Trojan.Win32.RootKit.E..come individuare percorso nascosto?

di **RickyLost** » 25/08/06 15:45

ciao,questo è il log fatto da gmer...qualcuno mi sa dire che fare?non riesco a eliminare Trojan.Win32.RootKit.E...l'antivirus mi dice che c'è ma non mette il percorso..GRAZIE in anticipo

GMER 1.0.10.10122 - http://www.gmer.net
Autostart 2006-08-25 16:39:20
Windows 5.1.2600 Service Pack 2

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\SYSTEM\CurrentControlSet\Services\ >>>
aswUpdSv /*avast! iAVS4 Control Service*/@ = "C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe"
avast! Antivirus /*avast! Antivirus*/@ = "C:\Programmi\Alwil Software\Avast4\ashServ.exe"
bdss /*BitDefender Scan Server*/@ = "C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service
Creative Service for CDROM Access /*Creative Service for CDROM Access*/@ = C:\WINDOWS\system32\CTsvcCDA.EXE
MDM /*Machine Debug Manager*/@ = "C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE"
NVSvc /*NVIDIA Display Driver Service*/@ = %SystemRoot%\System32\nvsvc32.exe
ScsiPort@ = %SystemRoot%\system32\drivers\scsiport.sys
Spooler /*Spooler di stampa*/@ = %SystemRoot%\system32\spoolsv.exe
UMWdf /*Windows User Mode Driver Framework*/@ = C:\WINDOWS\system32\wdfmgr.exe
viritsvclite /*Virit eXplorer Lite*/@ = C:\VEXPLITE\viritsvc.exe
XCOMM /*BitDefender Communicator*/@ = "C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>
@NeroFilterCheckC:\WINDOWS\system32\NeroCheck.exe = C:\WINDOWS\system32\NeroCheck.exe
@DSLSTATEXEC:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon = C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
@DSLAGENTEXEdslagent.exe USB = dslagent.exe USB
@MessengerPlus3"C:\Programmi\MessengerPlus! 3\MsgPlus.exe" = "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
@avast!C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
@CloneCDTray"C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s = "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s
@VIRIT LITE MONITORC:\VEXPLITE\MONLITE.EXE = C:\VEXPLITE\MONLITE.EXE
@SoundManSOUNDMAN.EXE = SOUNDMAN.EXE
@BDMCon"C:\Programmi\Softwin\BitDefender8\bdmcon.exe" = "C:\Programmi\Softwin\BitDefender8\bdmcon.exe"
@BDNewsAgent"C:\Programmi\Softwin\BitDefender8\bdnagent.exe" = "C:\Programmi\Softwin\BitDefender8\bdnagent.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run >>>
@homepage.monitor.exeC:\Programmi\IntCodec\isamonitor.exe /*file not found*/ = C:\Programmi\IntCodec\isamonitor.exe /*file not found*/
@pmsngr.exeC:\Programmi\IntCodec\pmsngr.exe /*file not found*/ = C:\Programmi\IntCodec\pmsngr.exe /*file not found*/

HKCU\Software\Microsoft\Windows\CurrentVersion\Run@Creative Detector = C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler@cholecyst =

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>
@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Estensione panoramica video del Pannello di controllo*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/
@{32683183-48a0-441b-a342-7c2a440a9478} /*Media Band*/(null) =
@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/C:\WINDOWS\system32\nvcpl.dll = C:\WINDOWS\system32\nvcpl.dll
@{1CDB2949-8F65-4355-8456-263E7C208A5D} /*Desktop Explorer*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A47} /*Desktop Explorer Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{1E9B04FB-F9E5-4718-997B-B8DA88302A48} /*nView Desktop Context Menu*/C:\WINDOWS\system32\nvshell.dll = C:\WINDOWS\system32\nvshell.dll
@{E0D79304-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WinZip\WZSHLSTB.DLL = C:\PROGRA~1\WinZip\WZSHLSTB.DLL
@{E0D79305-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WinZip\WZSHLSTB.DLL = C:\PROGRA~1\WinZip\WZSHLSTB.DLL
@{E0D79306-84BE-11CE-9641-444553540000} /*WinZip*/C:\PROGRA~1\WinZip\WZSHLSTB.DLL = C:\PROGRA~1\WinZip\WZSHLSTB.DLL
@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Cartelle Web*/C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL = C:\PROGRA~1\FILECO~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL
@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL
@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Programmi\Microsoft Office\OFFICE11\msohev.dll = C:\Programmi\Microsoft Office\OFFICE11\msohev.dll
@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/C:\WINDOWS\System32\twext.dll = C:\WINDOWS\System32\twext.dll
@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/C:\WINDOWS\System32\twext.dll = C:\WINDOWS\System32\twext.dll
@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/C:\WINDOWS\System32\extmgr.dll = C:\WINDOWS\System32\extmgr.dll
@{CC0F5AAC-24A5-40D5-8014-1ED7B4971DBF} /*Vocal Reader - Shell Extension*/C:\Programmi\VocalReader\VocalReader3.dll = C:\Programmi\VocalReader\VocalReader3.dll
@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =
@{23F0DC38-DC86-49D6-81EC-40C54A204212} /*Zen Nano Plus Media Explorer*/C:\Programmi\Creative\Creative Zen Nano Plus\CTMvns.dll = C:\Programmi\Creative\Creative Zen Nano Plus\CTMvns.dll
@{B41DB860-8EE4-11D2-9906-E49FADC173CA} /*WinRAR shell extension*/C:\Programmi\WinRAR\rarext.dll = C:\Programmi\WinRAR\rarext.dll
@{FFB699E0-306A-11d3-8BD1-00104B6F7516} /*Play on my TV helper*/C:\WINDOWS\System32\nvcpl.dll = C:\WINDOWS\System32\nvcpl.dll
@{472083B0-C522-11CF-8763-00608CC02F24} /*avast*/C:\Programmi\Alwil Software\Avast4\ashShell.dll = C:\Programmi\Alwil Software\Avast4\ashShell.dll
@{D653647D-D607-4DF6-A5B8-48D2BA195F7B} /*BitDefender Antivirus v8*/C:\Programmi\Softwin\BitDefender8\bdshelxt.dll = C:\Programmi\Softwin\BitDefender8\bdshelxt.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>
avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll
BitDefender Antivirus v8@{D653647D-D607-4DF6-A5B8-48D2BA195F7B} = C:\Programmi\Softwin\BitDefender8\bdshelxt.dll
VocalReader3@{CC0F5AAC-24A5-40D5-8014-1ED7B4971DBF} = C:\Programmi\VocalReader\VocalReader3.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WinZip\WZSHLSTB.DLL

