TROJAN-SPY.HTML.smitfraud.c
Logfile of HijackThis v1.99.1
Scan saved at 17.02.27, on 25/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\PavProt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\PavFnSvr.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\Pavkre.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\System32\winsi32.exe
C:\Programmi\ISTsvc\istsvc.exe
C:\WINDOWS\bbjie.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\programmi\180solutions\sais.exe
C:\Programmi\MSN Apps\Updater\01.02.3000.1001\it\msnappau.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\WINDOWS\isrvs\desktop.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\APVXDWIN.EXE
C:\WINDOWS\System32\ap9h4qmo.exe
C:\Program Files\Vjzligy\Ttcw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\rouu\rouum.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\eMule\emule.exe
C:\TinMessenger\TinMessenger.exe
C:\PROGRA~1\COMMON~1\rouu\rouua.exe
C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\prevsrv.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\psimsvc.exe
C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\WebProxy.exe
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\AdTools Service\AdToolsKeep.exe
C:\temp\NCASEP~1.EXE
C:\WINDOWS\System32\rundll32.exe
C:\temp\NCASEP~1.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\temp\NCASEP~1.EXE
C:\Programmi\MSN\MSNCoreFiles\msn6.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Documents and Settings\topo gigio\Impostazioni locali\Temp\Directory temporanea 3 per hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gw.aliceadsl.it/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fornito da Alice
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {5B6920AC-C976-475C-B2CE-CCBB2A8B0A85} - C:\WINDOWS\System32\bglo.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmi\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programmi\SideFind\sfbho.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Programmi\ISTbar\istbarcm.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Microsoft Update Machine] winrun32.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] sp2hosts.exe
O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] winreg32.exe
O4 - HKLM\..\Run: [Window_Protect] winsi32.exe
O4 - HKLM\..\Run: [IST Service] C:\Programmi\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Ndry7] C:\WINDOWS\bbjie.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [sais] c:\programmi\180solutions\sais.exe
O4 - HKLM\..\Run: [ivifwzyv] C:\WINDOWS\ivifwzyv.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmi\MSN Apps\Updater\01.02.3000.1001\it\msnappau.exe"
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Programmi\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [Xjmsgkz] C:\Program Files\Vjzligy\Ttcw.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] winrun32.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] sp2hosts.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] winreg32.exe
O4 - HKLM\..\RunServices: [Window_Protect] winsi32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Sygate Personal Firewall] sp2hosts.exe
O4 - HKCU\..\Run: [Window_Protect] winsi32.exe
O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] winreg32.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] winrun32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [rouu] C:\PROGRA~1\COMMON~1\rouu\rouum.exe
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Programmi\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet
O4 - Startup: C6 Messenger.lnk = C:\TinMessenger\TinMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programmi\SideFind\sidefind.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\MSMSGS.EXE
O9 - Extra button: Alice - {37454518-DFF5-466D-87EE-54C9A702C7C2} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A2ED8642-D1C9-42DA-8230-E999733C4001} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A2ED8642-D1C9-42DA-8230-E999733C4001} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc/U1MEyxMMg6mC58ua-GY.chm::/on-line.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CF4D26E1-ADF9-4B51-A776-4C55642B85AC}: NameServer = 217.141.109.207 151.99.125.1
O18 - Filter: text/html - {3556C6C1-F2BA-4CE1-B9C2-F2D83BCBA2EC} - C:\WINDOWS\System32\bglo.dll
O18 - Filter: text/plain - {3556C6C1-F2BA-4CE1-B9C2-F2D83BCBA2EC} - C:\WINDOWS\System32\bglo.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\PavProt.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Programmi\File comuni\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Programmi\Panda Software\Panda TruPrevent Personal 2005\psimsvc.exe

Ciao ,
esegui queste operazioni

1) Disattiva il ripristino di configurazione, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=257&SH=N

2) riavvia in modalità provvisoria, leggi qui come fare
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=N

apri HIJAC THIS ed elimina come indicato in questo articolo
http://www.aiutamici.com/software/descrizione.asp?CodSw=1175
le righe che seguono, (nel caso le righe da eliminare non compaiono in modalità provvisoria, eliminale dalla modalità normale e riavvia il computer).

