infestato

[Hidro]

cmq vada come vada vi ringrazio tutti per il tempo che dedicato a me per risolvere questi problemi

[YMen]

Originariamente inviato da Hidro

cmq vada come vada vi ringrazio tutti per il tempo che dedicato a me per risolvere questi problemi

di niente

[Hidro]

io comunque ho il firewall di windows (senza sp1 e sp2) attivato.... ma serve a qualcosa o se lo disattivo è la stessa cosa?

[YMen]

Originariamente inviato da Hidro

io comunque ho il firewall di windows (senza sp1 e sp2) attivato.... ma serve a qualcosa o se lo disattivo è la stessa cosa?

prima di tutto metti sia sp1 che sp2 soprattutto sp2 e cmq il firewall di windows è cmq una protezione in più ma senza l'sp1 e 2 serve a poco

[bluepix]

Originariamente inviato da Hidro

io comunque ho il firewall di windows (senza sp1 e sp2) attivato.... ma serve a qualcosa o se lo disattivo è la stessa cosa?

Da Hijackthis non sembra che tu non abbia installato nè antivirus nè un firewall nè uno spyware

Mi sbaglio?

[YMen]

in ogni caso come procede la disinfestazione?

[Hidro]

io ho ad aware e firewall di windows attivati antivirus nada... ho fatto la scansione e poi l'ho tolto

[YMen]

Originariamente inviato da bluepix

Da Hijackthis non sembra che tu non abbia installato nè antivirus nè un firewall nè uno spyware

Mi sbaglio?

accidenti è vero non me ne ero accorto metti subito un firewall (io consiglio kerio) e un av (a pagamento: kaspersky free: antivir) dopo averli installati aggiornali fai una scansione con l'av da mod prov poi scaricati ewido, a-squared, ad-aware e spybot S&D e facci una scansione.
Ps: perchè non me l'hai detto subito che non avevi protezioni?

[tutmosi3]

In mezzo a tutto 'sto macello, io non ho ancora capito che antivirus, firewall, antispyware avevi.

Ciao

[YMen]

Originariamente inviato da tutmosi3

In mezzo a tutto 'sto macello, io non ho ancora capito che antivirus, firewall, antispyware avevi.

Ciao

a quanto ho capito come firewall usa quello di xp av l'ha installato fatto la scansione e disinstallato e antispyware aveva ad-aware

[Hidro]

ad aware come spyware, firewall di windows, appena fatta scansione con kaspersky... trova rpcclient.exe come trojan.... il problema è che non si può cancellare perchè l'accesso è negato

[YMen]

Originariamente inviato da Hidro

trova rpcclient.exe come trojan.... il problema è che non si può cancellare perchè l'accesso è negato

anche da mod prov?

[Hidro]

questo è il report della scansione di kaspersky



Statistics:
Start time: 14/06/2005 16.11.17
Completion time: 14/06/2005 16.18.33
Objects scanned: 37634
Dangerous objects detected: 27
Viruses disinfected: 0
Objects deleted: 12
Objects quarantined: 0

Settings:
Objects to scan:
My Computer
If a dangerous object is detected:
Prompt user for action once the scan is completed
Scan level:
Recommended
Exclusions from the scan scope:
Option not used

