Problema con virus pazzo!

[superfil56]

Innanzi tutto mi presento...mi chiamo Filippo e adoro lavorare al pc soprattutto per quanto riguarda la grafica e il web design...
Purtroppo a volte il lavoro mi viene impedito da piccoli virus che non fanno altro che disturbare la mia quiete...fino ad ora sono sempre riuscito a toglierli di persona o tramite antivirus...
Qualche tempo fa però mi è capitato un virus che proprio non riesco a togliere n nessun modo e che sembra molto tosto...per questo mi rivolgo a voi per chiedere aiuto.
Vi espongo la situazione il più dettagliatamente possibile:

Il virus non so da dove sia entrato ma probabilmente da un finto aggioramento di msn messenger su cui io stupidamente ho cliccato ok... Gli effetti collaterali sono 1) ogni circa 5 minuti utilizza la CPU al 100% e se termino il processo con Task Manager dopo un secondo ricompare 2) non mi permette di utilizzare Internet Explorer 3) a volte mi manda in continuazione messaggi di errore e se tento di chiuderli in una frazione di secondo ne riapre altri 4) si copia da solo su chiavette e simili creandoci all' interno un file .exe invisibile e modificando l' autorun.
Altri dettagli sul virus: a) come simbolo ha un cd messo di sbieco con dietro una specie di scatola...è un simbolo di windows...sulle proprietà c' è scritto Install Shield Installer b) il file sicuramente infetto è situato nella cartella system32 di windows e se provo a eliminarlo lui ricompare...se per caso si riesce ad eliminare (come sono riuscito con qualche stratagemma) dopo un pò ricompare con un altro nome c) se vado su regedit e cerco il nome del virus in associazione a volte trovo scritto MDM Rock 4
Ora come ora sono riuscito a sistemare provvisoriamente la situazione infatti il virus mi lascia connettere a internet e non mi riempie più l utilizzo della cpu...però rimane ancora qualche stranezza del tipo 1) se apro C:// cliccandoci due volte sopra mi chiede con cosa voglio aprirla mentre se faccio tasto destro + apri la apre normalmente 2) se apro risorse di rete ci mette molto ad aprire la cartella.
Vi prego aiutatemi perchè sono in una situazione disperata.

Ps: contando che in questi giorni stavo formattando il fisso, ho trasferito dati a due portatili...il virus si è propagato anche a loro!!! Quindi ho 3 computer infetti!!! Vi prego aiuto!!!

[Gle89]

clicca qui e segui la fase PRIMA ANALISI - PRELIMINARE
con le scansioni.

Al termine di queste scansioni come è scritto in quella guida posta un log di HJT facendo in questa maniera:

Scarica HIJACKTHIS: clicca qui per il download.
Mettilo in una cartella in C: o in C:\Programmi.
Aprilo e premi la prima opzione "do a system scan and save log" aspetta che ti dia il file .txt (blocco note), copialo e incollalo qui tra i tag (code)….(/code) , le parentesi sostituiscile con quelle [] oppure tramite la funzione “gestisci allegati” oppure hostalo tramite www.zshare.net

[superfil56]

Ecco qui il file txt che mi ha dato HiJack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.09.29, on 11/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\HiJACK\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [WinampAgent] C:\Programmi\Winamp\winampa.exe
O4 - HKLM\..\Run: [MDM Rock 4] C:\WINDOWS\system32\acmejodyp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C81B8B5-8829-4815-8155-0C391401E22F}: NameServer = 130.244.127.161,130.244.127.169
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 3153 bytes

[Nuz]

C'è una voce da fixare:

O4 - HKLM\..\Run: [MDM Rock 4] C:\WINDOWS\system32\acmejodyp.exe

[superfil56]

Ok... clicco il tasto fix checked?

[Bugs Bunny]

seleziona la casella a sinistra della voce e premi su fix checked

[Nuz]

Si. Due domande: Hai un antivirus? Hai un firewall? Perchè dal log postato sembra che non nè hai.

[Riverside]

Originariamente inviato da superfil56

Ps: contando che in questi giorni stavo formattando il fisso, ho trasferito dati a due portatili...il virus si è propagato anche a loro!!! Quindi ho 3 computer infetti!!! Vi prego aiuto!!!

Alla grande .... vediamo dove ci porta questa discussione, con ben tre P.C. infetti

[superfil56]

Ok ragazzi ho fatto fix e ho confermato...la finestra di HiJack poi è diventata bianca... Ora dove devo agire?
Cmq non ho antivirus perchè ho appena formattato...ma l' antivirus che avevo prima di formattare non mi aveva trovato questo virus...non lo riconosceva...

