www.MegaLab.it

da **Andrexli** » dom gen 19, 2014 7:18 pm

Ecco qua Geronimo .

All processes killed
========== OTL ==========
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Configurazione IP di Windows
Cache del resolver DNS svuotata.
C:\Users\Utente\Desktop\antivirus\cmd.bat deleted successfully.
C:\Users\Utente\Desktop\antivirus\cmd.txt deleted successfully.
C:\ProgramData\frfjlfb7.fvv moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Utente
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 22989242 bytes
->Java cache emptied: 1588743 bytes
->Flash cache emptied: 506 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 18791910 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 68002 bytes
RecycleBin emptied: 217902 bytes

Total Files Cleaned = 42,00 mb

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Public

User: Utente
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0,00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Public

User: Utente
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 01192014_191129

Files\Folders moved on Reboot...
C:\Users\Utente\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\X50CFX9E\Impression@x96[1].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\RIC662KQ\viewforum[1].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O2OZ4IYI\ads[2].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O2OZ4IYI\dspl[1].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\M0EYZINI\1ec75eacc-8134-11e3-b5b5-003048b8e663@Top[1].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BKMU5X60\zrt_lookup[1].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\439I6GOC\viewtopic[1].htm moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\4A72F430-B40C-4D36-A068-CE33ADA5ADF9.dat moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
C:\Users\Utente\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Aspetto tua conferma per installare l'antivirus.. quale mi consigli?
Andrexli

da GERONIMO* » dom gen 19, 2014 10:08 pm

tutto ok

installati ZoneAllarm [;)]

da **Andrexli** » lun gen 20, 2014 6:58 pm

Ciao Geronimo. Niente da faer, non mi installa nessun antivirus. In particolare per zone allarm mi apre la finestra con "Impossibile creare un percorso temporaneo per i file di installazione" . [boh]

da GERONIMO* » mar gen 21, 2014 10:01 am

prova un attimo così
vai in pannello di controllo
Opzioni cartella
in Generale
in basso clicca su Ripristina valori predefiniti
poi vai sul tab Visualizzazione
e clicca su Reimposta cartelle e poi su Ripristina
conferma le modifiche dai applica-ok
riavvia il pc

e riprova a reinstallare un antivirus

da **Andrexli** » mar gen 21, 2014 8:24 pm

Ho fatto la procedura... niente.. solite finestre di errore... [nonono]

da GERONIMO* » mer gen 22, 2014 10:32 am

è uno strascico che ha lasciato il rootkit,oppure c'è ancora qualcosa nella cartella temp

usa questo tool come spiegato qui
http://www.windoctor.it/sistemi/ottimiz ... e-cleaner/

e riprova con l'antivirus

da **Andrexli** » mer gen 22, 2014 9:58 pm

Ciao Geronimo, TFC ha eliminato 19mb di file. Ho riprovato con gli antivirus, ma niente... soliti errori. Se può aiutare, ho notato che non mi apre più nenahc ei file .jpeg che prima mi apriva, adesso mi compare un mess che dice che non ho le autorizzazione appropriate per accedere al file.. [boh]

da **stevens** » mer gen 22, 2014 10:31 pm

se Gerinimo e' d'accordo

Scarica sul desktop Farbar Recovery Scan Tool: (scegli la versione adatta al tuo S.O. - 32 Bit o 64 Bit)
http://www.bleepingcomputer.com/downloa ... scan-tool/
Doppio click per avviarlo.
Ti compare una finestra: clicca Sì.
Clicca "Scan".
Finita la scansione,ti appaiono 2 il log sul desktop. (Addition e FRST)
Se non appaiono, significa che non lo hai scaricato sul desktop, per cui li trovi nella cartella dove hai scaricato il tool.
Postali qui. -

da **Andrexli** » gio gen 23, 2014 5:58 pm

Stevens ecco i log FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014
Ran by Utente (administrator) on UTENTE-PC on 23-01-2014 17:55:04
Running from C:\Users\Utente\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Italian Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/downloa ... ool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/downloa ... ool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/33 ... scan-tool/

==================== Processes (Whitelisted) =================

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {26B51A6E-72A2-4B46-B2BF-358B8D2E44D4} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shoc ... tor/sw.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== NetSvcs (Whitelisted) ===================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-01-05 11:19

==================== End Of Log ============================

e Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-01-2014
Ran by Utente at 2014-01-23 17:55:45
Running from C:\Users\Utente\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

==================== Restore Points =========================

==================== Hosts content: ==========================

2009-07-14 03:34 - 2014-01-14 19:37 - 00000741 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (01/23/2014 04:54:22 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/23/2014 08:47:58 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2014 08:49:27 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/22/2014 08:31:18 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/21/2014 08:22:44 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/21/2014 03:58:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/21/2014 09:01:26 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/20/2014 06:55:57 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/20/2014 06:54:32 PM) (Source: Windows Search Service) (User: )
Description: Impossibile inizializzare l'indice.

