Aiutamici Forum
Benvenuto Ospite Cerca | Topic Attivi | Utenti | | Log In | Registra

per cortesia un controllo LOG FILE: è tutto a posto? Opzioni
eliogabalo1959
Inviato: Sunday, January 18, 2009 6:48:13 PM
Rank: Newbie

Iscritto dal : 12/29/2008
Posts: 0
Ciao a tutti e grazie comunque per quello che potrete fare.
Sono un neo-iscritto (29.12) ed ho dovuto reinstallare tutto causa un virus.
L'antivirus NOD 32 che mi è stato installato presenta una serie di righe in carattere azzurro che a me sembrano dei problemi, ma non me ne intendo. Alla fine però dice che non c'è nessun virus, e siccome non mi fido ho postato quanto sotto. Se ho sbagliato qualcosa.....
Vi pregherei, gentilmente, di aiutarmi se qualcosa non va.
Grazie a chiunque risponderà.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18.35.06, on 18/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Eset\nod32kui.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programmi\Lexmark 5000 Series\lxdmmon.exe
C:\Programmi\Lexmark 5000 Series\lxdmamon.exe
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programmi\AskBarDis\bar\bin\AskService.exe
C:\Programmi\AskBarDis\bar\bin\ASKUpgrade.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxdmcoms.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmi\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programmi\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programmi\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programmi\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [lxdmmon.exe] "C:\Programmi\Lexmark 5000 Series\lxdmmon.exe"
O4 - HKLM\..\Run: [lxdmamon] "C:\Programmi\Lexmark 5000 Series\lxdmamon.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?AuthParam=1230906579_b26e8f8a8c4b86e3277a0b35e6672d03&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab&File=jinstall-6u11-windows-i586-jc.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: ASKService - Unknown owner - C:\Programmi\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Programmi\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: lxdmCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdmserv.exe
O23 - Service: lxdm_device - - C:\WINDOWS\system32\lxdmcoms.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programmi\File comuni\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6838 bytes
Sponsor
Inviato: Sunday, January 18, 2009 6:48:13 PM

 
r16
Inviato: Sunday, January 18, 2009 10:23:11 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao.
Scarica ed installa MalwareBytes:
clicca qui per il download : http://www.malwarebytes.org/
Prima di fare la scansione AGGIORNALO.
Esegui una scansione completa del sistema e, una volta terminata la scansione,assicurati che tutti i files evidenziati, siano selezionati, e clicca Rimuovi Selezionati
Posta il log.
*********************************************************************************************************
Importante: Disabilita il tuo antivirus e chiudi TUTTI i programmi aperti,e dopo aver scaricato COMBOFIX, chiudi la connessione.

Scarica Combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Salvalo sul desktop.
Doppio click su combofix.exe (comparirà una videata.)
Digita 1 premi Invio e segui le indicazioni.
Al termine, verrà creato un file log chiamato C:\ComboFix.txt. Postalo qui.
Durante l'operazione di scansione è importante non usare il PC (neanche il mouse) e attendere pazientemente la fine delle operazioni.

Disinstalla combofix in questo modo: (dopo che avrò visto il log)
Start
Esegui
nella finestra di dialogo, digita (oppure, copia ed incolla) questo comando: Combofix /u e premi invio poi cancella le cartelle in "C" di combofix (qoobox)
Riferisci se ci sono ancora problemi.

eliogabalo1959
Inviato: Monday, January 19, 2009 5:35:56 PM
Rank: Newbie

Iscritto dal : 12/29/2008
Posts: 0
Ciao anche a te e grazie per l'aiuto, sei molto gentile.
Presupposto: riguardo a Combo, ho disabilitato Amon di NOD 32, ma quando l'ho scaricato non l'ho salvato sul desktop,(non ricordavo + la procedura: 1 ed invio ed avevo paura di toccare qualcosa) ma devo aver schiacciato qualcosa perchè è partito da solo. Mi ha chiesto solo se volevo scaricare la console di emergenza, ecc. che ho risposto no
Scusami, se ho sbagliato. Se vuoi lo rifaccio, ma per favore aiutami.


