Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » molteplici problemi con windows xp!

2 pages: [1] 2
molteplici problemi con windows xp! Opzioni
Topic Precedente · Topic Sucessivo
bysa0
Inviato: Sunday, October 18, 2009 12:12:06 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
Ciao a tutti! Brick wall
sono un nuovo iscritto a questo forum, e spero che voi aiutamici potrete aiutarmi nei miei problemi informatici:

1- pc lentissimo all'avvio e anche nell'apertura di molti programmi.

2- praticamente 3-4 volte al giorno si apre una finestra di errore con explorer.exe, strano perchè explorer non lo uso mai. cmq non è un grave problema, basta cliccare su "ok" e nel giro di 2 minuti si risolve tutto.

3- altra finestra di errore che si apre da sola: errore dwrt32. E questo è già più grave perchè poi devo riavviare il pc, siccome non funziona più niente, nemmeno il mouse! Think

4- Classica schermata blu e conseguente riavvio del computer. ormai ci sono abituato... Anxious Anxious

Tentando di risolvere i miei problemi da solo ho sguazzato nella rete in cerca di soluzioni e ho fatto la scansione completa con MALWAREBYTES-ANTIMALWARE e con Hijackthis Questo è il responso:

Ah ecco: la scansione con malware è durata più di un ora, e quella con hijackthis è durata 5 secondi!! magari ho fatto quella parziale e non quella completa... mah... Eh?

Aiutatemi vi prego!!



LOG CON MALWAREBYTES:

Malwarebytes' Anti-Malware 1.41
Versione del database: 2974
Windows 5.1.2600 Service Pack 3

13/10/2009 19.24.44
mbam-log-2009-10-13 (19-24-28).txt

Tipo di scansione: Scansione completa (C:\|D:\|)
Elementi scansionati: 172423
Tempo trascorso: 1 hour(s), 24 minute(s), 51 second(s)

Processi delle memoria infetti: 1
Moduli della memoria infetti: 2
Chiavi di registro infette: 8
Valori di registro infetti: 7
Elementi dato del registro infetti: 2
Cartelle infette: 0
File infetti: 96

Processi delle memoria infetti:
C:\WINDOWS\AhnRpta.exe (Trojan.Backdoor) -> No action taken.

Moduli della memoria infetti:
C:\WINDOWS\system32\e8main0.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\Bitkv0.dll (Spyware.OnlineGames) -> No action taken.

Chiavi di registro infette:
HKEY_CLASSES_ROOT\CLSID\{bb4c402f-882a-4526-8c08-51278ea437c1} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c5f43bef-ce2f-46d8-afe6-a647bacd1f09} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c5f43bef-ce2f-afe6-46d8-a647bacd1f09} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\NOD32KVBIT (Trojan.Frethog) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Give4Free Plugin (Adware.Give4free) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Give4Free Plugin (Adware.Give4free) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\MADOWN (Worm.Magania) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> No action taken.

Valori di registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{bb4c402f-882a-4526-8c08-51278ea437c1} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c5f43bef-ce2f-46d8-afe6-a647bacd1f09} (Spyware.OnlineGames) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kamsoft (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vamsoft (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\host-domain-lookup.com (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.host-domain-lookup.com (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> No action taken.

Elementi dato del registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> No action taken.

