Ciao a tutti!
Da tre giorni il mio AVAST! segnala il trojan Bankfraud-CPU su tutte le pagine di Posteitaliane in cui è presente la finestra di Log-in.
Vorrei capire se è un falso positivo e soprattutto se il mio computer è infetto. Per sicurezza sto evitando di loggarmi ma tra un pò non potrò più evitare di farlo.
Ecco il resoconto di Hijackthis:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:03:38, on 21/12/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16750)
Boot mode: Normal

Running processes:
C:\windows\system32\taskhost.exe
C:\windows\system32\taskeng.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\System32\rundll32.exe
C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\windows\system32\igfxext.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\system32\wuauclt.exe
C:\PROGRA~1\samsung\SAMSUN~2\SUPNOT~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\system32\Macromed\Flash\FlashUtil32_11_9_900_170_ActiveX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\windows\System32\MsSpellCheckingFacility.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Persistence] C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [20131121] C:\Program Files\AVAST Software\Avast\setup\emupdate\2196b2a7-ba60-4c26-94fd-a71a8ffabc97.exe /check
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O17 - HKLM\System\CCS\Services\Tcpip\..\{95DE52F9-5E06-47C9-BE22-4B7FE2603F77}: NameServer = 8.8.8.8,8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5E9509A-5297-43D8-87EB-65E3B44F2BBE}: NameServer = 8.8.8.8,8.8.4.4
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

--
End of file - 6027 bytes

se il tuo avast non delira dovresti aver imbarcato questo

prova a fare una scansione con combofix

scaricalo da qui e mettilo sul desktop
non installare la recovery console quando te lo chiede
Lascia lavorare il programma senza interferire
Allega il rapporto C:\ComboFix.txt nella tua risposta.

un'infezione cosi' di certo hijackthis non la rileva

puoi anche usare malwarebytes anche se combofix e' piu' ''incisivo'' su certe infezioni....

Questo è il percorso del virus, se può essere utile:

Users/lukeluke/AppData/Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\72V2L418\login-home[1].htm

