scansione: 2007-11-05 18:46:02 - machine was rebooted . --- E O F ---

Sat Nov 03 22:55:08 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Acción Directa): C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Eliminado Bagle C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle C:\WINDOWS\SYSTEM32\DRIVERS\HIDR.EXE --> Eliminado Bagle C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Eliminado Bagle (rootkit) Por favor, envienos una muestra del fichero C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.66 a "virus@satinfo.es". Gracias. C:\WINDOWS\SYSTEM32\HLDRRR.EXE --> Eliminado Bagle Por favor, envienos una muestra del fichero C:\Muestras\FLEC006.EXE.Muestra EliBagle v10.66 a "virus@satinfo.es". Gracias. C:\DOCUMENTS AND SETTINGS\LUCA\DATI APPLICAZIONI\M\FLEC006.EXE --> Eliminado Bagle C:\DOCUMENTS AND SETTINGS\LUCA\DATI APPLICAZIONI\M\LIST.OCT --> Eliminado Bagle Eliminada Carpeta "%WinDir%\exefld" Restaurada Clave: "SafeBoot\Minimal y Network" Sat Nov 03 22:57:28 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Exploración): Explorando Unidad C:\ C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067241.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067242.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067243.SYS --> Eliminado Bagle (rootkit) C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067264.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067265.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067266.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067267.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067268.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067269.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067270.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067271.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067272.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067274.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067275.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067276.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067277.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067278.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067279.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067280.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067281.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067282.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067283.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067284.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067285.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067286.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067287.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067288.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067289.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067290.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067291.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067292.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067293.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067294.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067295.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067296.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067297.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067298.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067299.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067300.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067301.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067302.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067303.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067304.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067305.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067306.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067307.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067308.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067309.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067310.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067311.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067312.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067313.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067314.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067315.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP511\A0065902.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP511\A0065903.SYS --> Eliminado Bagle (rootkit) C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP511\A0065904.EXE --> Eliminado Bagle.dldr Nº Total de Directorios: 5445 Nº Total de Ficheros: 74462 Nº de Ficheros Analizados: 10824 Nº de Ficheros Infectados: 57 Nº de Ficheros Limpiados: 57 Sun Nov 04 10:52:13 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Acción Directa): Mon Nov 05 18:19:48 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Acción Directa): Eliminada Carpeta "%AppData%\M" Mon Nov 05 18:19:55 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Exploración): Explorando Unidad C:\ Per combofix come si fa? cerco il link su google? e come si chiama il log che ti dovrò postar?

http://www.wikifortio.com/480668/report_kaspersky.htmlForum link: report_kaspersky.htmlEdit link: http://www.wikifortio.com//upload/details....508e42ce502331c credo diesserci riuscito...... (B)

il pc ha deciso autonomamente di spegnersi, quindi ora riprovo a fare la scansione online con Kaspersky...

il pc vuole spegnersi er effettuare tutti gli aggiornamenti. se lo permetto perdo tutto? che faccio? :leggi:

non so se hai visto l'allegato, ma c'è un bottoncino per fermare la scansione (eppure la scansione è finita), e nella parte in basso della finestra c'è scritto "errore nel visualizzazione della pagina". non so se devo provare a rifare l'operazione...

buon giorno a tutti, sono arrivato al punto: fai anche uno scan online Kapersky, ma terminata la scansione non c'è da nessuna parte il pulsante "Save Report As" da cliccare(vedi allegato). che si fa? k.zip

te li invio a rate....ecco il primo ...ed ecco il secondo

ho provato dopo aver zippato ad allegare la cartella ma mi esce questa dicitura, eppure è solo di 105kb: Lo spazio totale necessario per caricare tutti i files allegati è maggiore di quello che ti è consentito utilizzare per ogni singolo messaggio o di quello totale. Perfavore diminuisci il numero di allegati o la loro dimensione. non so se è un problema momentaneo, riprovo tra un pò!!!!

