PDA

View Full Version : Nuovo virus?

R@is
07-12-2008, 19:43
Salve a tutti, ieri mi è scaduto il periodo di prova di Nod32 ed ho deciso di installare Antivir free.
Posto il warning che mi viene proposto da Antivir:
Virus or unwanted program 'DIAL/Dialer.Gen [dialer]'
detected in file 'C:\System Volume Information\_restore{0E699A11-3829-4437-9AAD-B8106ED556F0}\RP400\A0064467.exe.
Nonostante l'abbia cancellato, al riavvio del Pc quando Antivir ricomincia il suo lavoro riappare il warning.
Voi che sicuramente ne sapete più di me mi aiutate a capire?
Grazie.
wizard1993
07-12-2008, 19:49
disabilita il system restore( http://www.google.it/url?sa=t&source=web&ct=res&cd=3&url=http%3A%2F%2Fwww.sicurezzainrete.com%2Fdisabilitare_system_restore.htm&ei=kig8Sc72DpCk0gXPruSjBQ&usg=AFQjCNEoM-wOnnY9QrpGmhqNQd_GGGsjHA&sig2=kHW7gIHUseppoQZXLKHC5g ) e lancia una scansione con avira, se risolvi bene altrimenti passiamo alle maniere forti
R@is
07-12-2008, 19:53
Grazie per la tempestiva risposta, la casella relativa al system restore era già disabilitata da prima..........quindi?
wizard1993
07-12-2008, 19:54
segui questa guida
http://www.hwupgrade.it/forum/showthread.php?t=1599737
e allega i log secondo le modalità descritte
R@is
07-12-2008, 19:58
Scusa,scusa, la casella NON ERA vistata, adesso l'ho vistata e procedo con la scansione.
Poi ti faccio sapere, grazie e scusa ancora.
P.S. Se dovessi risolvere dopo la scansione, la casella "disattiva ripristino configurazione" la posso "svistare"?
R@is
07-12-2008, 21:20
Domanda sicuramente stupida: una volta in quarantena se elimino il file lo elimino definitivamente o lo elimino solo dalla quarantena e lo rimetto in circolo?
Ho finito ora la scansione e me l'ha ritrovato (sempre lo stesso) e lo ha messo in quarantena, che faccio?
Chill-Out
07-12-2008, 21:25
Domanda sicuramente stupida: una volta in quarantena se elimino il file lo elimino definitivamente o lo elimino solo dalla quarantena e lo rimetto in circolo?
Ho finito ora la scansione e me l'ha ritrovato (sempre lo stesso) e lo ha messo in quarantena, che faccio?

Se lo elimini dalla quarantena lo elimini definitivamente, tieni presente che una volta in quarantena non può più nuocere in teoria può rimanere lì a vita, per capire è necessario che tu alleghi il log della scansione fatta con Avira le modalità su come allegare i log le trovi nelle Regole di sezione che ho in firma.
wizard1993
07-12-2008, 21:25
quando ti chiede cosa fare eliminalo invece di quarantenarlo, poi riattiva anche il system restore, comunque se lo elimini dalla quarantena non lo rimetti in circolazione, se premi su restore invece si
R@is
07-12-2008, 21:33
Ecco il report, uso xp service pack 3

Avira AntiVir Personal
Report file date: domenica 7 dicembre 2008 21:01

Scanning for 1076607 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 3) [5.1.2600]
Boot mode: Normally booted
Username: Ale
Computer name: ALE

Version information:
BUILD.DAT : 8.2.0.337 16934 Bytes 18/11/2008 13:05:00
AVSCAN.EXE : 8.1.4.10 315649 Bytes 18/11/2008 08:21:26
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 11:30:36
ANTIVIR1.VDF : 7.1.0.197 1170432 Bytes 07/12/2008 18:07:08
ANTIVIR2.VDF : 7.1.0.198 2048 Bytes 07/12/2008 18:07:09
ANTIVIR3.VDF : 7.1.0.199 2048 Bytes 07/12/2008 18:07:09
Engineversion : 8.2.0.42
AEVDF.DLL : 8.1.0.6 102772 Bytes 14/10/2008 10:05:56
AESCRIPT.DLL : 8.1.1.17 336251 Bytes 06/12/2008 16:36:56
AESCN.DLL : 8.1.1.5 123251 Bytes 07/11/2008 15:06:41
AERDL.DLL : 8.1.1.3 438645 Bytes 04/11/2008 13:58:38
AEPACK.DLL : 8.1.3.4 393591 Bytes 11/11/2008 09:41:39
AEOFFICE.DLL : 8.1.0.32 196987 Bytes 06/12/2008 16:36:54
AEHEUR.DLL : 8.1.0.74 1519990 Bytes 06/12/2008 16:36:52
AEHELP.DLL : 8.1.2.0 119159 Bytes 06/12/2008 16:36:44
AEGEN.DLL : 8.1.1.6 323955 Bytes 06/12/2008 16:36:43
AEEMU.DLL : 8.1.0.9 393588 Bytes 14/10/2008 10:05:56
AECORE.DLL : 8.1.5.2 172405 Bytes 06/12/2008 16:36:40
AEBB.DLL : 8.1.0.3 53618 Bytes 14/10/2008 10:05:56
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/07/2008 12:02:15
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\programmi\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: repair
Secondary action.................: delete
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: domenica 7 dicembre 2008 21:01

