Ecco, ho fatto tutto. Questo è il log di Malwarebytes:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.orgVersione database: v2012.07.02.03
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Maria Silvana :: SILVANA [amministratore]
02/07/2012 20.43.51
mbam-log-2012-07-02 (20-43-51).txt
Tipo di scansione: Scansione completa
Opzioni di scansione attive: Memoria | Esecuzione automatica | Registro | File system | Euristica/Extra | Euristica/Shuriken | PUP | PUM
Opzioni di scansione disattivate: P2P
Elementi esaminati: 319310
Tempo impiegato: 2 ore, 8 minuti, 43 secondi
Processi rilevati in memoria: 0
(non sono stati rilevati elementi nocivi)
Moduli di memoria rilevati: 0
(non sono stati rilevati elementi nocivi)
Chiavi di registro rilevate: 0
(non sono stati rilevati elementi nocivi)
Valori di registro rilevati: 0
(non sono stati rilevati elementi nocivi)
Voci rilevate nei dati di registro: 0
(non sono stati rilevati elementi nocivi)
Cartelle rilevate: 0
(non sono stati rilevati elementi nocivi)
File rilevati: 8
C:\Documents and Settings\Maria Silvana\Impostazioni locali\Dati applicazioni\Thinstall\Cache\Stubs\d308e2a8cfc4791af89e692e9dd1a3a21a7a2\DvsService.exe (Trojan.Backdoor) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\programmi portatili o eseguibili\FormatFactoryPortable (convertitore)\Settings\Format Factory Portable\Settings\Native\STUBEXE\8.0.1112\@SYSTEM@\cmd.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\programmi portatili o eseguibili\FormatFactoryPortable (convertitore)\Settings\Format Factory Portable\Settings\Native\STUBEXE\8.0.1112\@SYSTEM@\regsvr32.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\programmi portatili o eseguibili\FormatFactoryPortable (convertitore)\Settings\Format Factory Portable\Settings\Native\STUBEXE\8.0.1112\@WINDIR@\regedit.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\programmi portatili o eseguibili\FormatFactoryPortable (convertitore)\Settings\Format Factory Portable\Settings\Virtual\STUBEXE\8.0.1112\@PROGRAMFILES@\FreeTime\FormatFactory\FormatFactory.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\programmi portatili o eseguibili\FormatFactoryPortable (convertitore)\Settings\Format Factory Portable\Settings\Virtual\STUBEXE\8.0.1112\@PROGRAMFILES@\FreeTime\FormatFactory\FFModules\mencoder.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\programmi portatili o eseguibili\FormatFactoryPortable (convertitore)\Settings\Format Factory Portable\Settings\Virtual\STUBEXE\8.0.1112\@PROGRAMFILES@\FreeTime\FormatFactory\FFModules\mplayer.exe (Trojan.Agent) -> Spostato in quarantena ed eliminato con successo.
C:\Programmi\VideoLAN\VLC\pl\tmp2\ssid.exe (Trojan.Agent.cn) -> Spostato in quarantena ed eliminato con successo.
(fine)
Ho eliminato i trojan e riavviato.
Questo, invece, è il log di HijackThis, dopo il riavvio:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23.12.46, on 02/07/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\AVAST Software\Avast\avastUI.exe
C:\Programmi\COMODO\COMODO Internet Security\cfp.exe
C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Maria Silvana\Documenti\Download\Nuova cartella\PortableApps\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://program.avast.com/api/?action=2&p_age=0&p_cid=1&p_cpv=100664663&p_elm=43&p_eml=msrg@hotmail.it&p_idw=0&p_iid=0&p_inf=0&p_lan=1040&p_lci=1040&p_let=24&p_lex=365&p_lic=0&p_lid=it-it&p_lit=1223632&p_lng=it&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_man=0&p_osv=5.1&p_pro=0&p_rcv=1&p_reh=768&p_rew=1024&p_tri=0&p_uid=cc79&p_vbd=1367&p_vep=6&p_ves=0&p_wnf=0&p_fsh=6.0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avast] "C:\Programmi\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Programmi\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [PPort11reminder] "C:\Programmi\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dati applicazioni\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Programmi\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [ControlCenter3] C:\Programmi\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [AS00_Gear511] C:\Programmi\NETGEAR\WG511SCU\Utility.\Gear511.exe -hide
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Maria Silvana\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DDDE44F-AAA3-4056-900B-485F9070BF41}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{956473A7-608F-401D-8E7D-58C3093B6500}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B531C7A-9C6C-4910-94CF-D5C462AB0385}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{C34208E7-C704-426C-872E-DF9EA1348645}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCDD0E1A-BA97-491A-8DBA-06A5494B1BA3}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{5DDDE44F-AAA3-4056-900B-485F9070BF41}: NameServer = 176.31.229.24,176.31.229.25
O17 - HKLM\System\CS2\Services\Tcpip\..\{5DDDE44F-AAA3-4056-900B-485F9070BF41}: NameServer = 176.31.229.24,176.31.229.25
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programmi\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Programmi\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Programmi\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Servizio Google Update (gupdate) (gupdate) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: Servizio Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Programmi\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Pos Service (PowerOffer Service) - Unknown owner - C:\Documents and Settings\Maria Silvana\Impostazioni locali\Dati applicazioni\PosService\Pos.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Programmi\WinPcap\rpcapd.exe
O23 - Service: ServiceLayer - Nokia - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Serv Updater (ServUpdater) - Unknown owner - C:\Documents and Settings\Maria Silvana\Impostazioni locali\Dati applicazioni\ServUpdater\ServiceUpd.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Programmi\Skype\Updater\Updater.exe
--
End of file - 8392 bytes
Ora è tardi, grazie ancora e ci ritroviamo domani. Buonanotte a tutti.