Ecco il Report di COMBOFIX:
ComboFix 13-12-20.01 - peaceman 21/12/2013 19:06:03.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.39.1040.18.2009.1191 [GMT 1:00]
Eseguito da: c:\users\peaceman\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Creati Da 2013-11-21 al 2013-12-21 )))))))))))))))))))))))))))))))))))
.
.
2013-12-21 18:14 . 2013-12-21 18:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-12-21 18:07 . 2013-12-21 18:07 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0EE3038B-54FA-4213-851F-C8D2FE4E344F}\offreg.dll
2013-12-20 10:17 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0EE3038B-54FA-4213-851F-C8D2FE4E344F}\mpengine.dll
2013-12-11 17:20 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2013-12-11 17:20 . 2013-05-10 03:48 164864 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 17:15 . 2013-10-30 02:19 301568 ----a-w- c:\windows\system32\msieftp.dll
2013-12-11 17:15 . 2013-11-12 02:07 2048 ----a-w- c:\windows\system32\tzres.dll
2013-12-11 17:15 . 2013-11-23 18:26 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-12-11 17:15 . 2013-10-19 01:36 159232 ----a-w- c:\windows\system32\imagehlp.dll
2013-12-11 17:15 . 2013-10-12 02:04 121856 ----a-w- c:\windows\system32\wshom.ocx
2013-12-11 17:15 . 2013-10-12 02:03 163840 ----a-w- c:\windows\system32\scrrun.dll
2013-12-11 17:15 . 2013-10-12 01:15 141824 ----a-w- c:\windows\system32\wscript.exe
2013-12-11 17:15 . 2013-10-12 01:15 126976 ----a-w- c:\windows\system32\cscript.exe
2013-12-11 17:15 . 2013-10-04 01:49 81408 ----a-w- c:\windows\system32\drivers\drmk.sys
2013-12-11 17:15 . 2013-10-04 01:17 177152 ----a-w- c:\windows\system32\drivers\portcls.sys
2013-12-11 17:15 . 2013-10-30 01:27 2349056 ----a-w- c:\windows\system32\win32k.sys
2013-12-04 09:07 . 2013-12-04 09:07 -------- d-----w- c:\users\peaceman\AppData\Roaming\AVAST Software
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-11 00:58 . 2012-11-23 09:21 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-12-11 00:58 . 2011-06-22 11:07 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-04 09:05 . 2013-03-10 23:04 178304 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-04 09:05 . 2013-03-10 23:04 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-12-04 09:05 . 2011-06-21 12:57 403440 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-12-04 09:05 . 2011-06-21 12:57 57672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-12-04 09:05 . 2012-02-26 10:31 79720 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-12-04 09:05 . 2011-06-21 12:57 35656 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-12-04 09:05 . 2011-06-21 12:57 774392 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-12-04 09:05 . 2011-06-21 12:57 70384 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-12-04 09:05 . 2011-06-21 12:56 43152 ----a-w- c:\windows\avastSS.scr
2013-12-04 09:05 . 2011-06-21 12:56 269216 ----a-w- c:\windows\system32\aswBoot.exe
2013-11-26 11:25 . 2011-06-24 12:58 230048 ------w- c:\windows\system32\MpSigStub.exe
2013-10-12 02:03 . 2013-11-13 11:33 656896 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 11:33 679424 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:01 . 2013-11-13 11:33 216576 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-05 19:57 . 2013-11-13 11:34 1168384 ----a-w- c:\windows\system32\crypt32.dll
2013-10-04 01:58 . 2013-11-13 11:34 152576 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2013-10-04 01:56 . 2013-11-13 11:34 168960 ----a-w- c:\windows\system32\credui.dll
2013-10-04 01:56 . 2013-11-13 11:34 1796096 ----a-w- c:\windows\system32\authui.dll
2013-10-03 01:58 . 2013-11-13 11:34 305152 ----a-w- c:\windows\system32\gdi32.dll
2013-09-25 02:01 . 2013-11-13 11:34 136640 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-09-25 02:01 . 2013-11-13 11:34 67520 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2013-09-25 01:57 . 2013-11-13 11:34 99840 ----a-w- c:\windows\system32\sspicli.dll
2013-09-25 01:57 . 2013-11-13 11:34 22016 ----a-w- c:\windows\system32\secur32.dll
2013-09-25 01:57 . 2013-11-13 11:34 247808 ----a-w- c:\windows\system32\schannel.dll
2013-09-25 01:56 . 2013-11-13 11:34 220160 ----a-w- c:\windows\system32\ncrypt.dll
2013-09-25 01:56 . 2013-11-13 11:34 1038848 ----a-w- c:\windows\system32\lsasrv.dll
2013-09-25 00:49 . 2013-11-13 11:34 22016 ----a-w- c:\windows\system32\lsass.exe
2013-09-25 00:49 . 2013-11-13 11:34 15872 ----a-w- c:\windows\system32\sspisrv.dll
2011-07-08 07:44 . 2011-07-12 19:01 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-12-04 09:05 321752 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-14 151064]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-12-04 3568312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Facebook Update]
2012-07-11 23:17 138096 ----atw- c:\users\peaceman\AppData\Local\Facebook\Update\FacebookUpdate.exe
.
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WatAdminSvc;Servizio Windows Activation Technologies;c:\windows\system32\Wat\WatAdminSvc.exe [2011-06-23 1343400]
R4 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312]
R4 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-03-01 161384]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-12-04 774392]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2013-12-04 403440]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2013-12-04 35656]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-12-04 70384]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-07-10 122880]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
Contenuto della cartella 'Scheduled Tasks'
.
2013-12-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-23 00:58]
.
2013-12-20 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000Core.job
- c:\users\peaceman\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-21 23:17]
.
2013-12-21 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1871111397-3539990770-1974983793-1000UA.job
- c:\users\peaceman\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-21 23:17]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{95DE52F9-5E06-47C9-BE22-4B7FE2603F77}: NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{B5E9509A-5297-43D8-87EB-65E3B44F2BBE}: NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{B5E9509A-5297-43D8-87EB-65E3B44F2BBE}\D61627769616E623: NameServer = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:\users\peaceman\AppData\Roaming\Mozilla\Firefox\Profiles\je9a7odl.default\
.
- - - - CHIAVI ORFANE RIMOSSE - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------
.
[HKEY_USERS\S-1-5-21-1871111397-3539990770-1974983793-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-1871111397-3539990770-1974983793-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Ora fine scansione: 2013-12-21 19:15:42
ComboFix-quarantined-files.txt 2013-12-21 18:15
.
Pre-Run: 114.339.647.488 byte disponibili
Post-Run: 117.898.137.600 byte disponibili
.
- - End Of File - - 65F77BDE6B099F80986BFC3597705949
2E5DEBB2116B3417023E0D6562D7ED07

Ciao. Ho provato ad usare Firefox, ed in effetti Avast stavolta non mi segnala nulla.
E' un segnale positivo o negativo?
Avast l'ho scaricat dal sito ufficiale 3 anni fa.
Prima di procedere con la procedura da te consigliata, volevo sapere se il Report di Combofix è pulito. Grazie ancora

Il trojan mi viene segnalato da Avast usando Explorer 10, mentre non viene segnalato se uso Firefox.
Credi possa essere magari un aggiornamento del Browser ad aver causato tutto ciò?

Ok. Ma in che senso rimuovere Explorer? Disinstallarlo o non usarlo?