Hijacker.small Kj difficoltá!

[Ransie]

Allora non ci crederete...

ho fatto una scansione con AVG...

allora Hijacker.Small.kj è ancora lì....
e ne ha trovati altri di virus!!

Ancora? di nuovo?

cosa faccio?
Scansione con hijackthis?

[crazy.cat]

Non avevi detto che passavi ad antivir pe?

Fai una scansione online sul sito della kaspersky www.kaspersky.com e poi posta qui il risultato così vediamo quanti virus girano sul tuo pc.

[Ransie]

mmm veramente lo installai e cancellai anche AVg ma si impallava il pc!
non so se perché uso zone alarm come firewall! non ne ho idea!
e quindi ritornai al vecchio AVG!

Accidenti spero di risolvere il problema prima di partire, ho una settimana di tempo..altrimenti ritorno all'estero e non mi ridaranno internet...ed io devo lavorare ad un progetto da casa...non ci voglio neanche pensare..voglio essere fiduciosa!

Ora provvedo alla scansione con Kaspersky!!

[Ransie]

Cioè possibile che navigando in questa settimana abbia preso questi virus?

comunque questo è lo scan con Kaspersky, 8 virus e nn so quanti files infetti. Stesso risultato di AVG. Come procedo? Cancello in modalità provvisoria?

KASPERSKY ONLINE SCANNER REPORT
Monday, January 01, 2007 7:02:32 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 1/01/2007
Kaspersky Anti-Virus database records: 241069
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 64936
Number of viruses found: 8
Number of infected objects: 13 / 0
Number of suspicious objects: 0
Duration of the scan process: 01:09:07

Infected Object Name / Virus Name / Last Action
C:\sti.log Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\WINDOWS\Temp\ZLT002e5.TMP Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\Downloaded Program Files\2r1h4\z22uq7.exe Infected: Trojan-Downloader.Win32.Small.yv skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\NOME-T08H4AXFBR.ldb Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\Common Framework\Db\PrdMgr_NOME-T08H4AXFBR.log Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\Common Framework\Db\Agent_NOME-T08H4AXFBR.log Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\BOPDATA\_Date-20070101_Time-172446296_EnterceptRules.dat Object is locked skipped
C:\Documents and Settings\All Users\Dati applicazioni\Network Associates\BOPDATA\_Date-20070101_Time-172446296_EnterceptExceptions.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Nancy\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\2.tmp Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\52E.tmp Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\~DF3AC4.tmp Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\~DFC4CB.tmp Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\~DFC4D6.tmp Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\~DFE5F2.tmp Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\~DFE67D.tmp Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\Perflib_Perfdata_890.dat Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Cronologia\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Cronologia\History.IE5\MSHist012007010120070102\index.dat Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temporary Internet Files\Content.IE5\6P5U7YP4\adv647[1].htm Infected: Trojan-Downloader.JS.Agent.ab skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Dati applicazioni\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\nancy83@supereva.it\real\members.stg Object is locked skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Dati applicazioni\Microsoft\Windows Live Contacts\nancy83@supereva.it\shadow\members.stg Object is locked skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\dcmhelp(2).exe.bac_a01916 Infected: Backdoor.Win32.SdBot.xd skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\Passe-partout.exe.bac_a01916 Infected: Trojan.Win32.Diamin.t skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\w197[1].exe.bac_a01916 Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\dzar[1].bac_a01916 Infected: Trojan-Proxy.Win32.Ranky.dm skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\dzar[2].bac_a01916 Infected: Trojan-Proxy.Win32.Ranky.dm skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\icpldrvx.exe.bac_a02684 Infected: Trojan-Spy.Win32.Banker.byu skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\A0070335.exe.bac_a02684 Infected: Backdoor.Win32.SdBot.xd skipped
C:\Documents and Settings\Nancy\.housecall6.6\Quarantine\A0070336.exe.bac_a02684 Infected: Trojan.Win32.Diamin.t skipped
C:\Documents and Settings\Nancy\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\index2.dat Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\contactgroup256.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\profile256.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\user1024.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\call256.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\callmember256.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\user16384.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\chatmsg512.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\transfer256.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\transfer512.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\chatmsg256.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\chat512.dbb Object is locked skipped
C:\Documents and Settings\Nancy\Dati applicazioni\Skype\nancy.ransie\user4096.dbb Object is locked skipped
C:\Documents and Settings\Nancy\ntuser.dat Object is locked skipped
C:\Programmi\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\Programmi\Kodak\Kodak EasyShare software\Catalog\EasyShare.me Object is locked skipped
C:\Programmi\Kodak\Kodak EasyShare software\Catalog\EasyShare.mm Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Program\BWKDLogs\BWTargetInf.log Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\inuse.txt Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\storydb.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\D0000000.FCS Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\main.log Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chn.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_die.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_dnd.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_ext.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs_rcv.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\prs.idx Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\chandir.dat Object is locked skipped
C:\Programmi\Kodak\KODAK Software Updater\7288971\Users\Default\Data\L0000034.FCS Object is locked skipped