Malwarebytes' Anti-Malware 1.33
Versione del database: 1666
Windows 5.1.2600 Service Pack 3

19/01/2009 16.29.24
mbam-log-2009-01-19 (16-29-24).txt

Tipo di scansione: Scansione completa (C:\|D:\|E:\|F:\|G:\|)
Elementi scansionati: 197380
Tempo trascorso: 1 hour(s), 42 minute(s), 10 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 0
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 0

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
(Nessun elemento malevolo rilevato)

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
(Nessun elemento malevolo rilevato)



ComboFix 09-01-18.06 - Eugenio 2009-01-19 17.12.37.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.1023.377 [GMT 1:00]
Eseguito da: c:\programmi\ComboFix.exe
AV: Sistema Antivirus NOD32 2.70 *On-access scanning disabled* (Updated)
* Creato nuovo punto di ripristino

ATTENZIONE - QUESTO PC NON HA LA CONSOLE DI RIPRISTINO DI EMERGENZA INSTALLATA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system\msvbvm60.dll

.
((((((((((((((((((((((((( Files Creati Da 2008-12-19 al 2009-01-19 )))))))))))))))))))))))))))))))))))
.

2009-01-19 17:10 . 2009-01-19 17:10 3,043,123 -ra------ c:\programmi\ComboFix.exe
2009-01-19 14:42 . 2009-01-19 14:42 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2009-01-19 14:42 . 2009-01-19 14:42 <DIR> d-------- c:\documents and settings\Eugenio\Dati applicazioni\Malwarebytes
2009-01-19 14:42 . 2009-01-19 14:42 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2009-01-19 14:42 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-19 14:42 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-19 14:40 . 2009-01-19 14:41 2,737,808 --a------ c:\programmi\mbam-setup.exe
2009-01-15 16:59 . 2009-01-15 17:05 54 --a------ C:\cmlink4ita.l2t
2009-01-15 11:24 . 2009-01-18 18:03 <DIR> d-------- c:\programmi\Trend Micro
2009-01-13 23:40 . 2009-01-13 23:40 1,374 --a------ c:\windows\imsins.BAK
2009-01-11 17:58 . 2009-01-11 17:58 56 --a------ C:\cmlink2ita.l2t
2009-01-11 17:52 . 2009-01-11 17:52 54 --a------ C:\cmlink6ita.l2t
2009-01-11 17:43 . 2009-01-11 17:43 54 --a------ C:\cmlink5ita.l2t
2009-01-11 17:39 . 2009-01-11 17:39 <DIR> d-------- c:\programmi\CM-VOL1
2009-01-11 17:39 . 2009-01-11 17:39 286,720 --------- c:\windows\Setup1.exe
2009-01-11 17:39 . 2009-01-11 17:39 73,216 --a------ c:\windows\ST6UNST.EXE
2009-01-11 17:39 . 2009-01-11 17:41 34 --a------ C:\cmlink.l2t
2009-01-11 11:27 . 2009-01-11 11:27 290,816 --a------ c:\windows\system32\ButtonsControl.ocx
2009-01-10 22:50 . 2009-01-10 22:50 <DIR> d-------- c:\programmi\cm-nius
2009-01-10 22:50 . 2009-01-10 22:50 <DIR> d-------- c:\programmi\cm-engines
2009-01-10 22:50 . 2009-01-15 16:56 <DIR> d-------- c:\programmi\ChessMultimedia
2009-01-08 16:48 . 2009-01-18 18:04 <DIR> d-------- c:\programmi\CCleaner
2009-01-08 11:56 . 2003-03-19 07:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
2009-01-08 11:56 . 2003-06-05 12:57 499,712 --a------ c:\windows\system32\msvcp71.dll
2009-01-08 11:56 . 2003-02-21 14:42 348,160 --a------ c:\windows\system32\msvcr71.dll
2009-01-06 16:33 . 2009-01-18 19:17 <DIR> d-------- c:\documents and settings\Eugenio\Dati applicazioni\ChessBase
2009-01-06 16:33 . 2009-01-18 18:53 247 --a------ c:\windows\ChssBase.ini
2009-01-06 16:30 . 2009-01-08 11:58 <DIR> d-------- c:\programmi\ChessBase
2009-01-04 11:07 . 2009-01-04 11:07 <DIR> d-------- c:\programmi\AskBarDis
2009-01-03 18:02 . 2008-10-16 21:04 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2009-01-03 18:02 . 2007-04-17 10:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2009-01-03 18:02 . 2007-03-08 06:11 1,032,192 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2009-01-03 18:02 . 2008-10-16 21:04 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2009-01-03 18:02 . 2008-10-16 21:04 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2009-01-03 18:02 . 2008-10-16 21:04 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2009-01-03 18:02 . 2008-10-16 21:04 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2009-01-03 18:02 . 2008-10-16 21:04 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2009-01-03 18:02 . 2008-10-16 14:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2009-01-03 11:35 . 2004-08-19 15:39 221,184 --a------ c:\windows\system32\wmpns.dll
2009-01-03 11:27 . 2009-01-03 11:27 <DIR> d-------- c:\windows\system32\it
2009-01-03 11:27 . 2009-01-03 11:27 <DIR> d-------- c:\windows\system32\bits
2009-01-03 11:27 . 2009-01-03 11:27 <DIR> d-------- c:\windows\l2schemas
2009-01-03 11:24 . 2009-01-03 11:24 <DIR> d-------- c:\windows\ServicePackFiles
2009-01-02 15:38 . 2009-01-04 11:07 <DIR> d-------- c:\programmi\Vuze
2009-01-02 15:38 . 2009-01-18 18:19 <DIR> d-------- c:\documents and settings\Eugenio\Dati applicazioni\Azureus
2009-01-02 15:38 . 2009-01-02 15:38 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Azureus
2009-01-02 15:35 . 2009-01-14 16:22 69 --a------ c:\windows\NeroDigital.ini
2009-01-02 15:29 . 2009-01-02 15:29 <DIR> d-------- c:\windows\Sun
2009-01-02 15:29 . 2009-01-02 15:29 <DIR> d-------- c:\programmi\Java
2009-01-02 15:29 . 2009-01-02 15:29 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-02 15:29 . 2009-01-02 15:29 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-02 15:21 . 2009-01-02 15:21 <DIR> d-------- c:\documents and settings\Eugenio\Dati applicazioni\Lexmark Productivity Studio
2009-01-02 15:20 . 2009-01-02 15:22 <DIR> d-------- c:\documents and settings\All Users\Lx_cats
2009-01-02 15:19 . 2009-01-02 15:19 <DIR> d-------- C:\logs
2009-01-02 15:19 . 2007-05-03 14:50 348,160 --a------ c:\windows\system32\lxdmcoin.dll
2009-01-02 15:19 . 2006-08-01 00:53 40,960 --a------ c:\windows\system32\lxdmvs.dll
2009-01-02 15:18 . 2006-11-09 02:11 1,645,320 --a------ c:\windows\system32\gdiplus.dll
2009-01-02 15:18 . 2007-05-22 17:59 692,224 --a------ c:\windows\system32\lxdmdrs.dll
