Problema con CSRSS.exe

[thepunisher187]

Salve raga, ho un problema col CSRSS.exe perchè aprendo taskmanager di questo processo ne sono aperti piu' di uno, ho fatto la scansione con hijackthis e ora vi posto il file log, spero possiate aiutarmi non so come fare, ho girato un po' nei vari post ma non sono riuscito a togliere questo problema, spero che voi sicuramente piu' esperti di me sappiate aiutarmi e dirmi cosa fare in questo caso...
p.s. comunque ho da poco formattato il pc ma ora (a causa di questo Csrss) si impalla un po'..

attendo i vostro aiuto

EDIT: scusate ma non riesco ad allegare il file log come immagine, ve lo copio qui:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23.16.04, on 06/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\CSRSS.exe
C:\WINDOWS\system\CSRSS.exe
C:\WINDOWS\help\CSRSS.exe
C:\WINDOWS\security\CSRSS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
C:\WINDOWS\SERVICES.EXE
C:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\Computer\IMPOST~1\Temp\Rar$EX00.871\Hi jackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [AVP] "C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Explorer] C:\WINDOWS\system32\CSRSS.exe
O4 - HKLM\..\Run: [Script di Sistema] C:\WINDOWS\CSRSS.exe
O4 - HKLM\..\Run: [Internet] C:\WINDOWS\system32\CSRSS.exe
O4 - HKLM\..\Run: [Host Info] C:\WINDOWS\system\CSRSS.exe
O4 - HKLM\..\Run: [Help] C:\WINDOWS\help\CSRSS.exe
O4 - HKLM\..\Run: [Discovery] C:\WINDOWS\security\CSRSS.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Aggiungi ad Anti-Banner - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\WIDCOMM\Software Bluetooth\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1225923452186
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe

--
End of file - 4745 bytes

[Deifobe]

1) Scarica Avenger e CCleaner

2) Esegui avenger e nella finestra copia/incolla tutta la citazione:

files to delete:
C:\WINDOWS\help\CSRSS.exe
C:\WINDOWS\security\CSRSS.exe
C:\WINDOWS\system\CSRSS.exe
C:\WINDOWS\CSRSS.exe
C:\csrss.exe
C:\WINDOWS\SERVICES.EXE
C:\services.exe
C:\autorun.inf
C:\WINDOWS\autorun.inf

registry values to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run | Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run | Internet
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run | Script di Sistema
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run | Host Info
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run | Discovery
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run | Help

Spunta "Automatically disable any rootkits found" e clicca su "execute".
Il pc dovrebbe riavviarsi da solo, altrimenti riavvialo tu.

3) Esegui CCleaner e ripulisci i file temporanei e i cookie (eseguilo 2 volte).

4) Svuota C:\WINDOWS\Prefetch

5) Vai su Virustotal, analizza C:\WINDOWS\system32\CSRSS.exe (fai copia/incolla) e posta il link all'analisi

6) scarica SystemScan, disconnetti il pc da internet => disattiva l'antivirus => esegui systemscan => clicca su "Scan Now". Finita la scansione, riattiva l'antivirus

carica il rapporto che trovi sul desktop su Savefile e posta il link ottenuto.

nota: systemscan viene riconosciuto come infetto per il tipo di scansione effettuata (è un falso positivo). La procedura postata è sicura.

7) posta il rapporto di systemscan, quello di avenger e l'analisi di virustotal.

ciao

[thepunisher187]

wow, c'è un bel giro da fare...ok allora ora ci provo appena ho un po' di tempo a disposizione e vi faccio sapere..comunque grazie

[thepunisher187]

ok fatto, pare abbia funzionato, comunque ecco i report:

Report di avenger
http://www.savefile.com/files/1875550

report di systemscan:
http://www.savefile.com/files/1875555

Analisi di Virus total (posto due link perchè non so quale dei due sia quello che intendevi, anche se credo sia il secondo):

http://www.virustotal.com/it/reanali...671605705346f8

http://www.virustotal.com/it/analisi...f9405caf340ecb


Ora è tutto ok?