Scan process completed.

[Amantide]

La maggioranza dei file infetti si trova nella cartella quarantena di qualche programma, per eliminarli sarà sufficiente svuotare questa cartella dal menu di quel programma.

I file infetti da eliminare sono questi:

C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped
C:\WINDOWS\Downloaded Program Files\2r1h4\z22uq7.exe Infected: Trojan-Downloader.Win32.Small.yv skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\2.tmp Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\52E.tmp Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temporary Internet Files\Content.IE5\6P5U7YP4\adv647[1].htm Infected: Trojan-Downloader.JS.Agent.ab skipped

Dalla modalità provvisoria prova ad eliminare le voci sottolineate, per i file nelle cartelle temporanei usa CCleaner.
Inoltre ti consiglio di installare A-squared o AVG Anti Spyware e fare la scansione completa del sistema.

[Ransie]

La maggioranza dei file infetti si trova nella cartella quarantena di qualche programma, per eliminarli sarà sufficiente svuotare questa cartella dal menu di quel programma.

Allora avevo già svuotato la cartella dei file in quarantena, svuotato le cartelle dei files temporanei di windows ed eliminato facilmente

C:\WINDOWS\system32\i Infected: Trojan-Downloader.BAT.Ftp.ab skipped

Il problema è che questi altri files non riesco a trovarli (eppure ho impostato anche la visualizzazione dei files nascosti):

C:\WINDOWS\Downloaded Program Files\2r1h4\z22uq7.exe Infected: Trojan-Downloader.Win32.Small.yv skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\2.tmp Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temp\52E.tmp Infected: Net-Worm.Win32.Bobic.ac skipped
C:\Documents and Settings\Nancy\Impostazioni locali\Temporary Internet Files\Content.IE5\6P5U7YP4\adv647[1].htm Infected: Trojan-Downloader.JS.Agent.ab skipped

AVG lo uso già ed ho fatto anche una scansione in modalità provvisoria eliminando gli unici due files che mi trovava infetti.
Rifaccio ora una scansione con Kaspersky e vediamo cosa trova.

Scusate l'ignoranza, ma ho due domande:
1)ci sono le cartelle temp e temporary files di windows e fin qui ok. E poi ne ho altre due in c:\documents and Settings.. devo svuotare entrambe?

2) è possibile che ogni volta che navigo (ed ora sto usando Mozilla) prendo un virus?

[crazy.cat]

1) si
2) evidentemente avg non è così buono da proteggerti.

[Ransie]

Allora ho usato CCleaner per i file temporanei.
Ho fatto altre scansioni con A-squared: mi ha rilevato stessi files e virus di AVG (che non riuscivo a trovare nella cartella Downloaded program files) e li ho eliminati.

Ho riavviato e rifatto la scansione e sembra essere tutto ok a parte un cookie che A-squared mi segnala sempre, io cancello ma ogni volta che mi collego ad internet si ricrea.Ma credo non sia nulla di grave.
perché AVG non li cancellava e A-squared si?

Dato che ieri era tardi, oggi rifaccio scansioni e controllo meglio perché non mi fido più ormai.
Scansione rifatta anche con Kaspersky, non è stato rilevato alcun malware.

Crazycat forse il problema è che la protezione permanente di AVG non è disponibile in versione gratuita o almeno così dice.E' scaduta dopo 30 gg. Mi sa che devo rivoluzionare il sistema di protezione del mio pc per non avere problemi. Io ho provato ad elimnare AVG e installare Antivir ma mi si bloccava tutto!Cosa faccio per proteggere una volta per tutte il mio pc?