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\WINDOWS\system32\e8main0.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\Bitkv0.dll (Spyware.OnlineGames) -> No action taken.
C:\0c9k.exe (Spyware.OnlineGames) -> No action taken.
C:\10nb.exe (Worm.Magania) -> No action taken.
C:\2fiji.com (Spyware.OnlineGames) -> No action taken.
C:\3c.exe (Spyware.OnlineGames) -> No action taken.
C:\3j2h0tf.bat (Worm.Magania) -> No action taken.
C:\3yalgc.exe (Spyware.OnlineGames) -> No action taken.
C:\dogyx90.exe (Spyware.OnlineGames) -> No action taken.
C:\eyt.exe (Spyware.OnlineGames) -> No action taken.
C:\fsaht.cmd (Spyware.OnlineGames) -> No action taken.
C:\gbm6n.exe (Spyware.OnlineGames) -> No action taken.
C:\gi2ky.exe (Spyware.OnlineGames) -> No action taken.
C:\icxpa.cmd (Spyware.OnlineGames) -> No action taken.
C:\ph.exe (Worm.Magania) -> No action taken.
C:\q1alx.exe (Worm.Magania) -> No action taken.
C:\qcod.exe (Worm.Magania) -> No action taken.
C:\qv9qc9f.exe (Worm.AutoRun) -> No action taken.
C:\rdsfk.com (Spyware.OnlineGames) -> No action taken.
C:\rg9g9bgq.exe (Spyware.OnlineGames) -> No action taken.
C:\s3ek.exe (Spyware.OnlineGames) -> No action taken.
C:\6phx.com (Spyware.OnlineGames) -> No action taken.
C:\aphqg.exe (Worm.Magania) -> No action taken.
C:\bycfht.exe (Spyware.OnlineGames) -> No action taken.
C:\cj3k.exe (Worm.Magania) -> No action taken.
C:\sm.exe (Spyware.OnlineGames) -> No action taken.
C:\wrsf.exe (Spyware.OnlineGames) -> No action taken.
C:\yudald.bat (Trojan.GameThief) -> No action taken.
C:\lhh3v.exe (Spyware.OnlineGames) -> No action taken.
C:\m.exe (Spyware.OnlineGames) -> No action taken.
C:\nu.cmd (Spyware.OnlineGames) -> No action taken.
C:\o8tf6l.exe (Spyware.OnlineGames) -> No action taken.
C:\o9bxu.exe (Worm.Magania) -> No action taken.
C:\Programmi\Trend Micro\HijackThis\backups\backup-20081110-153838-734.dll (Adware.Chiem) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP708\A0644731.EXE (Trojan.FlyStudio) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP708\A0645755.EXE (Trojan.FlyStudio) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP708\A0645756.EXE (Trojan.FlyStudio) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP709\A0645767.EXE (Trojan.FlyStudio) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP711\A0653021.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP712\A0654089.exe (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{161B6758-C94C-45E9-9B16-16CB50A7F9E0}\RP713\A0654112.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\nmdfgds0.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\nmdfgds1.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\olhrwef.exe (Trojan.GameThief) -> No action taken.
C:\WINDOWS\system32\4EA053\d83a70.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\4EA053\i-123.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\4EA053\RegEx.fnr (Worm.AutoRun) -> No action taken.
C:\WINDOWS\system32\4EA053\TPULETE2.EXE (Trojan.FlyStudio) -> No action taken.
C:\WINDOWS\system32\4EA053\XX-F980D.EXE (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\4EA053\Z8-23EBB.EXE (Trojan.FlyStudio) -> No action taken.
C:\Documents and Settings\oem.YOUR-154EF2BC30\Impostazioni locali\Temp\QRC.exe (Adware.QUADRegClean) -> No action taken.
C:\Documents and Settings\oem.YOUR-154EF2BC30\Impostazioni locali\Temp\nmdfgds1.dll (Worm.Magania) -> No action taken.
C:\Documents and Settings\oem.YOUR-154EF2BC30\Impostazioni locali\Temporary Internet Files\Content.IE5\F8WFT14D\QUAD_RegistryCleaner_v.1.5.97[1].exe (Adware.QUADRegClean) -> No action taken.
C:\sp1jensi.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\kav321.dll (Spyware.OnlineGames) -> No action taken.
C:\e2.cmd (Trojan.GameThief) -> No action taken.
C:\b.exe (Trojan.Agent) -> No action taken.
C:\i.exe (Trojan.Agent) -> No action taken.
C:\p.exe (Trojan.Agent) -> No action taken.
C:\cv22.cmd (Trojan.Agent) -> No action taken.
C:\minm.cmd (Trojan.Agent) -> No action taken.
C:\p1y2.cmd (Trojan.Agent) -> No action taken.
C:\xih9.cmd (Trojan.Agent) -> No action taken.
C:\n6t1h.cmd (Trojan.Agent) -> No action taken.
C:\nq0cq.cmd (Trojan.Agent) -> No action taken.
C:\rcukd.cmd (Trojan.Agent) -> No action taken.
C:\yannh.cmd (Trojan.Agent) -> No action taken.
C:\08dgu.com (Trojan.Agent) -> No action taken.
C:\0bcobed.exe (Spyware.OnlineGames) -> No action taken.
C:\68.exe (Trojan.Agent) -> No action taken.
C:\6fnlpetp.exe (Trojan.Agent) -> No action taken.
C:\86l2qw.bat (Spyware.OnlineGames) -> No action taken.
C:\8rcahp.exe (Spyware.OnlineGames) -> No action taken.
C:\itsduel.exe (Trojan.Agent) -> No action taken.
C:\lky.exe (Trojan.Agent) -> No action taken.
C:\opgde.exe (Spyware.OnlineGames) -> No action taken.
C:\pnt.com (Trojan.Agent) -> No action taken.
C:\pook.com (Trojan.Agent) -> No action taken.
C:\vfjc8mxm.exe (Spyware.OnlineGames) -> No action taken.
C:\xdw.com (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\amvo.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\amvo0.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\amvo1.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\Bitkv1.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\ckvo.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ckvo0.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\ckvo1.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\gasretyw0.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\gasretyw1.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\kamsoft.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\kav320.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\vamsoft.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\oem.YOUR-154EF2BC30\Impostazioni locali\Temp\cvasds0.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\oem.YOUR-154EF2BC30\Impostazioni locali\Temp\cvasds1.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\oem.YOUR-154EF2BC30\Impostazioni locali\Temp\herss.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\AhnRpta.exe (Trojan.Backdoor) -> No action taken.



LOG CON HIJACKTHIS:









Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.15.15, on 13/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
c:\programmi\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
C:\Programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\programmi\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
c:\programmi\mcafee.com\agent\mcagent.exe
C:\WINDOWS\AhnRpta.exe
C:\Programmi\Canon\CAL\CALMAIN.exe
c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\56443B\81942E.EXE
C:\WINDOWS\explorer.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Vista HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Programmi\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Programmi\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [AutoTBar] C:\Programmi\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Programmi\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Programmi\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [81942E] C:\WINDOWS\system32\56443B\81942E.EXE
O4 - HKLM\..\Run: [AliceRE_McciTrayApp] C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven_dev\syncer\McciTrayApp.exe
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\kamsoft.exe
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\OEM~1.YOU\IMPOST~1\Temp\herss.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: 81942E.lnk = C:\WINDOWS\system32\56443B\81942E.EXE
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmi\Canon\CAL\CALMAIN.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programmi\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Network WanMiniport First Position - Unknown owner - C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 8069 bytes
Torna in alto
 
Sponsor
Inviato: Sunday, October 18, 2009 12:12:06 PM

 
Torna in alto
 
r16
Inviato: Sunday, October 18, 2009 3:23:33 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Non ho parole, per dire come è ridotto quel pc.

Elimina tutto quello che ha trovato Malwarebytes.