2009-01-02 15:18 . 2001-08-30 23:08 87,040 --a------ c:\windows\system32\wiafbdrv.dll
2009-01-02 15:18 . 2001-08-30 23:08 87,040 --a--c--- c:\windows\system32\dllcache\wiafbdrv.dll
2009-01-02 15:18 . 2007-04-17 09:17 69,632 --a------ c:\windows\system32\lxdmcnv4.dll
2009-01-02 15:18 . 2007-05-22 09:10 65,536 --a------ c:\windows\system32\lxdmcaps.dll
2009-01-02 15:18 . 2008-04-13 19:45 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2009-01-02 15:01 . 2009-01-02 15:01 <DIR> d-------- c:\programmi\Windows Media Connect 2
2009-01-02 15:01 . 2009-01-02 15:18 <DIR> d-------- c:\programmi\Lexmark 5000 Series
2009-01-02 14:52 . 2009-01-02 14:52 <DIR> d-------- C:\lexmark
2009-01-02 14:43 . 2009-01-03 18:57 <DIR> d-------- c:\windows\system32\it-it
2009-01-02 14:11 . 2009-01-02 14:11 <DIR> d-------- c:\programmi\Google
2009-01-02 14:10 . 2009-01-02 14:10 <DIR> d-------- c:\programmi\File comuni\LightScribe
2009-01-02 14:08 . 2009-01-02 14:08 <DIR> d-------- c:\documents and settings\Eugenio\Dati applicazioni\Ahead
2009-01-02 14:06 . 2009-01-19 17:17 81,496 --a------ c:\windows\system32\nvapps.xml
2009-01-02 14:05 . 2009-01-02 14:16 <DIR> d-------- c:\windows\nview
2009-01-02 14:05 . 2006-10-31 14:35 208,896 --a------ c:\windows\system32\nvudisp.exe
2009-01-02 14:05 . 2006-10-31 14:35 17,056 --a------ c:\windows\system32\nvdisp.nvu
2009-01-02 14:04 . 2006-10-31 16:44 208,896 --a------ c:\windows\system32\NVUNINST.EXE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-19 15:54 --------- d-----w c:\programmi\ESET
2009-01-15 15:58 49,152 ----a-w c:\windows\cm_Sugg.dll
2009-01-15 15:58 40,960 ----a-w c:\windows\cm_TES.dll
2009-01-15 15:58 32,768 ----a-w c:\windows\cm_CMD.dll
2009-01-15 15:57 598,288 ----a-w c:\windows\OLEAUT32.DLL
2009-01-15 15:57 22,288 ----a-w c:\windows\COMCAT.DLL
2009-01-15 15:57 217,343 ----a-w c:\windows\Fonts\setup\setup.exe
2009-01-15 15:57 174,352 ----a-w c:\windows\RICHED32.DLL
2009-01-15 15:57 164,112 ----a-w c:\windows\OLEPRO32.DLL
2009-01-15 15:57 147,728 ----a-w c:\windows\ASYCFILT.DLL
2009-01-15 15:57 1,388,544 ----a-w c:\windows\Msvbvm60.dll
2009-01-11 16:50 86,016 ----a-w c:\windows\cm_LE.dll
2009-01-11 16:50 258,048 ----a-w c:\windows\cm_LMV.dll
2009-01-08 10:55 --------- d--h--w c:\programmi\InstallShield Installation Information
2009-01-02 15:32 --------- d-----w c:\documents and settings\Eugenio\Dati applicazioni\Skype
2009-01-02 13:07 --------- d-----w c:\programmi\NOS
2009-01-02 13:07 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\NOS
2009-01-02 13:05 --------- d-----w c:\programmi\File comuni\Ahead
2009-01-02 12:58 --------- d-----w c:\programmi\Nero
2009-01-02 12:58 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Nero
2009-01-02 12:52 --------- d-----w c:\programmi\File comuni\Adobe
2009-01-02 12:46 --------- d-----w c:\programmi\ASUS
2009-01-02 12:44 512,096 ----a-w c:\windows\system32\drivers\amon.sys
2009-01-02 12:44 15,424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2009-01-02 12:43 --------- d-----w c:\programmi\Skype
2009-01-02 12:43 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Skype
2009-01-02 12:42 --------- d-----w c:\programmi\File comuni\Skype
2009-01-02 12:32 23,600 ----a-w c:\windows\system32\drivers\TVICHW32.SYS
2009-01-02 12:26 --------- d-----w c:\documents and settings\Eugenio\Dati applicazioni\ACD Systems
2009-01-02 12:24 10,368 ----a-w c:\windows\system32\drivers\pfc.sys
2009-01-02 12:24 --------- d-----w c:\programmi\File comuni\ACD Systems
2009-01-02 12:24 --------- d-----w c:\programmi\ACD Systems
2009-01-02 12:24 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\ACD Systems
2009-01-02 12:22 --------- d-----w c:\programmi\SystemRequirementsLab
2009-01-02 12:17 --------- d-----w c:\programmi\Attansic
2009-01-02 12:13 --------- d-----w c:\programmi\Realtek
2009-01-02 12:13 --------- d-----w c:\programmi\File comuni\InstallShield
2009-01-02 12:09 --------- d-----w c:\programmi\VIA
2009-01-02 12:03 --------- d-----w c:\programmi\Microsoft Works
2009-01-02 11:54 --------- d-----w c:\programmi\Microsoft.NET
2009-01-02 11:49 --------- d-----w c:\programmi\CyberLink
2009-01-02 11:49 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\CyberLink
2009-01-02 11:34 --------- d-----w c:\programmi\microsoft frontpage
2009-01-02 11:32 --------- d-----w c:\programmi\Servizi in linea
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-09 18:40 333192 --a------ c:\programmi\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\programmi\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\programmi\AskBarDis\bar\bin\askBar.dll" [2008-12-09 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2009-01-02 949376]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-31 86016]
"Google Desktop Search"="c:\programmi\Google\Google Desktop Search\GoogleDesktop.exe" [2009-01-02 30192]
"lxdmmon.exe"="c:\programmi\Lexmark 5000 Series\lxdmmon.exe" [2007-12-14 455336]
"lxdmamon"="c:\programmi\Lexmark 5000 Series\lxdmamon.exe" [2007-12-14 25256]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-01-02 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-06 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-17 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2006-10-31 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-12-23 18:05 143360 c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdmcoms.exe"=
"c:\\Programmi\\Lexmark 5000 Series\\lxdmamon.exe"=
"c:\\Programmi\\Lexmark 5000 Series\\frun.exe"=
"c:\\Programmi\\Lexmark 5000 Series\\lxdmmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdmpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdmtime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdmjswx.exe"=
"c:\\Programmi\\ChessBase\\ChessProgram9\\ChessProgram9.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6002:TCP"= 6002:TCP:Fritz9