Starting search for hidden objects.
'48782' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'uTorrent.exe' - '1' Module(s) have been scanned
Scan process 'hpqste08.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'CALMAIN.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'freepopsd.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'freepopsservice.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'freepopsd.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'SUPERANTISPYWARE.EXE' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
47 processes with 47 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '63' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\Ale\Dati applicazioni\Thunderbird\Profiles\ac0d40sx.default\Mail\localhost\Inbox
[0] Archive type: Netscape/Mozilla Mailbox
--> Mailbox_[Message-ID: <200712170708.lBH78ssw077744@www.cedartech.net>][Subject: Avviso di Sicurezza][From: Poste@info.it]936.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200712170708.lBH78ssw077744@www.cedartech.net>][Subject: Avviso di Sicurezza][From: Poste@info.it]936.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300405.m3U45YNw020460@vhost3.lasvegas.ne][Subject: |Avviso di Sicurezza|][From: |info@poste|]1852.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300405.m3U45YNw020460@vhost3.lasvegas.ne][Subject: |Avviso di Sicurezza|][From: |info@poste|]1852.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300453.m3U4rQGK009108@www.deafnn.com>][Subject: |Avviso di Sicurezza|][From: |info@poste|]1854.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300453.m3U4rQGK009108@www.deafnn.com>][Subject: |Avviso di Sicurezza|][From: |info@poste|]1854.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200806020243.m522hur2032264@feller.simplecom.n][Subject: [Avviso di Sicurezza]][From: [info@poste.it]]2108.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200806020243.m522hur2032264@feller.simplecom.n][Subject: [Avviso di Sicurezza]][From: [info@poste.it]]2108.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Subject: NUOVE MISURE DI SICUREZZA GIUGNO 2008 !][From: BPOL@poste.it <Poste.it>][Message-ID: <E1KBnE1-0001EW-Jt@stronghold.kylos.pl>]2348.mim
[DETECTION] Contains recognition pattern of the PHISH/PosteItalia.1 phishing file/email
--> Mailbox_[Subject: NUOVE MISURE DI SICUREZZA GIUGNO 2008 !][From: BPOL@poste.it <Poste.it>][Message-ID: <E1KBnE1-0001EW-Jt@stronghold.kylos.pl>]2348.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the PHISH/PosteItalia.1 phishing file/email
[WARNING] This file is a mailbox. To avoid damaging your emails this file will not be repaired or deleted!
C:\Documents and Settings\Ale\Dati applicazioni\Thunderbird\Profiles\ac0d40sx.default\Mail\localhost\Trash
[0] Archive type: Netscape/Mozilla Mailbox
--> Mailbox_[Message-ID: <200712170708.lBH78ssw077744@www.cedartech.net>][Subject: Avviso di Sicurezza][From: Poste@info.it]152.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200712170708.lBH78ssw077744@www.cedartech.net>][Subject: Avviso di Sicurezza][From: Poste@info.it]152.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300453.m3U4rQGK009108@www.deafnn.com>][Subject: |Avviso di Sicurezza|][From: |info@poste|]1060.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300453.m3U4rQGK009108@www.deafnn.com>][Subject: |Avviso di Sicurezza|][From: |info@poste|]1060.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300405.m3U45YNw020460@vhost3.lasvegas.ne][Subject: |Avviso di Sicurezza|][From: |info@poste|]1066.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200804300405.m3U45YNw020460@vhost3.lasvegas.ne][Subject: |Avviso di Sicurezza|][From: |info@poste|]1066.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200806020243.m522hur2032264@feller.simplecom.n][Subject: [Avviso di Sicurezza]][From: [info@poste.it]]1308.mim
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Message-ID: <200806020243.m522hur2032264@feller.simplecom.n][Subject: [Avviso di Sicurezza]][From: [info@poste.it]]1308.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the HTML/Spoofing.Gen HTML script virus
--> Mailbox_[Subject: NUOVE MISURE DI SICUREZZA GIUGNO 2008 !][From: BPOL@poste.it <Poste.it>][Message-ID: <E1KBnE1-0001EW-Jt@stronghold.kylos.pl>]1580.mim
[DETECTION] Contains recognition pattern of the PHISH/PosteItalia.1 phishing file/email
--> Mailbox_[Subject: NUOVE MISURE DI SICUREZZA GIUGNO 2008 !][From: BPOL@poste.it <Poste.it>][Message-ID: <E1KBnE1-0001EW-Jt@stronghold.kylos.pl>]1580.mim
[1] Archive type: MIME
--> file0.html
[DETECTION] Contains recognition pattern of the PHISH/PosteItalia.1 phishing file/email
[WARNING] This file is a mailbox. To avoid damaging your emails this file will not be repaired or deleted!


