Su consiglio di Wolfstein metto il mio messaggio qui.
Dopo tutto l'Ambaradam l'intruso è scomparso all'80% ma non è debellato, ogni tanto riappare.
Ecco qui il mattone:
Salve, nel mio pc è apparso improvvisamente "Captchatest.top", che mi segnala con insistenza che nel mio pc è entrato un virus, l'antivirus è disattivato, il sistema è danneggiato, scansiona, elimina virus, installa tizio caio e sempronio, clicca qui e là e altre menate del genere, ovviamente non ho cliccato su nulla, probabilmente si tratta di un adware.
In rete ho trovato un mare di cose su "Captchaqualcosa", ma nulla su "Captchatest.top".
Sono ricorso alla guida di Giza e ho usato Malwarebytes, lancio la scansione e MB trova C:\Programfiles(x86)\Windows live\Photogallery\Winmoviemaker.exe classificato come "Generic malware suspicious", solo questo, forse è un falso positivo ma lo metto in quarantena.
Parto con AdwCleaner
Commenta:
# -------------------------------
# Malwarebytes AdwCleaner 8.3.2.0
# -------------------------------
# Build: 03-23-2022
# Database: 2022-03-15.3 (Local)
# Support:
https://www.malwarebytes.com/support#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 05-30-2022
# Duration: 00:00:15
# OS: Windows 10 Enterprise LTSC 2019
# Scanned: 32039
# Detected: 5
***** [ Services ] *****
No malicious services found.
***** [ Folders ] *****
PUP.Optional.Legacy C:\ProgramData\BSD\DriverHiveEngine
PUP.Optional.TweakBit C:\ProgramData\BSD\DriverHive
***** [ Files ] *****
No malicious files found.
***** [ DLL ] *****
No malicious DLLs found.
***** [ WMI ] *****
No malicious WMI found.
***** [ Shortcuts ] *****
No malicious shortcuts found.
***** [ Tasks ] *****
No malicious tasks found.
***** [ Registry ] *****
PUP.Optional.DriverUpdatePlus HKLM\Software\Wow6432Node\BSD
PUP.Optional.FreeMakeConverter HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32|ProductUpdater
PUP.Optional.FreeMakeConverter HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Run|ProductUpdater
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries found.
***** [ Chromium URLs ] *****
No malicious Chromium URLs found.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries found.
***** [ Firefox URLs ] *****
No malicious Firefox URLs found.
***** [ Hosts File Entries ] *****
No malicious hosts file entries found.
***** [ Preinstalled Software ] *****
No Preinstalled Software found.
AdwCleaner[S00].txt - [1622 octets] - [24/04/2022 11:33:26]
AdwCleaner_Debug.log - [5862 octets] - [24/04/2022 11:34:43]
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S01].txt ##########
Metto in quarantena quello che trova.
Scarico e lancio Rkill
Commenta:
Rkill 2.9.1 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/Copyright 2008-2022 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.htmlProgram started at: 05/30/2022 12:26:28 PM in x64 mode.
Windows Version: Windows 10 Enterprise LTSC 2019
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Defender Disabled
[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001
Ma perché Defender viene disabilitato?
Eseguo Hijackthis.
Commenta:
Log of HiJackThis Fork by Alex Dragokas v.2.9.0.26
Platform: x64 Windows 10 (Enterprise LTSB), 10.0.17763.2989 (ReleaseId: 1809), Service Pack: 0
Time: 30.05.2022 - 12:38 (UTC+02:00)
Language: OS: Italian (0x410). Display: Italian (0x410). Non-Unicode: Italian (0x410)
Elevated: No
Ran by: bbrun (group: Limited User) on DESKTOP-OQIHHIQ, FirstRun: yes
Internet Explorer: 11.1790.17763.0
Default: "E:\USB\Vivaldi\Application\vivaldi.exe" --single-argument %1 (Vivaldi S [E:\USB\Vivaldi])
Boot mode: Normal
Running processes:
Number | Path
1 C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
1 C:\Users\bbrun.DESKTOP-OQIHHIQ\Desktop\PortableApps\HiJackThis\HiJackThis.exe
1 C:\WINDOWS\System32\Wbem\WmiPrvSE.exe
1 C:\WINDOWS\system32\SearchIndexer.exe
1 C:\WINDOWS\system32\SecurityHealthService.exe
1 C:\WINDOWS\system32\SgrmBroker.exe
2 C:\WINDOWS\system32\csrss.exe
1 C:\WINDOWS\system32\dasHost.exe
1 C:\WINDOWS\system32\dwm.exe
2 C:\WINDOWS\system32\fontdrvhost.exe
1 C:\WINDOWS\system32\lsass.exe
1 C:\WINDOWS\system32\services.exe
1 C:\WINDOWS\system32\smss.exe
1 C:\WINDOWS\system32\spoolsv.exe
62 C:\WINDOWS\system32\svchost.exe
1 C:\WINDOWS\system32\wininit.exe
1 C:\WINDOWS\system32\winlogon.exe
1 C:\Windows\System32\ApplicationFrameHost.exe
2 C:\Windows\System32\RuntimeBroker.exe
1 C:\Windows\System32\ctfmon.exe
2 C:\Windows\System32\notepad.exe
1 C:\Windows\System32\sihost.exe
1 C:\Windows\System32\smartscreen.exe
1 C:\Windows\System32\taskhostw.exe
1 C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
1 C:\Windows\explorer.exe
1 MBAMService.exe
2 NVDisplay.Container.exe
1 Registry
R3 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002: Default URLSearchHook is missing