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ >>>
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WinZip\WZSHLSTB.DLL

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>
avast@{472083B0-C522-11CF-8763-00608CC02F24} = C:\Programmi\Alwil Software\Avast4\ashShell.dll
BitDefender Antivirus v8@{D653647D-D607-4DF6-A5B8-48D2BA195F7B} = C:\Programmi\Softwin\BitDefender8\bdshelxt.dll
WinRAR@{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programmi\WinRAR\rarext.dll
WinZip@{E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WinZip\WZSHLSTB.DLL

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\System32\sstext3d.scr

HKLM\Software\Microsoft\Internet Explorer\Main >>>
@Default_Page_URLhttp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome = http://www.microsoft.com/isapi/redir.dl ... ar=msnhome
@Start Pagehttp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>
@Start Pagehttp://www.google.com/ = http://www.google.com/
@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm

HKLM\Software\Classes\PROTOCOLS\Filter\text/xml@CLSID = C:\Programmi\File comuni\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

HKLM\Software\Classes\PROTOCOLS\Handler\ >>>
dvd@CLSID = C:\WINDOWS\system32\msvidctl.dll
its@CLSID = C:\WINDOWS\System32\itss.dll
mhtml@CLSID = %SystemRoot%\System32\inetcomm.dll
ms-its@CLSID = C:\WINDOWS\System32\itss.dll
ms-itss@CLSID = C:\Programmi\File comuni\Microsoft Shared\Information Retrieval\MSITSS.DLL
mso-offdap@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
mso-offdap11@CLSID = C:\PROGRA~1\FILECO~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
tv@CLSID = C:\WINDOWS\system32\msvidctl.dll

HKLM\Software\Classes\PROTOCOLS\Handler\wia@CLSID = C:\WINDOWS\System32\wiascr.dll

con HiJack

Logfile of HijackThis v1.99.1
Scan saved at 16.44.03, on 25/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\VEXPLITE\viritsvc.exe
C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINDOWS\system32\dslagent.exe
C:\Programmi\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe
C:\VEXPLITE\MONLITE.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmi\Softwin\BitDefender8\bdnagent.exe
C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Softwin\BitDefender8\bdmcon.exe
C:\Programmi\Softwin\BitDefender8\bdlite.exe
C:\VEXPLITE\viritexp.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\Utente\Desktop\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmi\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programmi\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [VIRIT LITE MONITOR] C:\VEXPLITE\MONLITE.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [BDMCon] "C:\Programmi\Softwin\BitDefender8\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Programmi\Softwin\BitDefender8\bdnagent.exe"
O4 - HKCU\..\Run: [Creative Detector] C:\Programmi\Creative\MediaSource\Detector\CTDetect.exe /R
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\FILECO~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas http://www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

di **lucas/s** » 25/08/06 15:52

sinceramente non vedo niente

apri il prompt dos(start>esegui>cmd) e digita:
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
Dai l'invio
Avvia gmer,clicca sul tag Rootkit,clicca su Scan,attendi la fine della scansione e clicca su Copy
Apri il block notes di windows,clicca su modifica>incolla
Clicca su File>salva con nome
Salva il file sul desktop
Apri il file salvato,copia e incolla il contenuto nella tua risposta