Disattiva il ripristino configurazione di sistema, e tienilo disattivato, fino alla soluzione del problema http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80121

Avvia hijackthis, metti la spunta alle voci che andrò ad elencarti e con tutte le applicazioni chiuse e disconnesso da Internet,premi su fix checked

O4 - HKLM\..\Run: [81942E] C:\WINDOWS\system32\56443B\81942E.EXE
O4 - HKLM\..\Run: [AliceRE_McciTrayApp] C:\PROGRA~1\ALICET~1\vendors\AliceRE\content\template\driven_dev\syncer\McciTray
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\kamsoft.exe
O4 - HKCU\..\Run: [vamsoft] C:\WINDOWS\system32\vamsoft.exe
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\OEM~1.YOU\IMPOST~1\Temp\herss.exe
O4 - Startup: 81942E.lnk = C:\WINDOWS\system32\56443B\81942E.EXE

Trova e cancella i file in rosso: (se non sai seguire il percorso, usa la funzione "Cerca")
C:\WINDOWS\AhnRpta.exe
C:\WINDOWS\system32\56443B\81942E.EXE
C:\WINDOWS\system32\vamsoft.exe

N.B:
Se prima hai eliminato i file che ha trovato Malwarebytes, alcuni file potresti NON trovarli.

Dai una pulita (registro compreso)con CCleaner http://www.aiutaamici.com/software?ID=11223
Nella schermata iniziale di CCleaner, clicca su Opzioni e poi Avanzate, togli il segno di spunta a: Cancella i file in Windows Temp solo se più vecchi di 48 ore. (poi esegui le pulizie)

Riavvia il pc.

Poi:
Start\Esegui\copia e incolla la stringa %temp% clicca su Ok, svuota la cartella temp. (non eliminare la cartella)
Poi:
Provvedi a svuotare del suo contenuto la cartella Prefetch :
clicca su Risorse del Computer
clicca su Disco locale C:
cerca, all’interno delle cartelle che saranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimina tutte le voci conservate al suo interno ( non eliminare la cartella)
SVUOTA IL CESTINO

Scarica Combofix

http://download.bleepingcomputer.com/sUBs/ComboFix.exe


Salvalo sul desktop.

Importante: Disabilita il tuo antivirus e chiudi TUTTI i programmi aperti,(Firewall compreso) e dopo aver scaricato COMBOFIX, chiudi la connessione.

Doppio click su combofix.exe (comparirà una videata.)
Se ti verrà chiesto se vuoi Installare LA CONSOLE DI RIPRISTINO DI EMERGENZA, clicca NO.
E' probabile che ti siano inviati messaggi dall'antivirus, tu ignorali.
Durante l'operazione di scansione è importante non usare il PC (neanche il mouse) e attendere pazientemente la fine delle operazioni.
Al termine, verrà creato un file log sul Desktop, chiamato C:\ComboFix.txt. Postalo qui.

Disinstalla combofix in questo modo: (dopo che avrò visto il log)
Start
Esegui
nella finestra di dialogo, copia ed incolla questo comando: Combofix /u e premi Invio poi cancella le cartelle in "C" di Combofix e (qoobox)

P.S:
Prendi in seria considerazione, di buttare McAfee dalla finestra, e sostituirlo con uno più serio.
Torna in alto
 
bysa0
Inviato: Sunday, October 18, 2009 3:44:54 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
ok! grazie mille!

mi fido ciecamente di ciò che hai detto.
ma sicuro che devo eliminare tutti i file che mi ha trovato malwarebytes?? non sono cose necessarie??? sicuro?
non vorrei eliminare chiavi essenziali...
Torna in alto
 
r16
Inviato: Sunday, October 18, 2009 3:49:06 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Dov'è il problema....
Vedi qualche file legittimo?
Io no.
Torna in alto
 
enigmista63
Inviato: Sunday, October 18, 2009 3:52:17 PM

Rank: AiutAmico

Iscritto dal : 4/28/2007
Posts: 1,976
Whistle Ciao segui attentamente quello che ti consiglia R16 e fai tutto alla lettera,e' uno dei pochi in grado di evitarti di formattare(cosa che io ti avrei detto no avendo le capacita' di R16) il tuo pc NON e' messo male,DI PIU'!!!!!
Saluti e buon lavoro R16.
Torna in alto
 
bysa0
Inviato: Sunday, October 18, 2009 3:55:02 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
OOOOOOOOOOOK perfetto!

vi farò sapere...

grazie! Pray Pray Pray
Torna in alto
 
bysa0
Inviato: Sunday, October 18, 2009 4:02:01 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
ma come faccio a eliminare i file rilevati da log di malwarebytes senza fare un'altra scansione con malwarebytes?

cioè ho fatto la scansione, ho salvato il file in blocco note, e poi come faccio a eliminarli direttamente con malwarebytes?

grasssie
Torna in alto
 
r16
Inviato: Sunday, October 18, 2009 4:06:21 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Se hai chiuso Malwarebytes, senza cliccare "Rimuovi Selezionati" devi rifare la scansione.
Se invece NON hai chiuso Malwarebytes, clicca su "Rimuovi selezionati."
Torna in alto
 
bysa0
Inviato: Sunday, October 18, 2009 7:36:21 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
perfetto!

ho eseguito correttamente tutte le istruzioni che mi hai suggerito, e ora posto il log di combofix:

Spero che non ci siano problemi gravi... Drool


ComboFix 09-10-17.01 - oem 18/10/2009 18.55.03.1.1 - NTFSx86
Eseguito da: c:\documents and settings\oem.YOUR-154EF2BC30\Desktop\ComboFix.exe
* Resident AV is active


ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\1utbfd.bat
C:\3rl3lqbq.bat
C:\9.cmd
C:\9jyhdim8.exe
C:\abk.bat
c:\documents and settings\oem.YOUR-154EF2BC30\Documenti\ZbThumbnail.info
c:\documents and settings\oem.YOUR-154EF2BC30\Preferiti\Videos.url
C:\e.cmd
C:\ev60a2.cmd
C:\h3.bat
C:\mranjm.exe
c:\programmi\Give4Free Plugin
c:\programmi\Give4Free Plugin\~data
c:\programmi\Give4Free Plugin\data
c:\programmi\Give4Free Plugin\uninstall.exe
c:\programmi\QUAD Utilities
c:\programmi\QUAD Utilities\QUAD RegistryCleaner\Vista Scheduler.dll
C:\ps.bat
C:\pv6mxu.bat
c:\recycler\S-1-5-21-139834705-3046566268-3420127741-1003
c:\recycler\S-1-5-21-329068152-507921405-1060284298-1003
C:\se12ydam.exe
C:\ucivd6xi.bat
C:\vb0hsoay.exe
C:\vva0hc0p.cmd
c:\windows\system32\_003126_.tmp.dll
c:\windows\system32\_003127_.tmp.dll
c:\windows\system32\_003128_.tmp.dll
c:\windows\system32\_003129_.tmp.dll
c:\windows\system32\_003136_.tmp.dll
c:\windows\system32\_003137_.tmp.dll
c:\windows\system32\_003138_.tmp.dll
c:\windows\system32\_003139_.tmp.dll
c:\windows\system32\_003141_.tmp.dll
c:\windows\system32\_003142_.tmp.dll
c:\windows\system32\_003145_.tmp.dll
c:\windows\system32\_003146_.tmp.dll
c:\windows\system32\_003148_.tmp.dll
c:\windows\system32\_003149_.tmp.dll
c:\windows\system32\_003150_.tmp.dll
c:\windows\system32\_003152_.tmp.dll
c:\windows\system32\_003155_.tmp.dll
c:\windows\system32\_003156_.tmp.dll
c:\windows\system32\_003160_.tmp.dll
c:\windows\system32\_003161_.tmp.dll
c:\windows\system32\_003163_.tmp.dll
c:\windows\system32\_003166_.tmp.dll
c:\windows\system32\_003168_.tmp.dll
c:\windows\system32\_003169_.tmp.dll
c:\windows\system32\_003170_.tmp.dll
c:\windows\system32\_003171_.tmp.dll
c:\windows\system32\_003172_.tmp.dll
c:\windows\system32\_003175_.tmp.dll
c:\windows\system32\_003176_.tmp.dll
c:\windows\system32\_003177_.tmp.dll
c:\windows\system32\_003178_.tmp.dll
c:\windows\system32\_003179_.tmp.dll
c:\windows\system32\_003184_.tmp.dll
c:\windows\system32\drivers\OCA_LOG.TXT
c:\windows\system32\e8main1.dll
c:\windows\system32\vbsdfe0.dll
c:\windows\system32\vbsdfe1.dll
C:\xmcckw.bat
C:\y.bat

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_KAVSYS
-------\Service_AVPsys


((((((((((((((((((((((((( Files Creati Da 2009-09-18 al 2009-10-18 )))))))))))))))))))))))))))))))))))
.

2009-10-13 17:45 . 2009-10-13 17:45 -------- d-----w- c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\Malwarebytes
2009-10-13 17:44 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-13 17:44 . 2009-10-13 17:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-10-13 17:44 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-13 17:44 . 2009-10-13 17:15 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-10-13 17:08 . 2009-10-13 17:08 -------- d-----w- c:\programmi\CCleaner
2009-10-13 16:32 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-10-13 16:32 . 2008-10-16 12:06 208744 ----a-w- c:\windows\system32\muweb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-13 17:48 . 2009-02-04 10:33 -------- d-----w- c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\BitTorrent
2009-09-06 22:18 . 2009-09-06 22:19 115074 --sh--r- C:\9cquqs.exe
2009-09-06 22:15 . 2009-09-06 22:15 -------- d-----w- c:\programmi\File comuni\Windows Live
2009-09-06 22:14 . 2004-08-30 11:02 77724 ----a-w- c:\windows\system32\perfc010.dat
2009-09-06 22:14 . 2004-08-30 11:02 456852 ----a-w- c:\windows\system32\perfh010.dat
2009-09-06 21:45 . 2009-09-06 21:42 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-09-06 21:38 . 2009-09-06 22:26 -------- d-----w- c:\programmi\File comuni\AVSMedia
2009-09-06 21:38 . 2009-09-06 22:25 -------- d-----w- c:\programmi\AVS4YOU
2009-09-06 21:37 . 2007-10-05 06:32 -------- d-----w- c:\programmi\Windows Live
2009-09-06 21:37 . 2006-10-09 16:29 -------- d-----w- c:\programmi\MSN Messenger
2009-09-06 21:36 . 2007-10-05 06:37 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\BASH OOZE WAVE DEFY
2009-09-06 21:30 . 2009-09-06 21:29 118651 --sh--r- C:\ctu8r.exe
2009-09-06 21:30 . 2009-09-06 21:29 117625 --sh--r- C:\f9o8o.exe
2009-09-06 21:29 . 2009-09-06 21:29 114400 --sh--r- C:\ycvvj.exe
2009-09-06 21:27 . 2007-10-05 06:32 -------- d-----w- c:\programmi\Messenger Plus! Live
2009-09-04 12:33 . 2009-09-04 12:33 117461 --sh--r- C:\sfkn.exe
2009-02-04 10:38 . 2009-02-04 10:38 20480 --sh--w- c:\windows\system32\4EA053\i-773.exe
2009-02-04 10:34 . 2009-02-04 10:34 1408208 --sh--r- c:\windows\system32\56443B\81942E.EXE
.