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2009-01-02 11264]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-01-02 15424]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [2009-01-02 35840]
R4 ASKService;ASKService;c:\programmi\AskBarDis\bar\bin\AskService.exe [2009-01-04 464264]
R4 ASKUpgrade;ASKUpgrade;c:\programmi\AskBarDis\bar\bin\ASKUpgrade.exe [2009-01-04 234888]
R4 lxdm_device;lxdm_device;c:\windows\system32\lxdmcoms.exe -service --> c:\windows\system32\lxdmcoms.exe -service [?]
S0 mv614x;mv614x;c:\windows\system32\drivers\mv614x.sys [2009-01-02 63232]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\programmi\Google\Google Desktop Search\GoogleDesktop.exe [2009-01-02 30192]
S4 lxdmCATSCustConnectService;lxdmCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdmserv.exe [2009-01-02 98984]
.
.
------- Scansione supplementare -------
.
uStart Page = hxxp://www.google.it/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\imon.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-19 17:17:17
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|ÿÿÿÿ"•€|þ»Ñw*]
"0140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'lsass.exe'(760)
c:\windows\system32\imon.dll
c:\programmi\Eset\pr_imon.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\File comuni\LightScribe\LSSrvc.exe
c:\windows\system32\lxdmcoms.exe
c:\programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\programmi\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-19 17:20:01 - Il pc è stato riavviato
ComboFix-quarantined-files.txt 2009-01-19 16:19:58