[Deifobe]

1) riesegui avenger:

files to delete:
C:\WINDOWS\Help\Autorun.inf
C:\WINDOWS\security\Autorun.inf
C:\WINDOWS\system\Autorun.inf
C:\WINDOWS\system32\Autorun.inf

clicca su execute.

2) Zippa la cartella c:\avenger, carica l'archivio su savefile e mandami il link con un messaggio privato (mi raccomando, non mettere il link sul forum)


3) Scarica e installa malwarebytes.
Aggiornalo: clicca sulla scheda "aggiornamenti" => "controlla aggiornamenti"
Esegui una "scansione completa" (seleziona l'opzione)
A scansione completa, posta il rapporto.

se trova qualcosa, per ora non eliminare nulla, vorrei prima controllarlo.

[thepunisher187]

Ecco i risultati della scansione:

Malwarebytes' Anti-Malware 1.30
Versione del database: 1375
Windows 5.1.2600 Service Pack 2

09/11/2008 16.42.39
mbam-log-2008-11-09 (16-42-33).txt

Tipo di scansione: Scansione completa (C:\|F:\|)
Elementi scansionati: 77778
Tempo trascorso: 27 minute(s), 19 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 2

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\Documents and Settings\Computer\Desktop\Windows Genuine\Windows XP Keygen.exe (Malware.Tool) -> No action taken.
F:\Documenti\Myebooks\Hacking\Windows XP Keygen.exe (Malware.Tool) -> No action taken.

[Deifobe]

collega i dispositivi usb al pc (nel farlo, tieni premuto il tasto shift) e fai una scansione con Bitdefender
(suppongo rimuoverà anche quanto trovato da malwarebytes..)

salva e posta il rapporto di scansione

[thepunisher187]

ok ma comunque i due malware che ha trovato, so cosa sono...sono 2 programmini di cui so la fonte ed è sicura quindi forse li vede come malware ma so che son sicuri...

[thepunisher187]

comunque ecco il report, ora cosa devo fare?:



BitDefender Log File

Product : BitDefender Total Security 2009
Version : BitDefender UIScanner v.12
Scanning task : Deep System Scan
Log date : 13:41:41 10/11/2008
Log path : C:\Documents and Settings\All Users\Dati applicazioni\Bitdefender\Desktop\Profiles\Logs\dee p_scan\1226320901_1_02.xml

Scan Paths:Path 0000: C:\Programmi\BitDefender\BitDefender 2009\uiscan.exe
Path 0001: C:\Programmi\Internet Explorer\iexplore.exe
Path 0002: C:\Programmi\BitDefender\BitDefender 2009\seccenter.exe
Path 0003: C:\PROGRA~1\WIDCOMM\SOFTWA~1\BTSTAC~1.EXE
Path 0004: C:\Programmi\WIDCOMM\Software Bluetooth\BTTray.exe
Path 0005: C:\WINDOWS\system32\ctfmon.exe
Path 0006: C:\Programmi\BitDefender\BitDefender 2009\bdagent.exe
Path 0007: C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
Path 0008: C:\WINDOWS\system32\wscntfy.exe
Path 0009: C:\WINDOWS\Explorer.EXE
Path 0010: C:\WINDOWS\system32\Ati2evxx.exe
Path 0011: C:\WINDOWS\System32\svchost.exe
Path 0012: C:\WINDOWS\System32\alg.exe
Path 0013: C:\Programmi\BitDefender\BitDefender 2009\vsserv.exe
Path 0014: C:\WINDOWS\system32\svchost.exe
Path 0015: C:\Programmi\File comuni\BitDefender\BitDefender Update Service\livesrv.exe
Path 0016: C:\Programmi\WIDCOMM\Software Bluetooth\bin\btwdins.exe
Path 0017: C:\Programmi\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
Path 0018: C:\WINDOWS\system32\spoolsv.exe
Path 0019: C:\WINDOWS\system32\svchost.exe
Path 0020: C:\WINDOWS\system32\svchost.exe
Path 0021: C:\WINDOWS\System32\svchost.exe
Path 0022: C:\WINDOWS\system32\svchost.exe
Path 0023: C:\WINDOWS\system32\svchost.exe
Path 0024: C:\WINDOWS\system32\Ati2evxx.exe
Path 0025: C:\WINDOWS\system32\lsass.exe
Path 0026: C:\WINDOWS\system32\services.exe
Path 0027: C:\WINDOWS\system32\winlogon.exe
Path 0028: C:\WINDOWS\system32\csrss.exe
Path 0029: \SystemRoot\System32\smss.exe
Path 0030: C:\
Path 0031: F:\