------- Sigcheck -------

[7] 2008-04-14 . 99B69A5697F622A192B2C1E0D55B48AB . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
[-] 2005-09-01 . 78BE48208966D99840C6F3DC76619C6E . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . B737A3DA2C0A605CE2C7E118C59F38C7 . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll
[-] 2005-09-01 . B737A3DA2C0A605CE2C7E118C59F38C7 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll
[7] 2004-08-19 . AED27A44228C3B2D24406A2755133922 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

[7] 2008-04-14 . 02815B70FC4CA8611A926176F1C39FC2 . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
[-] 2005-08-22 . 1231D4353698E19495DC8A929B8B74EB . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll
[-] 2005-08-22 . 1231D4353698E19495DC8A929B8B74EB . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 1A794D21BC51EEA1F908505E918FCC4E . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[7] 2004-08-19 . 4AD6F202266A25BC0CC1DCE2A3D91563 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

[7] 2008-04-14 . DB0C9517C2374D86A18DBFA12B35B129 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll
[-] 2005-07-26 . CC41F9D29EDD55037A4C26E70C175528 . 397824 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\rpcss.dll
[-] 2005-07-26 . CC41F9D29EDD55037A4C26E70C175528 . 397824 . . [5.1.2600.2726] . . c:\windows\system32\rpcss.dll
[-] 2005-07-26 . F683B6ED87C7DCE1FB51A7D113DE0346 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . 1A2A2A1AB10CF25ABF99CC79909C2DB5 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-04-28 . A5BC1A3B9F42ED4AB65804CEC4A7F69C . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll
[7] 2004-08-19 . 0C015AB735A4624C44CB5696E9208C4C . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll

[7] 2008-04-14 . 60977C9BAE8F86F9075829325303D0C9 . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe
[7] 2004-08-19 . 216F8454A9415DD3E451B169DC3121C4 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

[7] 2008-04-14 . 6B85F1A9DCE45D45BFFAD3222C21F297 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[-] 2005-07-08 . 9D6561AA09637E38E6449C711343CCAD . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . 3A4C429F316C510C3E4C5F2FC7372C26 . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
[-] 2005-07-08 . 3A4C429F316C510C3E4C5F2FC7372C26 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll
[7] 2004-08-19 . 2F8CBA2D2A332EB5D2A7DC084E3B30B3 . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

[7] 2008-04-14 . FA94696C0727BD59E517C674CD6E7C72 . 579584 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2007-03-08 . BAB4F995E526484A235A276E269AAF7F . 579072 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . 9DAA2190A18739B657B58F794ACF2E47 . 578560 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2007-03-08 . 9DAA2190A18739B657B58F794ACF2E47 . 578560 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll
[-] 2005-03-02 . 488019BFE2B0F9F8CD8394276D5B664A . 578048 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . 14B5D6B20467DBA209853D65D1F6A124 . 578048 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2004-08-19 . 08447BDFCE5D1B1956F962602381F5C1 . 578048 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

[7] 2008-04-14 . 70D7F99D95615C3C278367756287DB71 . 1036288 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . 7E2817A623E16F830B660F81C0FD63DA . 1035776 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[-] 2007-06-13 . 7E2817A623E16F830B660F81C0FD63DA . 1035776 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . B4E85805BE6D23DE697F7B3BA7492D0B . 1035776 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-19 . 178D42BD8FC34A9837417A6CE1D6BB7B . 1034752 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

[7] 2008-04-14 . A982208204830A213D7963BF2A215E56 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll
[-] 2006-12-19 . 89F95338182388B65DC381AEAAB62079 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[7] 2004-08-19 . 500E8EF27757B1C463A4A263ED2C95D2 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-30 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-30 118784]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"UpdateManager"="c:\programmi\File comuni\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
"SynTPLpr"="c:\programmi\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 98304]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 536576]
"HP Component Manager"="c:\programmi\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPHmon05"="c:\windows\system32\hphmon05.exe" [2003-05-22 483328]
"Cpqset"="c:\programmi\HPQ\Default Settings\cpqset.exe" [2004-04-30 208958]
"eabconfg.cpl"="c:\programmi\HPQ\Quick Launch Buttons\EabServr.exe" [2004-07-30 286720]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"AutoTBar"="c:\programmi\HP\Digital Imaging\bin\AUTOTBAR.EXE" [2003-09-30 57344]
"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online"="c:\programmi\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"OASClnt"="c:\programmi\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-05-27 413696]
"Malwarebytes Anti-Malware (reboot)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=

S3 SMALUSB;Digital Camera Driver;c:\windows\system32\drivers\smalidt.sys [16/12/1998 18.16.37 9216]
.
Contenuto della cartella 'Scheduled Tasks'

2008-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]

2005-01-14 c:\windows\Tasks\Symantec NetDetect.job
- c:\programmi\Symantec\LiveUpdate\NDETECT.EXE [2003-05-03 13:19]
.
.
------- Scansione supplementare -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\Mozilla\Firefox\Profiles\9hhra3td.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sm/
.
- - - - CHIAVI ORFANE RIMOSSE - - - -

HKLM-Run-HPHUPD05 - c:\programmi\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
HKLM-Run-DXDllRegExe - dxdllreg.exe
AddRemove-Winamp Toolbar for Firefox - c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\Mozilla\Firefox\Profiles\ompoxajk.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-18 18:52
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\programmi\HPQ\Default Settings\cpqset.exe????????????4?8?6?1??@???? ???B???????????????B????????