[Riverside]

Originariamente inviato da superfil56

Cmq non ho antivirus perchè ho appena formattato...

Inizia con l'installare l'antivirus (che non sia Avast), poi se ne parla

[superfil56]

Ce n' è qualcuno gratuito che funzia e che potete consigliarmi?

[Nuz]

Diciamo pure che se installi Antivir è meglio.

[Gle89]

un ottimo antivirus è questo:

ANTIVIR PERSONAL EDITION FREE: clicca qui per il download
● una volta installato, scarica gli aggiornamenti e poi, esegui una scansione completa del sistema.
qui trovi la Guida di configurazione per Antivir pubblicata da Juninho, ed altre cose importanti ed interessanti in relazione ad Antivir.

[Riverside]

Edit .... Glenda.

[superfil56]

Ragazzi ho scaricato AntiVir, l ho aggiornato e adesso mi sta facendo la scansione...siamo quasi alla fine e mi dice:
C:/WINDOWS/system32/windexserv.dll
You may not have the required permission or the file is locked.
Please make sure that you have administrative rights for this action.
Is the Trojan horse TR/Agent.Jativ.A

Poi mi chiede se voglio:

-Delete locked files after reboot
-Ignore

Cosa scelgo???

[Nuz]

Tra le due l'unica scelta logica è: Delete.

[Chill-Out]

Originariamente inviato da superfil56

Ragazzi ho scaricato AntiVir, l ho aggiornato e adesso mi sta facendo la scansione...siamo quasi alla fine e mi dice:
C:/WINDOWS/system32/windexserv.dll
You may not have the required permission or the file is locked.
Please make sure that you have administrative rights for this action.
Is the Trojan horse TR/Agent.Jativ.A

Poi mi chiede se voglio:

-Delete locked files after reboot
-Ignore

Cosa scelgo???

Devi essere loggato come amministratore, comunque scegli questa opzione:
-Delete locked files after reboot

[superfil56]

Ok fatto...vi posto i risultati della scansione:

AntiVir PersonalEdition Classic
Report file date: domenica 11 novembre 2007  21:41

Scanning for 923375 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    COMPUTERCASA

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.172   1092608 Bytes  05/11/2007 20:41:01
ANTIVIR3.VDF : 7.0.0.197    104960 Bytes  09/11/2007 20:41:01
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  11/11/2007 20:41:01
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\programmi\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: domenica 11 novembre 2007  21:41

