ennesimo log hijackthis !!! chi mi può dire cosa cancellare?

[ric74]

Intanto approfitto di questo mio primo messaggio per salutare tutti i frequentatori di questo forum.

Vado subito al sodo esponendoVi l'oggetto della mia richiesta d'aiuto.

Di seguito posto il mio log di hijackthis con preghiera che qualcuno mi possa dire cosa c'è di dannoso da eliminare:

Logfile of HijackThis v1.99.1
Scan saved at 17.59.01, on 05/07/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Programmi\Analog Devices\Core\smax4pnp.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\Trend Micro\Internet Security 14\pccguide.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Telecom Italia Media\Fast 800-840 Tin.it\dslmon.exe
C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE
C:\Programmi\Messenger\msmsgs.exe
C:\3DSMAX7\VRLSERVER.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE
C:\Programmi\PowerArchiver\POWERARC.EXE
C:\TMP\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Barra degli strumenti anti-frode Trend Micro - {06647158-359E-4D10-A8DE-E6145DA90BE9} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Barra degli strumenti anti-frode Trend Micro - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - C:\PROGRA~1\TRENDM~1\INTERN~1\PccIeBar.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmi\Trend Micro\Internet Security 14\pccguide.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Programmi\Telecom Italia Media\Fast 800-840 Tin.it\dslmon.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {04365000-DFC6-11D3-B2BB-00105AE309D0} (/Quercia TLQJ 2000-Quercia) - https://bdsbusinessweb.bancodisicilia.i ... J2kQrc.cab
O16 - DPF: {13083D70-37BD-11D4-B315-00508B6D3B87} (/Quercia TLQJ 2000-QF24) - https://bdsbusinessweb.bancodisicilia.i ... qJ2kQF.cab
O16 - DPF: {2A5C1DD0-DFC5-11D3-B2BB-00105AE309D0} (/Quercia TLQJ 2000-Other) - https://bdsbusinessweb.bancodisicilia.i ... J2kOth.cab
O16 - DPF: {5140EE10-DFC4-11D3-B2BB-00105AE309D0} (/Quercia TLQJ 2000-Image) - https://bdsbusinessweb.bancodisicilia.i ... J2kImg.cab
O16 - DPF: {572A663E-9756-4DAA-8F65-D97CEF308D64} (/Quercia TLQJ 2000-BDR) - https://bdsbusinessweb.bancodisicilia.i ... J2kBDR.cab
O16 - DPF: {59E6401A-A851-4E94-8DBA-40BD28BF4AA0} (/TlqJ 2000 LiberoBDR) - https://bdsbusinessweb.bancodisicilia.i ... Libero.cab
O16 - DPF: {9389EFC0-3B78-482E-9974-6A365C571126} (/Quercia TLQJ 2000-TabF24) - https://bdsbusinessweb.bancodisicilia.i ... 2kTabF.cab
O16 - DPF: {B1738950-DFC5-11D3-B2BB-00105AE309D0} (/Quercia TLQJ 2000-QCbi) - https://bdsbusinessweb.bancodisicilia.i ... J2kQCb.cab
O16 - DPF: {CB572CC0-E5F9-11D3-B2C1-00105AE309D0} (/Quercia TLQJ 2000-QData) - https://bdsbusinessweb.bancodisicilia.i ... J2kQDt.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{75105985-49B2-4181-9962-C34C289788CD}: NameServer = 151.99.125.2,212.216.112.122
O17 - HKLM\System\CCS\Services\Tcpip\..\{C84E148A-2A17-44A5-A81B-0A9D18A94504}: NameServer = 62.211.69.150 212.48.4.15
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Programmi\File comuni\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

Nel frattempo accetterei volentieri ulteriori informazioni utili su come poter agire al meglio per sistemare del tutto il mio computer colpito da questo dialer.

Ringrazio anticipatamente chiuque voglia porgermi il proprio aiuto.

Ciao a tutti!

[crazy.cat]

Al momento non vedo niente nel tuo log.

Se stai parlando del dialer winmovie plugin c'è una lunga lista con questo problema,
http://www.MegaLab.it/forum/viewtopic.php?t=21462
http://www.MegaLab.it/forum/viewtopic.php?t=22253
http://www.MegaLab.it/forum/viewtopic.php?t=22319
http://www.MegaLab.it/forum/viewtopic.php?t=22226
http://www.MegaLab.it/forum/viewtopic.php?t=22126

se hai l'adsl dovresti attivare il dialer e poi rifare il log in modo che possa vedere dove si nasconde.