Pre-Run: 74.179.727.360 byte disponibili
Post-Run: 74,231,177,216 byte disponibili

246 --- E O F --- 2009-01-13 22:40:19


r16
Inviato: Monday, January 19, 2009 6:37:31 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao .
No , non hai sbagliato a non scaricare la console di emergenza.
Vorrei sapere se hai scaricato tu questo programma: AskBarDis.
Comunque anche se lo hai scaricato tu, io lo eliminerei, poi vedi tu.
Avvia in modalità provvisoria http://guide.aiutamici.com/guide?C1=7&C2=68&ID=80122

Avvia hijackthis, metti la spunta alle voci che andrò ad elencarti e con tutte le applicazioni chiuse e disconnesso da Internet,premi su fix checked:
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programmi\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programmi\AskBarDis\bar\bin\askBar.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.ca b?AuthParam=1230906579_b26e8f8a8c4b86e3277a0b35e6672d03&GroupName=JSC&BHost=java dl.sun.com&FilePath=/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab&F ile=jinstall-6u11-windows-i586-jc.cab
O23 - Service: ASKService - Unknown owner - C:\Programmi\AskBarDis\bar\bin\AskService.exe
O23 - Service: ASKUpgrade - Unknown owner - C:\Programmi\AskBarDis\bar\bin\ASKUpgrade.exe