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'explorer.exe'(3556)
c:\progra~1\mcafee.com\vso\McVSSkt.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmi\Bonjour\mDNSResponder.exe
c:\programmi\McAfee.com\Agent\Mcdetect.exe
c:\progra~1\McAfee.com\VSO\McShield.exe
c:\progra~1\McAfee.com\Agent\McTskshd.exe
c:\programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\wdfmgr.exe
c:\programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
c:\programmi\Canon\CAL\CALMAIN.exe
c:\combofix\CF16148.exe
c:\progra~1\McAfee.com\VSO\McVSEscn.exe
.
**************************************************************************
.
Ora fine scansione: 2009-10-18 19.02.30 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-10-18 17:02

Pre-Run: 8.026.685.440 byte disponibili
Post-Run: 7.867.088.896 byte disponibili

258 --- E O F --- 2009-10-13 17:24
Torna in alto
 
r16
Inviato: Sunday, October 18, 2009 10:58:24 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Apri un file di testo sul Desktop (start\esegui\digita: notepad.exe\ Ok
Ci incolli il codice che vedi qui sotto, e salvi il file di testo obbligatoriamente con il nome CFScript.txt (non incollare la parola Code)


Code:
File::
C:\9cquqs.exe
C:\ctu8r.exe
C:\f9o8o.exe
C:\ycvvj.exe
C:\sfkn.exe
c:\windows\system32\4EA053\i-773.exe
c:\windows\system32\56443B\81942E.EXE
c:\windows\Tasks\Symantec NetDetect.job
c:\programmi\Symantec\LiveUpdate\NDETECT.EXE

Folders::
c:\programmi\Symantec
c:\programmi\Symantec\LiveUpdate



e trascinalo sull'icona di ComboFix.
Attendi la fine dei lavori, senza toccare tastiera, mouse o altro.
Posta il log aggiornato di combofix
Torna in alto
 
bysa0
Inviato: Monday, October 19, 2009 12:38:25 AM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
fatto!
oltre al log di combofix, mi ha salvato un documento che si apre tramite internet e dice così:

- - ComboFix - - -


Inviate i malware a Bleeping Computer per un analisi.


Copia/incolla il percorso qui sotto nel box sopra e clicca su Invia.

File path ---> C:\Qoobox\Quarantine\[4]-Submit_2009-10-18_19.46.01.zip


che faccio?? invio a bleeping computer o no??

rinnovo le mie molteplici gratitudini!

cmq, ecco il log aggiornato di combofix:


ComboFix 09-10-17.01 - oem 18/10/2009 19.46.25.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.39.1040.18.222.95 [GMT 2:00]
Eseguito da: c:\documents and settings\oem.YOUR-154EF2BC30\Desktop\ComboFix.exe
Opzioni usate :: c:\documents and settings\oem.YOUR-154EF2BC30\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
* Resident AV is active


ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!

FILE ::
"C:\9cquqs.exe"
"C:\ctu8r.exe"
"C:\f9o8o.exe"
"c:\programmi\Symantec\LiveUpdate\NDETECT.EXE"
"C:\sfkn.exe"
"c:\windows\system32\4EA053\i-773.exe"
"c:\windows\system32\56443B\81942E.EXE"
"c:\windows\Tasks\Symantec NetDetect.job"
"C:\ycvvj.exe"
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\9cquqs.exe
C:\ctu8r.exe
C:\f9o8o.exe
c:\programmi\Symantec\LiveUpdate\NDETECT.EXE
C:\sfkn.exe
c:\windows\system32\4EA053\i-773.exe
c:\windows\system32\56443B\81942E.EXE
c:\windows\Tasks\Symantec NetDetect.job
C:\ycvvj.exe

.
((((((((((((((((((((((((( Files Creati Da 2009-09-18 al 2009-10-18 )))))))))))))))))))))))))))))))))))
.

2009-10-13 17:45 . 2009-10-13 17:45 -------- d-----w- c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\Malwarebytes
2009-10-13 17:44 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-13 17:44 . 2009-10-13 17:44 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-10-13 17:44 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-13 17:44 . 2009-10-13 17:15 -------- d-----w- c:\programmi\Malwarebytes' Anti-Malware
2009-10-13 17:08 . 2009-10-13 17:08 -------- d-----w- c:\programmi\CCleaner
2009-10-13 16:32 . 2008-10-16 12:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-10-13 16:32 . 2008-10-16 12:06 208744 ----a-w- c:\windows\system32\muweb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-13 17:48 . 2009-02-04 10:33 -------- d-----w- c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\BitTorrent
2009-09-06 22:15 . 2009-09-06 22:15 -------- d-----w- c:\programmi\File comuni\Windows Live
2009-09-06 22:14 . 2004-08-30 11:02 77724 ----a-w- c:\windows\system32\perfc010.dat
2009-09-06 22:14 . 2004-08-30 11:02 456852 ----a-w- c:\windows\system32\perfh010.dat
2009-09-06 21:45 . 2009-09-06 21:42 -------- d---a-w- c:\documents and settings\All Users\Dati applicazioni\TEMP
2009-09-06 21:38 . 2009-09-06 22:26 -------- d-----w- c:\programmi\File comuni\AVSMedia
2009-09-06 21:38 . 2009-09-06 22:25 -------- d-----w- c:\programmi\AVS4YOU
2009-09-06 21:37 . 2007-10-05 06:32 -------- d-----w- c:\programmi\Windows Live
2009-09-06 21:37 . 2006-10-09 16:29 -------- d-----w- c:\programmi\MSN Messenger
2009-09-06 21:36 . 2007-10-05 06:37 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\BASH OOZE WAVE DEFY
2009-09-06 21:27 . 2007-10-05 06:32 -------- d-----w- c:\programmi\Messenger Plus! Live
.