End of the scan: domenica 7 dicembre 2008 21:47
Used time: 46:23 Minute(s)

The scan has been done completely.

5690 Scanning directories
446036 Files were scanned
20 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
446015 Files not concerned
9439 Archives were scanned
3 Warnings
0 Notes
48782 Objects were scanned with rootkit scan
0 Hidden objects were found
Chill-Out
07-12-2008, 21:44
I log vanno allegati non copiati ed incollati, grazie.

Non conoscendo la versione in uso di Thunderbird procedi cosi:

1 Disconnettiti dalla rete
2 Disabilita Antivir
3 Elimina tutte le email nella cartella Inbox
4 File --> Non in linea --> Impostazioni 'fuori linea' --> Spazio su disco

oppure

File -> Non in linea c'è Lavora scollegato

la procedura compattera automaticamente l'indice

5 Svuota il cestino
6 Riattiva Antivir fai scansione completa ed allega il log
R@is
07-12-2008, 21:57
Scusami ma sono poco pratico, la prossima volta "allego".
Se ho delle mail che mi servono come faccio?
Non vorrei eliminarle....
P.S. Thunderbird 2.0.0.4
Grazie
Chill-Out
07-12-2008, 22:02
Scusami ma sono poco pratico, la prossima volta "allego".
Se ho delle mail che mi servono come faccio?
Non vorrei eliminarle....
P.S. Thunderbird 2.0.0.4
Grazie

Quelle indicate nel log vanno eliminate tutte, eventualmente quelle che ti servono le sposti in un'altra cartella, per allegare i log come ti ho già detto e sufficiente leggere le Regole di sezione che ho in firma.
R@is
08-12-2008, 09:21
Allora ho eseguito la procedura che mi hai consigliato e rifatto la scansione completa: ecco il link al report.
AVSCAN-20081208-092946-22C3A131.LOG (http://wikisend.com/download/488108/AVSCAN-20081208-092946-22C3A131.LOG)
Che faccio ora?
wizard1993
08-12-2008, 10:18
elimina definitivamente le email infette (c'è l'opzione compatta da qualche parte in thunderbird) poi, hai ancora l'avviso?
R@is
08-12-2008, 10:21
elimina definitivamente le email infette (c'è l'opzione compatta da qualche parte in thunderbird) poi, hai ancora l'avviso?

In effetti le mail le ho già eliminate, ho anche "cliccato" compatta cartelle ma l'avviso rimane!:muro:
R@is
08-12-2008, 10:23
Rifatto tutta le procedura sembra ok ora.
Grazie mille!
wizard1993
08-12-2008, 10:26
lasciamo da parte le e-mail, l'altro avviso è scomparso ?
per le email cancella i file che si trovano qui
C:\Documents and Settings\Ale\Dati applicazioni\Thunderbird\Profiles\ac0d40sx.default\Mail\localhost\Inbox
aiutati con killbox se non si cancellano subito, poi svuota il cestino riesegui la scansione e allega il log
R@is
08-12-2008, 10:29
Per il momento non ho rifatto la scansione generale ma mi pare che nel log postato stamattina non ci fosse più traccia del dialer.
Ad ogni modo adesso rilancio la scansione totale e ti faccio sapere.
Grazie Wizard!
wizard1993
08-12-2008, 10:32
di nulla; facci sapere
R@is
08-12-2008, 11:22
Ecco l'ultimo log, AVSCAN-20081208-113324-518563E6.LOG (http://wikisend.com/download/643396/AVSCAN-20081208-113324-518563E6.LOG).
Mi pare tutto ok, che ne dite?
Posso "svistare" il system restore?
Grazie
Chill-Out
08-12-2008, 11:33
Per compattare la procedura è indicata qui http://www.hwupgrade.it/forum/showpost.php?p=25339467&postcount=10