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'winamp.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'hpotdd01.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
27 processes with 27 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '26' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\Filippo\Documenti\Immagini\Immagini Filippo\01-Moto\Rs 125\Aprilia rs 125 MS Replica\Nuova cartella (6).rar
  [0] Archive type: RAR
  --> edn325o.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a669f7.qua'!
C:\Documents and Settings\Filippo\Documenti\Immagini\Immagini Filippo\01-Moto\Rs 125\Zipps\New Graphics.rar
  [0] Archive type: RAR
  --> qivgH24.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ae69f2.qua'!
C:\Documents and Settings\Filippo\Documenti\Immagini\Immagini Filippo\04-Altro\Other\raccolta1.zip
  [0] Archive type: ZIP
  --> f1kgufE.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '479a6a1e.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Aprilia Extrema Gp.rar
  [0] Archive type: RAR
  --> iG5P1pU.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a96a77.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Aprilia Rs 125 250 del 2002.rar
  [0] Archive type: RAR
  --> bQ3022n.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a96a7b.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Aprilia RS 125 Burnout.rar
  [0] Archive type: RAR
  --> krOD22I.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a96a7e.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Aprilia Rs 125 con motore BMW F650 portato a oltre 700cc.rar
  [0] Archive type: RAR
  --> U75nn7l.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a96a82.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Aprilia Rs 125 Extrema.rar
  [0] Archive type: RAR
  --> OOrlgUD.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a96a86.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Articolo1.rar
  [0] Archive type: RAR
  --> xvwTec4.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6a8b.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Articolo2.rar
  [0] Archive type: RAR
  --> mjv5yI5.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6a8d.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Articolo3.rar
  [0] Archive type: RAR
  --> cSPH08K.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6a8f.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Articolo4.rar
  [0] Archive type: RAR
  --> ULdrx0s.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6a91.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Esplosi Rotax 122.rar
  [0] Archive type: RAR
  --> GuKkwDf.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a76a95.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Evoluzioni in Rs.rar
  [0] Archive type: RAR
  --> oXWwYeK.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a66a9a.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Geardata 2.1.zip
  [0] Archive type: ZIP
  --> sB0mg1g.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47986a8b.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Libretto Rs dal 99 al 05.rar
  [0] Archive type: RAR
  --> DnhkKym.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47996a93.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Libretto Rs prec 99.rar
  [0] Archive type: RAR
  --> ix54jgb.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47996a94.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Lo scarico nel motore a 2 tempi.rar
  [0] Archive type: RAR
  --> BE33bmT.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47576a9a.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Manuale d' officina dal 1999 al 2005 (Italiano).rar
  [0] Archive type: RAR
  --> Ew4M2iH.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a56a90.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Manuale d' officina Rotax 122.rar
  [0] Archive type: RAR
  --> p4SrjCR.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a56a92.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Motore Rotax.rar
  [0] Archive type: RAR
  --> LSV4xjX.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6aa2.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Pieghe in Rs.rar
  [0] Archive type: RAR
  --> WRH1gbg.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '479c6a9d.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Rotax Aprilia-122.rar
  [0] Archive type: RAR
  --> S83RGql.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6aa3.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Rs Crash.rar
  [0] Archive type: RAR
  --> K3KCb88.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47576aa8.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Rs Power di Stefano.rar
  [0] Archive type: RAR
  --> cTI38uL.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47576aa9.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Sfida tra Mito e Rs depotenziate.rar
  [0] Archive type: RAR
  --> kpHf2kR.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a06a9d.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Sound Rs Superfil56.zip
  [0] Archive type: ZIP
  --> b40iMVb.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ac6aa7.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Tutti i componenti Rs dal 1999 al 2005 versione delux.rar
  [0] Archive type: RAR
  --> rm2p2U1.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6aad.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Tutti i componenti Rs dal 1999 al 2005.rar
  [0] Archive type: RAR
  --> tnYe8k2.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6aae.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Una Aprilia RS 125 stradale da 37cv.rar
  [0] Archive type: RAR
  --> YBmO83H.com
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47986aa7.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Wallpaper01.zip
  [0] Archive type: ZIP
  --> Qsq55F1.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a36a9b.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Wallpaper02.zip
  [0] Archive type: ZIP
  --> y6kdrM6.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '46c8276c.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Wallpaper03.zip
  [0] Archive type: ZIP
  --> OtLtg63.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a36a9c.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Project aprilia 1.1\Downloads\Wallpaper04.zip
  [0] Archive type: ZIP
  --> w5F4740.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '46c8276d.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\ARLRDBD.zip
  [0] Archive type: ZIP
  --> CmM6xL5.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47836ab7.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\BAUHS93.zip
  [0] Archive type: ZIP
  --> Qc40Lv8.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '478c6aa6.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\FORTE.zip
  [0] Archive type: ZIP
  --> KJHtDLn.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47896ab4.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\ImpennataPc1.zip
  [0] Archive type: ZIP
  --> Cpe57Wt.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47a76ad3.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\ImpennataPc2.zip
  [0] Archive type: ZIP
  --> j4kcmPu.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '46cc2724.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\Mettiu e la Motozappa.zip
  [0] Archive type: ZIP
  --> o5MB74V.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ab6acb.qua'!
C:\Documents and Settings\Filippo\Documenti\Web\Sito Aprilia\Download\Sound Aprilia1.zip
  [0] Archive type: ZIP
  --> G2Ct4H5.gif                                        .scr
      [DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
      [INFO]      The file was moved to '47ac6ad6.qua'!
C:\WINDOWS\serv.exe
      [DETECTION] Is the Trojan horse TR/Spy.Banker.akh.5
      [INFO]      The file was moved to '47a96d81.qua'!
C:\WINDOWS\system32\windexserv.dll
      [DETECTION] Is the Trojan horse TR/Agent.Jativ.A
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!


End of the scan: domenica 11 novembre 2007  22:13
Used time: 32:17 min

The scan has been done completely.

   2332 Scanning directories
 140634 Files were scanned
     43 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     42 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 140591 Files not concerned
   1042 Archives were scanned
      2 Warnings
      0 Notes

Now? altre operazioni?

[Chill-Out]

Riavvia il PC

[superfil56]

Pc riavviato!