------- Sigcheck -------

[7] 2008-04-14 . 99B69A5697F622A192B2C1E0D55B48AB . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll
[-] 2005-09-01 . 78BE48208966D99840C6F3DC76619C6E . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . B737A3DA2C0A605CE2C7E118C59F38C7 . 19968 . . [5.1.2600.2751] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll
[-] 2005-09-01 . B737A3DA2C0A605CE2C7E118C59F38C7 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll
[7] 2004-08-19 . AED27A44228C3B2D24406A2755133922 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB900725$\linkinfo.dll

[7] 2008-04-14 . 02815B70FC4CA8611A926176F1C39FC2 . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll
[-] 2005-08-22 . 1231D4353698E19495DC8A929B8B74EB . 197632 . . [5.1.2600.2743] . . c:\windows\$NtServicePackUninstall$\netman.dll
[-] 2005-08-22 . 1231D4353698E19495DC8A929B8B74EB . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 1A794D21BC51EEA1F908505E918FCC4E . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[7] 2004-08-19 . 4AD6F202266A25BC0CC1DCE2A3D91563 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB905414$\netman.dll

[7] 2008-04-14 . DB0C9517C2374D86A18DBFA12B35B129 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll
[-] 2005-07-26 . CC41F9D29EDD55037A4C26E70C175528 . 397824 . . [5.1.2600.2726] . . c:\windows\$NtServicePackUninstall$\rpcss.dll
[-] 2005-07-26 . CC41F9D29EDD55037A4C26E70C175528 . 397824 . . [5.1.2600.2726] . . c:\windows\system32\rpcss.dll
[-] 2005-07-26 . F683B6ED87C7DCE1FB51A7D113DE0346 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . 1A2A2A1AB10CF25ABF99CC79909C2DB5 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-04-28 . A5BC1A3B9F42ED4AB65804CEC4A7F69C . 395776 . . [5.1.2600.2665] . . c:\windows\$NtUninstallKB902400$\rpcss.dll
[7] 2004-08-19 . 0C015AB735A4624C44CB5696E9208C4C . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB894391$\rpcss.dll

[7] 2008-04-14 . 60977C9BAE8F86F9075829325303D0C9 . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe
[7] 2004-08-19 . 216F8454A9415DD3E451B169DC3121C4 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB896423$\spoolsv.exe

[7] 2008-04-14 . 6B85F1A9DCE45D45BFFAD3222C21F297 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll
[-] 2005-07-08 . 9D6561AA09637E38E6449C711343CCAD . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . 3A4C429F316C510C3E4C5F2FC7372C26 . 249344 . . [5.1.2600.2716] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll
[-] 2005-07-08 . 3A4C429F316C510C3E4C5F2FC7372C26 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll
[7] 2004-08-19 . 2F8CBA2D2A332EB5D2A7DC084E3B30B3 . 246272 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893756$\tapisrv.dll

[7] 2008-04-14 . FA94696C0727BD59E517C674CD6E7C72 . 579584 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll
[-] 2007-03-08 . BAB4F995E526484A235A276E269AAF7F . 579072 . . [5.1.2600.3099] . . c:\windows\$hf_mig$\KB925902\SP2QFE\user32.dll
[-] 2007-03-08 . 9DAA2190A18739B657B58F794ACF2E47 . 578560 . . [5.1.2600.3099] . . c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2007-03-08 . 9DAA2190A18739B657B58F794ACF2E47 . 578560 . . [5.1.2600.3099] . . c:\windows\system32\user32.dll
[-] 2005-03-02 . 488019BFE2B0F9F8CD8394276D5B664A . 578048 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . 14B5D6B20467DBA209853D65D1F6A124 . 578048 . . [5.1.2600.2622] . . c:\windows\$NtUninstallKB925902$\user32.dll
[7] 2004-08-19 . 08447BDFCE5D1B1956F962602381F5C1 . 578048 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB890859$\user32.dll

[7] 2008-04-14 . 70D7F99D95615C3C278367756287DB71 . 1036288 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[-] 2007-06-13 . 7E2817A623E16F830B660F81C0FD63DA . 1035776 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[-] 2007-06-13 . 7E2817A623E16F830B660F81C0FD63DA . 1035776 . . [6.00.2900.3156] . . c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2007-06-13 . B4E85805BE6D23DE697F7B3BA7492D0B . 1035776 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-19 . 178D42BD8FC34A9837417A6CE1D6BB7B . 1034752 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe

[7] 2008-04-14 . A982208204830A213D7963BF2A215E56 . 135168 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\shsvcs.dll
[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\$NtServicePackUninstall$\shsvcs.dll
[-] 2006-12-19 . FAD73705BED0910E910DE852B0F8AEBC . 134656 . . [6.00.2900.3051] . . c:\windows\system32\shsvcs.dll
[-] 2006-12-19 . 89F95338182388B65DC381AEAAB62079 . 135168 . . [6.00.2900.3051] . . c:\windows\$hf_mig$\KB928255\SP2QFE\shsvcs.dll
[7] 2004-08-19 . 500E8EF27757B1C463A4A263ED2C95D2 . 134656 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB928255$\shsvcs.dll
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-10-30 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-10-30 118784]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"UpdateManager"="c:\programmi\File comuni\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
"SynTPLpr"="c:\programmi\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 98304]
"SynTPEnh"="c:\programmi\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 536576]
"HP Component Manager"="c:\programmi\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"HPHmon05"="c:\windows\system32\hphmon05.exe" [2003-05-22 483328]
"Cpqset"="c:\programmi\HPQ\Default Settings\cpqset.exe" [2004-04-30 208958]
"eabconfg.cpl"="c:\programmi\HPQ\Quick Launch Buttons\EabServr.exe" [2004-07-30 286720]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"AutoTBar"="c:\programmi\HP\Digital Imaging\bin\AUTOTBAR.EXE" [2003-09-30 57344]
"VSOCheckTask"="c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online"="c:\programmi\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"OASClnt"="c:\programmi\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"QuickTime Task"="c:\programmi\QuickTime\qttask.exe" [2008-05-27 413696]
"Malwarebytes Anti-Malware (reboot)"="c:\programmi\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Avvio^Programmi^Esecuzione automatica^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=

