Invio il log del computer dell'ufficio nel quale Avast continua a dire di aver trovato un worm che non riesce a processare. Per altro questo worm sembra ricrearsi in ogni dove. Mi date un'occhiata al log? grazie, jjmmy

Logfile of HijackThis v1.99.1
Scan saved at 16.00.22, on 01/08/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Programmi\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINNT\System32\svchost.exe
C:\Programmi\FreePOPs\freepopsservice.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\Ahead\InCD\InCDsrv.exe
C:\WINNT\system32\mgabg.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Ahead\InCD\InCD.exe
C:\WINNT\system32\internat.exe
C:\Programmi\Everyday Auto Backup\AutoBackup.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Administrator\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.unipr.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: m1a2 - {521693AA-7453-47ED-9959-3BD47DAA1B1A} - C:\WINNT\system32\msx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programmi\Ahead\InCD\InCD.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Everyday Auto Backup] C:\Programmi\Everyday Auto Backup\AutoBackup.exe /1
O4 - Startup: Collegamento a freepopsd.exe.lnk = C:\Programmi\FreePOPs\freepopsd.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{338CD1F2-9515-4121-A307-391048F28098}: NameServer = 160.78.48.10,192.135.11.20
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: F-Secure Automatic Update (BackWeb Client - 7681197) - Unknown owner - (no file)
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: FreePOPs - Unknown owner - C:\Programmi\FreePOPs\freepopsservice.exe
O23 - Service: fsbwsys - Unknown owner - (no file)
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programmi\Ahead\InCD\InCDsrv.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\system32\mgabg.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\Oracle\Ora81\BIN\ONRSD.EXE
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmi\Sygate\SPF\smc.exe
O23 - Service: Microsoft Service Manager (winmdgr) - Sygate Technologies, Inc. - (no file)

Ciao
fai cosi:
- Scarica <b><u>Killbox</u></b>

- Portati nelle installazioni/applicazioni del pannello di controllo e disinstalla tutto quello che non hai installato tu..

---

- <b>Consiglio__</b>Metti hijackthis in una cartella a lui dedicata,es;(C:\HJT) altrimenti non sarà in grado di fare il backup delle voci rimosse
- <b>Consiglio__</b>Stampati la pagina perché in modalità provvisoria non avrai accesso a internet

---

Poi:
- <b>Riavvia in modalità provvisoria</b>
guida-->> http://www.aiutamici.com/software/view.asp?tipo=home&CodSw=344&SH=NA

- <b>Assicurati di avere accesso a file e cartelle nascosti</b>
(Pannello di controllo--> Opzioni Cartella--> Visualizzazione) metti la spunta su:
1)Visualizza file e cartelle nascoste
2)Disattiva nascondi file protetti di sistema

- Decomprimi la cartella , avvia Killbox.exe e segui i 3 passaggi come da esempio:
1) Inserisci il percorso del file <b>(C:\WINNT\system32\msx.dll)</b> in <b>full path</b> mediante il tasto a cartellina
2) Seleziona delete on reboot
3) Clicca sulla X rossa in alto a destra e il computer verrà riavviato

<img src="http://img214.imageshack.us/img214/3333/killlf3.jpg" border=0>

Con hijackthis adesso fixa questa voce se presente ancora:
O2 - BHO: m1a2 - {521693AA-7453-47ED-9959-3BD47DAA1B1A} - C:\WINNT\system32\msx.dll


Fai anche uno scan online al limite:
http://steven.altervista.org/files/scan.html

Assicurati di non avere questi files:
C:\WINNT\system32\gtrack.dll
C:\WINNT\system32\kaboom.dll
C:\WINNT\Temp\wmpl.exe
C:\WINNT\system32\msx.dll
C:\WINNT\system32\iewatch.exe
C:\WINNT\system32\icqchk.exe
C:\WINNT\system32\kpsf.exe
C:\WINNT\system32\ietool1.exe
C:\WINNT\system32\ietool2.exe
C:\WINNT\system32\ietool3.exe
C:\WINNT\system32\kpsf.sys
C:\WINNT\system32\kpsf.ini


Edited by - steven75 on 08/01/2006 20:52:37