Dettagli:
Il catalogo dell'indice del contenuto è danneggiato. (HRESULT : 0xc0041801) (0xc0041801)

Error: (01/20/2014 06:54:32 PM) (Source: Windows Search Service) (User: )
Description: Impossibile inizializzare l'applicazione.

Contesto: applicazione Windows

Dettagli:
Il catalogo dell'indice del contenuto è danneggiato. (HRESULT : 0xc0041801) (0xc0041801)

System errors:
=============
Error: (01/23/2014 04:54:48 PM) (Source: Service Control Manager) (User: )
Description: Servizio Listener Gruppo Home terminato. Errore specifico del servizio %%-2147023143.

Error: (01/23/2014 04:52:47 PM) (Source: Service Control Manager) (User: )
Description: Servizio Browser di computer terminato con l'errore:
%%1060

Error: (01/23/2014 04:52:40 PM) (Source: Service Control Manager) (User: )
Description: Il servizio vToolbarUpdater17.3.0 non è stato avviato per il seguente errore:
%%2

Error: (01/23/2014 04:52:39 PM) (Source: Service Control Manager) (User: )
Description: Servizio Browser di computer terminato con l'errore:
%%1060

Error: (01/23/2014 08:58:56 AM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 millisecondi) durante l'attesa della risposta alla transazione dal servizio lmhosts.

Error: (01/23/2014 08:58:57 AM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (01/23/2014 08:48:23 AM) (Source: Service Control Manager) (User: )
Description: Servizio Listener Gruppo Home terminato. Errore specifico del servizio %%-2147023143.

Error: (01/23/2014 08:46:23 AM) (Source: Service Control Manager) (User: )
Description: Servizio Browser di computer terminato con l'errore:
%%1060

Error: (01/23/2014 08:46:15 AM) (Source: Service Control Manager) (User: )
Description: Il servizio vToolbarUpdater17.3.0 non è stato avviato per il seguente errore:
%%2

Error: (01/23/2014 08:46:14 AM) (Source: Service Control Manager) (User: )
Description: Servizio Browser di computer terminato con l'errore:
%%1060

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 43%
Total physical RAM: 2038.3 MB
Available physical RAM: 1142.13 MB
Total Pagefile: 4076.61 MB
Available Pagefile: 3000.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:164.69 GB) (Free:78.48 GB) NTFS

==================== End Of Log ============================

da GERONIMO* » ven gen 24, 2014 10:46 am

credo che il problema sia qualche servizio corrotto dal rootkit
possiamo provare 2 cose
1 con il comando SFC (System File Checker)
L'altra sostituire il servizio service.exe con uno integro

hai il dvd di windows a disposizione?

da **Andrexli** » ven gen 24, 2014 7:47 pm

No, niente DVD .. [acc2]

da GERONIMO* » ven gen 24, 2014 8:39 pm

proviamo senza dvd

apri il prompt dei comandi
start -tutti i programmi-accessori-prompt dei comandi
tasto destro su prompt dei comandi e scegli Esegui come Amministratore per aprirlo
copia e incolla nel prompt questo comando sfc /scannow e premi Invio sulla tastiera
e aspetta la fine dell'operazione...che arrivi al 100% se vengono trovati file danneggiati verranno ripristinati

da **Andrexli** » sab gen 25, 2014 10:19 am

Fatto, ecco qua

Microsoft Windows [Versione 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Windows\system32>sfc /scannow

Avvio in corso dell'analisi del sistema. Attendere. L'operazione richiederà alcu
ni minuti.

Avvio in corso della fase di verifica dell'analisi del sistema.
100% della verifica completato.

Protezione risorse di Windows: nessuna violazione di integrità trovata.

C:\Windows\system32>

ora?

da GERONIMO* » sab gen 25, 2014 8:36 pm

dice che non ci sono file danneggiati
il tuo account è amministratore?

da **Andrexli** » sab gen 25, 2014 10:06 pm

si, ho controllato su account utente in pannello di controllo e dice "administrator" [boh]

Non riesco ad aggioranre nenache java...

da **Andrexli** » sab feb 08, 2014 4:41 pm

Geronimoooooo!!!!! Ci sono riuscito. Ho dovuto fare un nuovo account administrator ed eliminare il vecchio! Ora è tutto ok, ho installato zonealarm. [grazie]

Di tutto, se passi da ivorno hai una birra pagata... Ciaoo [applauso+]