[wizard1993]

Originariamente inviato da Special

Allora, ho provato a fare come dice sul link indicato, xchè in effetti la cartella piena di file rinominati random era presente, ho usato lo script:

Files to delete:
%SystemDrive%:\Documents and Settings\[Utente corrente]\Dati applicazioni\hidires\m_hook.sys
%SystemDrive%:\Documents and Settings\[Utente corrente]\Dati applicazioni\hidires\hidr.exe
%SystemDrive%:\WINDOWS\system32\wintems.exe
%SystemDrive%:\WINDOWS\system32\hldrrr.exe

folders to delete:
%SystemDrive%:\Documents and Settings\[Utente corrente]\Dati applicazioni\hidires
%SystemDrive%:\WINDOWS\exefld

registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK

registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | hldrrr

Modificandolo opportunamente, ma il risultato è stato il seguente:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\occyuoap

*******************

Script file located at: \??\C:\WINDOWS\shtsoyeq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



Could not open file C:\Documents and Settings\Muletto\Dati applicazioni\hidires\m_hook.sys for deletion
Deletion of file C:\Documents and Settings\Muletto\Dati applicazioni\hidires\m_hook.sys failed!

Could not process line:
C:\Documents and Settings\Muletto\Dati applicazioni\hidires\m_hook.sys
Status: 0xc000003a



Could not open file C:\Documents and Settings\Muletto\Dati applicazioni\hidires\hidr.exe for deletion
Deletion of file C:\Documents and Settings\Muletto\Dati applicazioni\hidires\hidr.exe failed!

Could not process line:
C:\Documents and Settings\Muletto\Dati applicazioni\hidires\hidr.exe
Status: 0xc000003a



File C:\WINDOWS\system32\wintems.exe not found!
Deletion of file C:\WINDOWS\system32\wintems.exe failed!

Could not process line:
C:\WINDOWS\system32\wintems.exe
Status: 0xc0000034



File C:\WINDOWS\system32\hldrrr.exe not found!
Deletion of file C:\WINDOWS\system32\hldrrr.exe failed!

Could not process line:
C:\WINDOWS\system32\hldrrr.exe
Status: 0xc0000034



Folder C:\Documents and Settings\Muletto\Dati applicazioni\hidires not found!
Deletion of folder C:\Documents and Settings\Muletto\Dati applicazioni\hidires failed!

Could not process line:
C:\Documents and Settings\Muletto\Dati applicazioni\hidires
Status: 0xc0000034

Folder C:\WINDOWS\exefld deleted successfully.


Registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook not found!
Deletion of registry key HKLM\SYSTEM\CurrentControlSet\Services\m_hook failed!

Could not process line:
HKLM\SYSTEM\CurrentControlSet\Services\m_hook
Status: 0xc0000034

Registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK deleted successfully.
Registry value HKLM\Software\Microsoft\Windows\CurrentVersion\Run|hldrrr deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

fai una scan con gmer di rootkit e auto start e cancella le voci in rosso