non riesco ad eliminare un virus! [Win32/SpamTool]

[Assenzio]

ciao... ho un virus ke nn riesco ad eliminare!io ho l'esetnod32 il nome del virus ke mi porta è variante modificata di Win32/SpamTool..blen cavallo di troia!!!come posso fare ad eliminarlo....ho letto già in un altro forum qui ma nn ci ho capito molto.....grazie in anticipo

[ryan atwood]

Ciao, fai una scansione online con [http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html]Kasperky[/URL]
Posta il risultato!

[Assenzio]

ok....qst è lil report
Scan statistics:
Files scanned: 72209
Threat name: 5
Infected objects: 5
Suspicious objects: 0
Duration of the scan: 01:24:11


File name / Threat name / Threats count
C:\Documents and Settings\eee\Impostazioni locali\Temp\IH13A0.tmp Infected: Trojan-Mailfinder.Win32.Blen.gc 1
C:\Documents and Settings\eee\Impostazioni locali\Temp\IHC0.tmp Infected: Trojan-Mailfinder.Win32.Blen.gd 1
C:\Documents and Settings\eee\Impostazioni locali\Temp\~tmp\mdnk34\mdmm.exe Infected: Backdoor.Win32.Agent.adhd 1
C:\Programmi\LuckyTender\1.3.0\LuckyTender.dll Infected: not-a-virus:AdWare.Win32.Agent.fps 1
C:\Programmi\WebMediaPlayer\uninst.exe Infected: Trojan.Win32.Agent.bppa 1

grazie ancora....

[ryan atwood]

Scarica Avenger e copia incolla:

Files to delete:
C:\Documents and Settings\eee\Impostazioni locali\Temp\IH13A0.tmp
C:\Documents and Settings\eee\Impostazioni locali\Temp\IHC0.tmp
C:\Documents and Settings\eee\Impostazioni locali\Temp\~tmp\mdnk34\mdmm.exe
C:\Programmi\LuckyTender\1.3.0\LuckyTender.dll
C:\Programmi\WebMediaPlayer\uninst.exe

Premi EXECUTE e permetti il reboot
Posta il log di avenger.
Scarica Malwarebytes
Aggiornalo
Posta il risultato

[Assenzio]

ok il risultato di avenger è:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\Documents and Settings\eee\Impostazioni locali\Temp\IH13A0.tmp" deleted successfully.
File "C:\Documents and Settings\eee\Impostazioni locali\Temp\IHC0.tmp" deleted successfully.
File "C:\Documents and Settings\eee\Impostazioni locali\Temp\~tmp\mdnk34\mdmm.exe" deleted successfully.
File "C:\Programmi\LuckyTender\1.3.0\LuckyTender.dl l" deleted successfully.
File "C:\Programmi\WebMediaPlayer\uninst.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.
quello di malwarebytes....
Malwarebytes' Anti-Malware 1.34
Versione del database: 1750
Windows 5.1.2600 Service Pack 2

12/02/2009 0.52.59
mbam-log-2009-02-12 (00-52-59).txt

Tipo di scansione: Scansione completa (C:\|)
Elementi scansionati: 142529
Tempo trascorso: 35 minute(s), 31 second(s)

Processi delle memoria infetti: 1
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 1
Elementi dato del registro infetti: 0
Cartelle infette: 4
File infetti: 4

Processi delle memoria infetti:
C:\WINNT\system\mstsc.exe (Trojan.Agent) -> Unloaded process successfully.

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run\mstsc (Trojan.Agent) -> Quarantined and deleted successfully.

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
C:\Programmi\WebMediaPlayer (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\resources (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\skins (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\updates (Adware.EGDAccess) -> Quarantined and deleted successfully.

File infetti:
C:\Programmi\WebMediaPlayer\sqlite3.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\resources\wmp_translat ion_file.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\skins\classic.skn (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\WINNT\system\mstsc.exe (Trojan.Agent) -> Quarantined and deleted successfullgrazie ancoraa.............

[ryan atwood]

Come và il PC??
Posta un nuovo Malwarebytes!

[Assenzio]

ti ringrazio tantissimo.....il virus è sparito.....grazie ancora e ciau....