Report:
C:\WINDOWS\System32\rpcclient.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.11.22
rpcclient.exe\rpcclient.exe object could not be disinfected, disinfection postponed 14/06/2005 16.11.22
C:\WINDOWS\System32\rpcclient.exe object could not be disinfected, disinfection postponed 14/06/2005 16.11.27
C:\WINDOWS\SYSTEM32\RPCCLIENT.EXE is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.11.31
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcClient [ImagePath=C:\WINDOWS\System32\rpcclient.exe] is infected with a virus Service: startUp link to C:\WINDOWS\SYSTEM32\RPCCLIENT.EXE object with "Infected" verdict 14/06/2005 16.11.31
C:\WINDOWS\SYSTEM32\RPCCLIENT.EXE object could not be disinfected, disinfection postponed 14/06/2005 16.11.31
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcClient [ImagePath=C:\WINDOWS\System32\rpcclient.exe] object could not be disinfected 14/06/2005 16.11.31
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\Ad-Aware SE Default.skn password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\arrow1.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\arrow2.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bck1.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt11.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt12.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt13.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt21.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt22.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt23.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt31.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt32.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt33.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt41.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt42.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt43.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt51.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt52.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt53.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt61.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\bt62.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\checkbox1.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\checkbox2.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\checkbox3.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\checkbox4.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\defbtn1.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\defbtn2.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\defbtn3.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph1.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph2.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph3.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph4.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph5.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph6.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\glyph7.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\main.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\preview.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Documents and Settings\Iron\Documenti\Zip & programmi\aawsepersonal.exe/WISE0020.BIN\sprite1.bmp password protected, has not been processed 14/06/2005 16.12.20
C:\Program Files\Internet Optimizer\optimize.exe is a Trojan Trojan-Downloader.Win32.Dyfuca.ei 14/06/2005 16.12.55
C:\Program Files\Internet Optimizer\optimize.exe object could not be disinfected, disinfection postponed 14/06/2005 16.12.55
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\Ad-Aware SE Default.skn password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\arrow1.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\arrow2.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bck1.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt11.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt12.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt13.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt21.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt22.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt23.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt31.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt32.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt33.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt41.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt42.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt43.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt51.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt52.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt53.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt61.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\bt62.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox1.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox2.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox3.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\checkbox4.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\defbtn1.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\defbtn2.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\defbtn3.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph1.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph2.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph3.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph4.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph5.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph6.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\glyph7.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\main.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\preview.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\Programmi\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask\sprite1.bmp password protected, has not been processed 14/06/2005 16.13.06
C:\WINDOWS\system32\aimsg.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.15.54
C:\WINDOWS\system32\aimsg.exe object could not be disinfected, disinfection postponed 14/06/2005 16.15.54
C:\WINDOWS\system32\cfmon.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.15.56
C:\WINDOWS\system32\cfmon.exe object could not be disinfected, disinfection postponed 14/06/2005 16.15.56
C:\WINDOWS\system32\i is a Trojan Trojan-Downloader.BAT.Ftp.ab 14/06/2005 16.16.02