ecco Sat Nov 03 22:55:08 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Acción Directa): C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Eliminado Bagle C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle C:\WINDOWS\SYSTEM32\DRIVERS\HIDR.EXE --> Eliminado Bagle C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Eliminado Bagle (rootkit) Por favor, envienos una muestra del fichero C:\Muestras\HLDRRR.EXE.Muestra EliBagle v10.66 a "virus@satinfo.es". Gracias. C:\WINDOWS\SYSTEM32\HLDRRR.EXE --> Eliminado Bagle Por favor, envienos una muestra del fichero C:\Muestras\FLEC006.EXE.Muestra EliBagle v10.66 a "virus@satinfo.es". Gracias. C:\DOCUMENTS AND SETTINGS\LUCA\DATI APPLICAZIONI\M\FLEC006.EXE --> Eliminado Bagle C:\DOCUMENTS AND SETTINGS\LUCA\DATI APPLICAZIONI\M\LIST.OCT --> Eliminado Bagle Eliminada Carpeta "%WinDir%\exefld" Restaurada Clave: "SafeBoot\Minimal y Network" Sat Nov 03 22:57:28 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Exploración): Explorando Unidad C:\ C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067241.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067242.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067243.SYS --> Eliminado Bagle (rootkit) C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067264.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067265.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067266.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067267.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067268.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067269.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067270.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067271.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067272.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067274.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067275.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067276.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067277.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067278.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067279.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067280.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067281.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067282.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067283.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067284.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067285.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067286.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067287.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067288.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067289.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067290.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067291.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067292.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067293.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067294.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067295.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067296.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067297.EXE --> Eliminado Bagle.dldr C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067298.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067299.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067300.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067301.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067302.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067303.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067304.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067305.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067306.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067307.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067308.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067309.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067310.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067311.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067312.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067313.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067314.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP520\A0067315.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP511\A0065902.EXE --> Eliminado Bagle C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP511\A0065903.SYS --> Eliminado Bagle (rootkit) C:\System Volume Information\_restore{40B70121-7FC1-4057-9C2D-765003B2A806}\RP511\A0065904.EXE --> Eliminado Bagle.dldr Nº Total de Directorios: 5445 Nº Total de Ficheros: 74462 Nº de Ficheros Analizados: 10824 Nº de Ficheros Infectados: 57 Nº de Ficheros Limpiados: 57 Sun Nov 04 10:52:13 2007 EliBagle v10.66 ©2007 S.G.H. / Satinfo S.L. ---------------------------------------------- Lista de Acciones (por Acción Directa): mi si è liberato un pò di spazio su C, è normale, no!!!!!

ho scaricato il programmino collegandomi al link che mi hai inserito nel post precedente, mi è apparsa una finestrella "SATINFO" con l'opzione di scelta Explorar o Salir e ho scelto Explorar. dopodicchè lui ha lavorao per i fatti suoi e poi quando ha finito si è chiuso tutto e basta. Non capisco a questo punto cosa devo fare, da dove prendere sto log che dici e cos'è e dove copiarlo !!!! scusami ma di ste cose non ne capisco molto, come avrai notato!!!!

ma, precisamente, materialmente,"postare il log che trovi in: C:\ con il nome InfoSat.txt" ome si fa?

scusami, ma non capisco molto il gergo e le operazioni da fare. quando hai tempo e voglia, se puoi spiegarmelo come si parlaad un tonto sono più cotento....

anche io ho lo stesso pc e stesso problema:se va in stand by non si riaccende più. io spero sia solo un problema di impostazioni..se capisci come si fa fammi sapere.

la mia ragazza ha appena comprato un notebook(non so se si può nominare) e quando va in "pausa" si blocca e non si riprende più. c'è qualche tasto particolare che va pigiato, oppure devo cambiare delle impostazioni (quelle sul rsparmio energtico?) oppure è un problema del computer e devo portarlo in assistenza? aiutateci, grazie

si ho provatocon spazio(coe faccio sul mio della stessa marca), con esc....ho dovuto tener premuto a lungo il tasto di spegnimento e si è riavviato....