Grazie ciao

di **RickyLost** » 25/08/06 16:16

ciao e grazie...ho fatto quello che mi hai suggerito:
mi dice solo "gmer has not found any system modification" :eeh:

pero se avvio virt mim dice "C:\:125208df.cpx:$DATA Infetto da Trojan.Win32.RootKit.E" :roll:

...io ho seguito tutte le procedure e pareva scomparso poi dopo due o tre scansioni virt mi ha detto come ti ho scritto

di **lucas/s** » 25/08/06 16:30

Ok
Per piacere scarica questo programma
http://www.merijn.org/files/adsspy.zip
Decomprimi l'archivio
avvia il programma,leva tutte le spunte presenti e mettila solo nella casella "Scan only this folder",clicca sul pulsantino e seleziona il disco rigido da scansionare,clicca su "Scan the system ecc " per far partire la scansione
A fine scansione dovresti visualizzare questo valore
C:\:125208df.cpx
Metti la spunta(flag) nella caselle che corrisponde al valore e clicca su "Remove selected streams"

Ciao

PS:Ehi disattiva virit durante l'operazione

di **RickyLost** » 25/08/06 16:51

mi dice "the following ADS stream could not be deleted,they may be locked by another program : 125208.cpx" :eeh:

comunque è gia qualcosa che l'abbia trovato,prima nessun programma lo riusciva a trovare...suggerimenti :?:

di **lucas/s** » 25/08/06 17:15

è un casino adesso porca miseria
dai questo comando dal prompt
C:\WINDOWS\system32\notepad.exe C:\:125208df.cpx
Elimina il contenuto del block notes(sempre che si apra)
Chiudi il block notes
Alla domanda se vuoi salvarlo rispondi SI

Ciao

PS:Probabilmente di da un messaggio che la memoria virtuale è insufficente

di **RickyLost** » 25/08/06 17:27

è successo come avevi previsto :eeh:

,il block si apre poi mi dice che è impossibile salvarlo e di controllare che il percorso sia valido e infine che la memoria è insufficiente...ho provato chiudendo tutte le applicazioni ma nulla..ma cosa diavolo mi sono beccato nel PC?possibile che sia così potente! :?:

di **lucas/s** » 25/08/06 17:32

Anche peggio,prova con Antivir ciao

di **RickyLost** » 25/08/06 18:39

ciao,purtroppo antivir non trova nulla...che faccio?mi sa che c'è solo da riformattare tutto,vero?
comunque grazie1000

di **lucas/s** » 25/08/06 18:43

Aspetta
Scarica questo file http://www.geocities.com/holifay89/cat.zip
Estrai il file in C:\Windows
Adesso apri il prompt dos
(Start>esegui>cmd)
Dove lampeggia il cursore digita:
CD C:\Windows <------dai l'invio
cat C:\:125208df.cpx > c:\forum.bak <------dai l'invio

Apri C:\ dovresti trovare il file forum.bak,perpiacere me lo invii?
Lo puoi inviare tramite questa form
http://www.suspectfile.com/

Grazie

di **RickyLost** » 25/08/06 19:00

senti mi dice che accettano solo file zip ma non bak,ma non riesco a zipparlo ...comunque devo mettere il mio user-name o il mio vero nome?

di **lucas/s** » 25/08/06 19:05

me lo puoi allegare ad un e-mail
lucass[at]suspectfile.com
(sostituisci [at] con la @

Grazie

di **RickyLost** » 25/08/06 19:06

senti come nome ho messo il mio user-name e ho zippato il file...spero di aver fatto bene

di **RickyLost** » 25/08/06 19:06

ah ok ho visto ora il msg...ora te lo mando

di **RickyLost** » 25/08/06 19:12

te l'ho inviato...

di **lucas/s** » 25/08/06 19:28

Aggiorna Antivir lo riconosce e come.

di **RickyLost** » 25/08/06 19:35

forse allora devo disinstallare avast?
perche ho notato che come aggiornavo mi trovava dei virus...possibile che vedesse certi elementi di antivir come virus? :?:

di **lucas/s** » 25/08/06 19:40

No disattivalo avast aggiorna antivir e lancia una scansione completa(meglio se dalla provvisoria)facile no?

Ciao

di **RickyLost** » 26/08/06 09:37

ciao!avevi ragione antivir l'ha trovato,6 UN GENIO!!!...

grazie davvero della tua disponibilità!!!

ora spero non torni di nuovo perchè mi ha fatto impazzire in questi giorni,meno male che mi hai aiutato!ciao

di **lucas/s** » 26/08/06 09:47

Caffè please

Contento che hai risolto

Ciao

Trojan.Win32.RootKit.E..come individuare percorso nascosto?

Trojan.Win32.RootKit.E..come individuare percorso nascosto?

Topic correlati a "Trojan.Win32.RootKit.E..come individuare percorso nascosto?":

Chi c’è in linea