O2 - HKLM\..\BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
O3 - HKLM\..\Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll
O4 - Global User Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Memorandum - coll..lnk -> E:\VARIE\Documenti vari\Come fare a\Memorandum.txt
O4 - HKCU\..\Run: [EssentialPIM Portable] = F:\USB\EssentialPIM_AUP\EssentialPIM.exe /autorun
O4 - HKLM\..\Run: [CmPCIaudio] = C:\WINDOWS\syswow64\RunDll32.exe C:\WINDOWS\Syswow64\CMICNFG3.dll,CMICtrlWnd
O7 - TroubleShooting: (EV) HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\Environment: [TEMP] = (not exist)
O7 - TroubleShooting: (EV) HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\Environment: [TMP] = (not exist)
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [@ivt] protocol is in Unknown Zone, should be Intranet Zone (User: 'amo')
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [file] protocol is in Unknown Zone, should be Internet Zone (User: 'amo')
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [ftp] protocol is in Unknown Zone, should be Internet Zone (User: 'amo')
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [http] protocol is in Unknown Zone, should be Internet Zone (User: 'amo')
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [https] protocol is in Unknown Zone, should be Internet Zone (User: 'amo')
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [knownfolder] protocol is in Unknown Zone, should be My Computer Zone (User: 'amo')
O15 - HKU\S-1-5-21-3234073230-3742036366-1949944855-1002\..\ProtocolDefaults: - [shell] protocol is in Unknown Zone, should be My Computer Zone (User: 'amo')
O17 - DHCP DNS 1: 192.168.1.10
O18 - HKLM\Software\Classes\Protocols\Filter\text/xml: [CLSID] = {807553E5-5146-11D5-A672-00B0D022E945} - (no file)
O18 - HKLM\Software\Classes\Protocols\Handler\msdaipp\0x00000001: [CLSID] = {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - (no file)
O18 - HKLM\Software\Classes\Protocols\Handler\msdaipp\oledb: [CLSID] = {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - (no file)
O18 - HKLM\Software\Classes\Protocols\Handler\mso-offdap11: [CLSID] = {32505114-5902-49B2-880A-1F7738E5A384} - (no file)
O18 - HKLM\Software\Classes\Protocols\Handler\mso-offdap: [CLSID] = {3D9F03FA-7A94-11D3-BE81-0050048385D1} - (no file)
O18 - HKLM\Software\Classes\Protocols\Handler\wlpg: [CLSID] = {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - (no file)
O22 - Task (.job): (disabled) CreateExplorerShellUnelevatedTask.job - (no file)
O22 - Task (.job): (disabled) EPSON WF-2860 Series Update {40DA0318-3943-4B75-9DD5-651500F1FBEC}.job - (no file)
O22 - Task (.job): (disabled) EPSON WF-2860 Series Update {89C8C398-7451-4980-B57B-ED730EE3A4B2}.job - (no file)
O23 - Service R2: Malwarebytes Service - (MBAMService) - C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
O23 - Service R2: NVIDIA Display Container LS - (NVDisplay.ContainerLocalSystem) - C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_19c79fb6254e3b11\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log -l 3 -d C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_19c79fb6254e3b11\Display.NvContainer\plugins\LocalSystem -r -p 30000 -cfg NVDisplay.ContainerLocalSystem\LocalSystem
O23 - Service S2: AOMEI Backupper Scheduler Service - (Backupper Service) - C:\Program Files (x86)\AOMEI\AOMEI Backupper\6.9.1\ABService.exe
O23 - Service S2: Epson Scanner Service - (EpsonScanSvc) - C:\WINDOWS\system32\EscSvc64.exe
O23 - Service S2: Freemake Improver - C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
Debug information:
- 30.05.2022 12:38:25 - LoadFileToStream - #0 LastDllError = 5 (Accesso negato.) CreateFile C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
- 30.05.2022 12:38:25 - ParseJob. Unable to open file: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job - #0 LastDllError = 0
- 30.05.2022 12:38:25 - LoadFileToStream - #0 LastDllError = 5 (Accesso negato.) CreateFile C:\WINDOWS\Tasks\EPSON WF-2860 Series Update {40DA0318-3943-4B75-9DD5-651500F1FBEC}.job
- 30.05.2022 12:38:25 - ParseJob. Unable to open file: C:\WINDOWS\Tasks\EPSON WF-2860 Series Update {40DA0318-3943-4B75-9DD5-651500F1FBEC}.job - #0 LastDllError = 0
- 30.05.2022 12:38:25 - LoadFileToStream - #0 LastDllError = 5 (Accesso negato.) CreateFile C:\WINDOWS\Tasks\EPSON WF-2860 Series Update {89C8C398-7451-4980-B57B-ED730EE3A4B2}.job
- 30.05.2022 12:38:25 - ParseJob. Unable to open file: C:\WINDOWS\Tasks\EPSON WF-2860 Series Update {89C8C398-7451-4980-B57B-ED730EE3A4B2}.job - #0 LastDllError = 0
--
End of file - Time spent: 28,6 sec. - 14210 bytes, CRC32: FFFFFFFF. Sign: 좷黯]
Il mio S.O. è Win 10 Enterprise LTSC 2019, come navigatore uso Vivaldi.
Grazie.