==================================
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
-
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
-
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {5B6920AC-C976-475C-B2CE-CCBB2A8B0A85} - C:\WINDOWS\System32\bglo.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll
-
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Programmi\SideFind\sfbho.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Programmi\ISTbar\istbarcm.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
-
O4 - HKLM\..\Run: [Microsoft Update Machine] winrun32.exe
O4 - HKLM\..\Run: [Sygate Personal Firewall] sp2hosts.exe
O4 - HKLM\..\Run: [NTSF MICROSOFT SYSTEM] winreg32.exe
O4 - HKLM\..\Run: [Window_Protect] winsi32.exe
O4 - HKLM\..\Run: [IST Service] C:\Programmi\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Ndry7] C:\WINDOWS\bbjie.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [sais] c:\programmi\180solutions\sais.exe
O4 - HKLM\..\Run: [ivifwzyv] C:\WINDOWS\ivifwzyv.exe
-
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
-
O4 - HKLM\..\Run: [MSNSysRestore] C:\WINDOWS\System32\pc32.exe bg
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [Xjmsgkz] C:\Program Files\Vjzligy\Ttcw.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] winrun32.exe
O4 - HKLM\..\RunServices: [Sygate Personal Firewall] sp2hosts.exe
O4 - HKLM\..\RunServices: [NTSF MICROSOFT SYSTEM] winreg32.exe
O4 - HKLM\..\RunServices: [Window_Protect] winsi32.exe
-
O4 - HKCU\..\Run: [Sygate Personal Firewall] sp2hosts.exe
O4 - HKCU\..\Run: [Window_Protect] winsi32.exe
O4 - HKCU\..\Run: [NTSF MICROSOFT SYSTEM] winreg32.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] winrun32.exe
-
O4 - HKCU\..\Run: [rouu] C:\PROGRA~1\COMMON~1\rouu\rouum.exe
-
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Programmi\SideFind\sidefind.dll
-
O9 - Extra button: Alice - {37454518-DFF5-466D-87EE-54C9A702C7C2} - http://gw.aliceadsl.it/alice (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A2ED8642-D1C9-42DA-8230-E999733C4001} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A2ED8642-D1C9-42DA-8230-E999733C4001} - (no file) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://gw.aliceadsl.it/home
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://dl.ad-ware.cc/U1MEyxMMg6mC58ua-GY.chm::/on-line.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c7.cab
-
O18 - Filter: text/html - {3556C6C1-F2BA-4CE1-B9C2-F2D83BCBA2EC} - C:\WINDOWS\System32\bglo.dll
O18 - Filter: text/plain - {3556C6C1-F2BA-4CE1-B9C2-F2D83BCBA2EC} - C:\WINDOWS\System32\bglo.dll
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
==================================

Con la funzione TROVA di Windows, cerca ed elimina questi file,

==================================
se.dll
spage.html
nem220.dll
sysupd.dll
bglo.dll
wsem303.dll
sfbho.dll
istbarcm.dll
winrun32.exe
sp2hosts.exe
winreg32.exe
winsi32.exe
istsvc.exe
bbjie.exe
optimize.exe
sais.exe
ivifwzyv.exe
MediaAccK.exe
desktop.exe
ffisearch.exe
pc32.exe
ap9h4qmo.exe
Ttcw.exe
AdTools.exe
rouum.exe
sidefind.dll
hwclock.exe
==================================

SVUOTA LA CARTELLA C:\DOCUME~1\TOPOGI~1\IMPOST~1\Temp

ELIMINA LE CARTELLE IN ROSSO
C:\WINDOWS\<font color=red><b>isrvs</font id=red></b>
C:\Programmi\<font color=red><b>SideFind</font id=red></b>
C:\Programmi\<font color=red><b>ISTbar</font id=red></b>
C:\Programmi\<font color=red><b>ISTsvc</font id=red></b>
C:\Program Files\<font color=red><b>Internet Optimizer</font id=red></b>
c:\programmi\<font color=red><b>180solutions</font id=red></b>
C:\Program Files\<font color=red><b>Media Access</font id=red></b>
C:\Program Files\<font color=red><b>Vjzligy</font id=red></b>
C:\Program Files\<font color=red><b>AdTools Service</font id=red></b>
C:\PROGRA~1\COMMON~1\<font color=red><b>rouu</font id=red></b>


Vai a PANNELLO DI CONTROLLO e clicca su OPZIONI INTERNET
nella finestra che si apre clicca i tre pulsanti
ELIMINA COOKIES - ELIMINA FILE . CANCELLA CRONOOLOGIA
clicca inoltre sul pulsante PAGINA PREDEFINITA e poi su OK

al termine utilizza i programmi AD-AWARE e SPYBOT indicati in questo articolo
http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=388&SH=N

sempre in modalità provvisoria fai una scansione Antivirus

quindi riavvia il computer e controlla se il problema e risolto, se e tutto OK riattiva il ripristino configurazione disattivato all'inizio di questa procedura.


BLOCCO QUIESTO FORUM PER LA PRESENZA DI LINK CHE FANNO CARICARE VIRUS - APRI UN NUOVO MESSAGGIO PER CONTINUARE IL DISCORSO.

---

Collaboratore Aiutamici