Trova e cancella i file in rosso:
C:\Programmi\AskBarDis\bar\bin\AskService.exe ( è una cartella)
C:\Programmi\AskBarDis\bar\bin\ASKUpgrade.exe (è un'altra cartella)
Dai una pulita (registro compreso)con CCleaner http://www.aiutaamici.com/software?ID=11223
Riavvia il pc.
*********************************************************************************************************
Fai una scansione on-line con con kaspersky
http://www.kaspersky.com/virusscanner

Clicca su Kaspersky Online Scanner
Clicca su Accept
Si avvierà un Update
Vai nella colonna di sinistra dove c'è scritto Scan e scegli my computer
Finita la scansione in fondo a destra, clicca sulla la voce View Scan Report, e poi clicca su "Save Report As" e salvalo sul desktop, per poi postarlo qui.
Dimmi se il pc ha ancora problemi.
eliogabalo1959
Inviato: Thursday, January 29, 2009 6:12:49 PM
Rank: Newbie

Iscritto dal : 12/29/2008
Posts: 0
Ciao r16 e grazie ancora. Scusa il ritardo, ma ho dei problemi. Puoi ancora aiutarmi?
Ho fatto quanto mi avevi chiesto, almeno spero. Se ho sbagliato qualcosa non arrabbiarti. Sono inesperto...
Ho cancellato AskBarDis, avviato hijack this, fix checked e spuntato i numeri in rosso.
Ho cancellato i file in rosso, ma ho trovato solo la cartella Askservice e non upgrade. Comunque ho dato una pulita con CCleaner.
Ho fatto la scansione con Kaspersky che ti allego.
Mi pare non ci siano virus, ma facendo girare l'antivirus, come ti avevo nel primo post ho circa una cinquantina di righe, la cui maggior parte mi indicano che il "il file è bloccato". Avrei cercato di copiare per fartelo vedere ma non ci sono riuscito. Per il resto il pc non mi da problemi: solo quei file bloccati che non so cosa siano.
Se, dico se, va tutto bene per te, devo cancellare Combo Hijack marwarebytes ecc.?? o li tengo??
Se va tutto bene potrei scrivere anche per il portatile di mia moglie? e se si quali operazioni devo fare?

Tuesday, January 27, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, January 26, 2009 18:49:02
Records in database: 1701953


Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes

Scan area My Computer
C:\
D:\
E:\
F:\
G:\

Scan statistics
Files scanned 159578
Threat name 0
Infected objects 0
Suspicious objects 0
Duration of the scan 02:57:08

No malware has been detected. The scan area is clean.
The selected area was scanned.
r16
Inviato: Thursday, January 29, 2009 6:32:10 PM
Rank: AiutAmico

Iscritto dal : 8/7/2007
Posts: 11,016
Ciao.
Quella cinquantina di file bloccati, dovrebbero essere file di Windows,niente di preoccupante.
Disistalla pure Combofix nelle modalità descritte nel post in cui lo hai scaricato.
Malwarebytes, lo puoi tenere installato, è un valido programma.
Ricorda di aggiornarlo prima di ogni scansione.
Comunque posta un log di hijack this per un ultimo controllo, ed eventuali pulizie.
*********************************************************************************************************
Per il portatile della moglie mi serve un log di hijack this, che puoi postare sempre in questo topic.
Utenti presenti in questo topic
Guest


Salta al Forum
Aggiunta nuovi Topic disabilitata in questo forum.
Risposte disabilitate in questo forum.
Eliminazione tuoi Post disabilitata in questo forum.
Modifica dei tuoi post disabilitata in questo forum.
Creazione Sondaggi disabilitata in questo forum.
Voto ai sondaggi disabilitato in questo forum.

Main Forum RSS : RSS

Aiutamici Theme
Powered by Yet Another Forum.net versione 1.9.1.8 (NET v2.0) - 3/29/2008
Copyright © 2003-2008 Yet Another Forum.net. All rights reserved.