Scan Options:Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : Yes

Target Selection Options:Scan registry keys : Yes
Scan cookies : Yes
Scan boot sectors : Yes
Scan memory processes : Yes
Scan archives : Yes
Scan runtime packers : Yes
Scan emails : No
Scan all files : Yes
Heuristic Scan : Yes
Scanned extensions :
Excluded extensions :

Target Processingefault action for infected objects : Disinfect
Default action for suspicious objects : None
Default action for hidden objects : None
Default action for encrypted infected objects : None
Default action for encrypted suspicious objects : None
Default action for password-protected objects : None

Scan engines summaryNumber of virus signatures : 2050827
Archive plugins : 43
Email plugins : 6
Scan plugins : 12
System plugins : 4
Unpack plugins : 7

Overall scan summaryScanned items : 102018
Infected items : 41
Suspicious items : 0
Resolved items : 2
Unresolved items : 102
Password-protected items : 63
Individual viruses found : 9
Scanned directories : 4179
Scanned boot sectors : 4
Scanned archives : 1458
Input-output errors : 30
Scan time : 02:10:24
Files per second : 12

Scanned processes summaryScanned : 28
Infected : 0

Scanned registry keys summaryScanned : 887
Infected : 0

Scanned cookies summaryScanned : 887
Infected : 0

[thepunisher187]

Remaining issues:Object Name Threat Name Final Status
C:\Documents and Settings\Computer\Desktop\Windows Genuine\keyfinder.exe Application.Findkeyxp.N Disinfect Failed
F:\Documenti\Myebooks\Hacking\keyfinder.exe Application.Findkeyxp.N Disinfect Failed
F:\Documenti\Myebooks\Hacking\wp.rar=]keyfinder.exe Application.Findkeyxp.N Disinfect Failed
C:\Documents and Settings\Computer\Desktop\Backup\Copia di Documenti\Downloads\FL Studio 7 crack Fruity Loops 7 Crack keygen.rar=]FL Studio 7 crack Fruity Loops 7 Crack+keygen=](Embedded EXE 2o) Backdoor.Rbot.EWU Infected (no action was possible, file was in an archive)
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001340.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001341.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001342.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001343.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001344.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001352.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001353.EXE Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004375.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004376.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004377.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004378.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004379.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004385.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004386.EXE Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007422.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007423.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007424.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007425.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007426.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007433.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007434.EXE Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
F:\CSRSS.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
F:\SERVICES.exe Dropped:Win32.Worm.Delf.NFJ Disinfect Failed
F:\eMule\Incoming\[PC - APP - ITA] ALCHOL 120% + SERIALE.rar=][PC - APP - ITA] ALCHOL 120% + SERIALE\ALCHOL 120% +SERIALE\Alcohol 120% 1.4.0 (114) [KeyGen].exe Trojan.Generic.86833 Delete Failed (file was in an archive)
F:\eMule\Incoming\Alchol 120% 2.0.2600.2 [ITA]+Keygen.rar=]Alchol 120% 2.0.2600.2 [ITA]+Keygen\[Software ita] Alchol 120% keygen.exe Trojan.Packed.8310 Delete Failed (file was in an archive)
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001345.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0001350.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0004383.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007427.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007431.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007446.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007447.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007448.inf Win32.Worm.Delf.NFJ Disinfect Failed
C:\System Volume Information\_restore{3B93BEAC-7B82-46B2-BB1C-4A622C0962F9}\RP15\A0007452.inf Win32.Worm.Delf.NFJ Disinfect Failed
F:\Autorun.inf Win32.Worm.Delf.NFJ Disinfect Failed