C:\WINDOWS\system32\i object could not be disinfected, disinfection postponed 14/06/2005 16.16.02
C:\WINDOWS\system32\msdirectx.sys is a Trojan Trojan.Win32.Rootkit.h 14/06/2005 16.16.07
C:\WINDOWS\system32\msdirectx.sys object could not be disinfected, disinfection postponed 14/06/2005 16.16.07
C:\WINDOWS\system32\msnt32.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.16.08
C:\WINDOWS\system32\msnt32.exe object could not be disinfected, disinfection postponed 14/06/2005 16.16.08
C:\WINDOWS\system32\o is a Trojan Trojan-Downloader.BAT.Ftp.ab 14/06/2005 16.16.11
C:\WINDOWS\system32\o object could not be disinfected, disinfection postponed 14/06/2005 16.16.11
C:\WINDOWS\system32\rpcclient.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.16.13
C:\WINDOWS\system32\rpcclient.exe object could not be disinfected, disinfection postponed 14/06/2005 16.16.13
C:\WINDOWS\system32\Sygat.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.16.16
C:\WINDOWS\system32\Sygat.exe object could not be disinfected, disinfection postponed 14/06/2005 16.16.16
C:\WINDOWS\system32\uuu.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.16.17
C:\WINDOWS\system32\uuu.exe object could not be disinfected, disinfection postponed 14/06/2005 16.16.17
C:\WINDOWS\system32\windowsp.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.16.18
C:\WINDOWS\system32\windowsp.exe object could not be disinfected, disinfection postponed 14/06/2005 16.16.18
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\26MUI77V\loko3[1].m is a Trojan Trojan.Win32.LowZones.br 14/06/2005 16.16.21
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\26MUI77V\loko3[1].m object could not be disinfected, disinfection postponed 14/06/2005 16.16.21
C:\WINDOWS\System32\rpcclient.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.17.38
C:\WINDOWS\System32\rpcclient.exe moved to the backup storage 14/06/2005 16.17.42
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, object locked 14/06/2005 16.17.42
C:\WINDOWS\System32\rpcclient.exe will be deleted at system startup 14/06/2005 16.17.51
rpcclient.exe\rpcclient.exe deleted 14/06/2005 16.17.51
C:\WINDOWS\System32\rpcclient.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.17.51
C:\WINDOWS\System32\rpcclient.exe error moving to the backup storage 14/06/2005 16.17.55
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.17.55
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.17.59
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.18.01
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.18.03
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.18.05
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.18.08
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.18.09
C:\WINDOWS\System32\rpcclient.exe cannot be deleted, file not found 14/06/2005 16.18.10
C:\WINDOWS\SYSTEM32\RPCCLIENT.EXE processing error 14/06/2005 16.18.14
C:\Program Files\Internet Optimizer\optimize.exe is a Trojan Trojan-Downloader.Win32.Dyfuca.ei 14/06/2005 16.18.14
C:\Program Files\Internet Optimizer\optimize.exe moved to the backup storage 14/06/2005 16.18.15
C:\Program Files\Internet Optimizer\optimize.exe deleted 14/06/2005 16.18.16
C:\WINDOWS\system32\aimsg.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.18.16
C:\WINDOWS\system32\aimsg.exe moved to the backup storage 14/06/2005 16.18.17
C:\WINDOWS\system32\aimsg.exe deleted 14/06/2005 16.18.17
C:\WINDOWS\system32\cfmon.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.18.17
C:\WINDOWS\system32\cfmon.exe moved to the backup storage 14/06/2005 16.18.19
C:\WINDOWS\system32\cfmon.exe deleted 14/06/2005 16.18.19
C:\WINDOWS\system32\i is a Trojan Trojan-Downloader.BAT.Ftp.ab 14/06/2005 16.18.19
C:\WINDOWS\system32\i moved to the backup storage 14/06/2005 16.18.22
C:\WINDOWS\system32\i deleted 14/06/2005 16.18.22
C:\WINDOWS\system32\msdirectx.sys is a Trojan Trojan.Win32.Rootkit.h 14/06/2005 16.18.22
C:\WINDOWS\system32\msdirectx.sys moved to the backup storage 14/06/2005 16.18.24
C:\WINDOWS\system32\msdirectx.sys deleted 14/06/2005 16.18.24
C:\WINDOWS\system32\msnt32.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.18.24
C:\WINDOWS\system32\msnt32.exe moved to the backup storage 14/06/2005 16.18.25
C:\WINDOWS\system32\msnt32.exe deleted 14/06/2005 16.18.25
C:\WINDOWS\system32\o is a Trojan Trojan-Downloader.BAT.Ftp.ab 14/06/2005 16.18.25
C:\WINDOWS\system32\o moved to the backup storage 14/06/2005 16.18.26
C:\WINDOWS\system32\o deleted 14/06/2005 16.18.26
C:\WINDOWS\system32\rpcclient.exe processing error 14/06/2005 16.18.26
C:\WINDOWS\system32\Sygat.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.18.26
C:\WINDOWS\system32\Sygat.exe moved to the backup storage 14/06/2005 16.18.27
C:\WINDOWS\system32\Sygat.exe deleted 14/06/2005 16.18.27
C:\WINDOWS\system32\uuu.exe is a Trojan Backdoor.Win32.Codbot.ad 14/06/2005 16.18.27
C:\WINDOWS\system32\uuu.exe moved to the backup storage 14/06/2005 16.18.28
C:\WINDOWS\system32\uuu.exe deleted 14/06/2005 16.18.28
C:\WINDOWS\system32\windowsp.exe is a Trojan Backdoor.Win32.Codbot.ae 14/06/2005 16.18.28
C:\WINDOWS\system32\windowsp.exe moved to the backup storage 14/06/2005 16.18.32
C:\WINDOWS\system32\windowsp.exe deleted 14/06/2005 16.18.32
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\26MUI77V\loko3[1].m is a Trojan Trojan.Win32.LowZones.br 14/06/2005 16.18.32
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\26MUI77V\loko3[1].m moved to the backup storage 14/06/2005 16.18.33
C:\WINDOWS\system32\config\systemprofile\Impostazioni locali\Temporary Internet Files\Content.IE5\26MUI77V\loko3[1].m deleted 14/06/2005 16.18.33

[Hidro]

conclusione... infestato da trojan che nessun altro antivirus rilevava

[Hidro]

appena tolto il firewall sono stato bombardato da lsass e altra robbaccia ma kaspersky li ha bloccati tutti

[YMen]

quindi ora sei completamente pulito? hai riavviato il pc?

[tutmosi3]

Originariamente inviato da YMen

a quanto ho capito come firewall usa quello di xp av l'ha installato fatto la scansione e disinstallato e antispyware aveva ad-aware

Il che mida da pensare che in precedenza non avessi antivirus.

Ciao

[Hidro]

diciamo che sono pulito


cmq ora mi arriva il cd di windows xp con sp1 e 2 già installati e formatto


thx a tutti

[YMen]

anzichè formattare perchè non installi soltanto l'sp 1 e 2?
almeno così non rendi inutile il lavoro di noi tutti

[Hidro]

mi potreste passare un link per il service pack 1?