S3 SMALUSB;Digital Camera Driver;c:\windows\system32\drivers\smalidt.sys [16/12/1998 18.16.37 9216]
.
Contenuto della cartella 'Scheduled Tasks'

2008-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmi\Apple Software Update\SoftwareUpdate.exe [2008-04-11 15:57]
.
.
------- Scansione supplementare -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\oem.YOUR-154EF2BC30\Dati applicazioni\Mozilla\Firefox\Profiles\9hhra3td.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.sm/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-18 18:55
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\programmi\HPQ\Default Settings\cpqset.exe????????????4?8?6?1??@???? ???B???????????????B????????

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2009-10-18 19.00.30
ComboFix-quarantined-files.txt 2009-10-18 17:00
ComboFix2.txt 2009-10-18 17:39
ComboFix3.txt 2009-10-18 17:02

Pre-Run: 7.833.333.760 byte disponibili
Post-Run: 7.817.830.400 byte disponibili

181 --- E O F --- 2009-10-13 17:24
Torna in alto
 
r16
Inviato: Monday, October 19, 2009 1:53:36 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ok.
Non inviare niente a nessuno.
Disistalla combofix.
Poi:
Start\Esegui\copia e incolla la stringa %temp% clicca su Ok, svuota la cartella temp. (non eliminare la cartella)
Poi:
Provvedi a svuotare del suo contenuto la cartella Prefetch :
clicca su Risorse del Computer
clicca su Disco locale C:
cerca, all’interno delle cartelle che saranno visualizzate la cartella Windows, aprila ed, al suo interno, cerca la cartella Prefetch, la apri ed elimina tutte le voci conservate al suo interno ( non eliminare la cartella)
SVUOTA IL CESTINO
Poi:
Lancia Hijackthis e pulisci gli ADS in questo modo:
clicca sulla voce Open the misc tool section
clicca su Open ads spy
togli la spunta alla voce Quick scan (windows base folder only)
clicca su Scan.
Aspetta pazientemente la fine della scansione.
se venissero rilevati ADS, spunta tutte (senza paura) le caselline e clicca su Remove selected

Fai uno ScanDisk approfondito, e una deframmentazione del HD.
Se non riscontri problemi, Riattiva il ripristino configurazione di sistema.
Torna in alto
 
bysa0
Inviato: Monday, October 19, 2009 2:21:45 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
Perfetto!

solo che eliminando combofix non ho trovato alcuna cartella col nome: qoobox. boh... l'avrò già eliminata, o non è mai esistita... Sick

ora faccio lo scandisk.
e poi la deframmentazione.
vi terrò aggiornati...

grazie!!!
Torna in alto
 
r16
Inviato: Monday, October 19, 2009 3:13:08 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
E' importante che venga trovata (se c'è) e eliminata la cartella qoobox.
Con la funzione "Cerca" digita qoobox se la trovi, la elimini.
Poi sempre con la funzione Cerca, digita Combofix ed elimina tutto quello che trova.
Torna in alto
 
bysa0
Inviato: Monday, October 19, 2009 5:13:26 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
niente da fare! nessuna cartella qoobox trovata... vabbè...

Niente, io aspetto un paio di gg per vedere se tutto va bene e se non riscontro problemi, riattivo il ripristino configurazione di sistema! ok?
Torna in alto
 
r16
Inviato: Monday, October 19, 2009 5:34:52 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Posta un log di HJT per un'ultima verifica.
Torna in alto
 
bysa0
Inviato: Monday, October 19, 2009 5:49:13 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
voilà!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.10.10, on 18/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
c:\programmi\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
C:\Programmi\Telecom Italia\WanMiniport1st\WanMiniport1st_srv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe
C:\Programmi\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\McAfee.com\VSO\mcvsshld.exe
C:\Programmi\McAfee.com\VSO\oasclnt.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Vista HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Programmi\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [AutoTBar] C:\Programmi\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Programmi\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Programmi\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programmi\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programmi\Canon\CAL\CALMAIN.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programmi\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: Network WanMiniport First Position - Unknown owner - C:\Programmi\Telecom Italia\WanMiniport1st\srvany.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Programmi\File comuni\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 7467 bytes
Torna in alto
 
r16
Inviato: Monday, October 19, 2009 6:01:51 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Vai in Installazione Applicazioni e rimuovi TUTTE le versioni Java che trovi.
Fai una pulizia con CCleaner, e riavvia il pc.
Installa questa versione:
http://www.aiutamici.com/software?ID=11134

Se in fase di installazione, ti venisse rchiesta l'installazione di qualche Toolbar, non la installare.
Sei a posto.
Torna in alto
 
bysa0
Inviato: Monday, October 19, 2009 6:12:37 PM

Rank: Member

Iscritto dal : 10/17/2009
Posts: 26
Bene!
Cerco di eliminare i 4 proggrammini java che ho installato sul pc, ma mi si apre una finestra con scritto:

"Impossibile accedere al servizio Windows Installer. Ciò può verificarsi se si esegue Windows in modalità provvisoria, o se Windows Installer non è installato correttamente."

windows nn è in modalità provvisoria, quindi non è installato correttamente Windows Installer.... Liar
uffa.. posso fare qualcosa?
Torna in alto
 
Utenti presenti in questo topic
Guest

2 pages: [1] 2

Aiutamici Forum » FORUM - Istruzioni e Guide » Sicurezza VIRUS » molteplici problemi con windows xp!


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.