[ric74]

Chiedo umilmente scusa , ho erroneamente postato il log di un altro computer che effettivamente non ha problemi .

Questo è quello incasinato

Logfile of HijackThis v1.99.1
Scan saved at 17.56.07, on 05/07/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programmi\AVPersonal\AVGUARD.EXE
C:\Programmi\AVPersonal\AVWUPSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Programmi\RealVNC\WinVNC\WinVNC.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SERVICES.EXE
C:\WINNT\Explorer.exe
C:\WINNT\services.exe
C:\WINNT\system32\Promon.exe
C:\Programmi\Analog Devices\SoundMAX\Smtray.exe
C:\WINNT\system32\carpserv.exe
C:\WINNT\mHotkey.exe
C:\Programmi\ScanSoft\OmniPageSE\opware32.exe
C:\WINNT\SERVICES.EXE
C:\Programmi\AVPersonal\AVGNT.EXE
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\WINNT\system32\spoolsvc.exe
C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Dati applicazioni\tofareraci\systvmrs.exe
C:\WINNT\system32\ctfmon.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Programmi\WinZip\WZQKPICK.EXE
C:\Programmi\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Impostazioni locali\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\SERVICES.EXE
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\SERVICES.EXE
O2 - BHO: IEHlprObj Class - {01FB9C55-FC66-4476-A199-389241193188} - C:\WINNT\system32\YLOXBH~1.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmi\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1040,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmi\google\googletoolbar1.dll
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [Smapp] C:\Programmi\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programmi\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [SERVICES.EXE] C:\WINNT\SERVICES.EXE
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programmi\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Systems] C:\WINNT\system32\spoolsvc.exe
O4 - HKLM\..\Run: [oeuai] C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Dati applicazioni\tofareraci\systvmrs.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programmi\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmi\WinZip\WZQKPICK.EXE
O4 - Global Startup: Controllo del Calendario di Ulead Photo Express.lnk = C:\Programmi\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O8 - Extra context menu item: &Google Search - res://c:\programmi\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\programmi\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programmi\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmi\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmi\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programmi\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O15 - Trusted Zone: www.1987324.com
O15 - Trusted Zone: www.adslconnection.name
O15 - Trusted Zone: *.aflashcounter.com
O15 - Trusted Zone: www.linkautomatici.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.sgrunt.biz
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.softlab.name
O15 - Trusted Zone: www.xxx-content.name
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/19027/CD/Mondo.exe
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.softlab.name/closer/close.exe
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programmi\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programmi\AVPersonal\AVWUPSRV.EXE
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Gestione estesa dischi fissi (dskex) - Unknown owner - C:\WINNT\downlo~1\qcycc\tsnkg2.exe (file missing)
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoRpc.exe (file missing)
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoRT.exe (file missing)
O23 - Service: eTrust Antivirus Job Server (InoTask) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoTask.exe (file missing)
O23 - Service: NMS Service (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Unknown owner - C:\Programmi\Trend Micro\PC-cillin 2002\PCCPFW.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Programmi\Trend Micro\PC-cillin 2002\Tmntsrv.exe (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\RealVNC\WinVNC\WinVNC.exe" -service (file missing)

Grazie ancora!!!!

[crazy.cat]

Il dialer è quello che ti indico in azzurro ma devono sparire anche tutti i file segnati in rosso.
Cancella le righe indicate con hijackthis e usando Delete doctor seleziona i file indicati e riavvia subito il pc.

Ho rimosso le righe del 01 suppunendo che le modifiche le avevi inserite tu.

F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\SERVICES.EXE
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\SERVICES.EXE
O2 - BHO: IEHlprObj Class - {01FB9C55-FC66-4476-A199-389241193188} - C:\WINNT\system32\YLOXBH~1.DLL (file missing)
O4 - HKLM\..\Run: [tourpath] regedit /s c:\winnt\tour.reg (sospetto???)
O4 - HKLM\..\Run: [SERVICES.EXE] C:\WINNT\SERVICES.EXE
O4 - HKLM\..\Run: [Systems] C:\WINNT\system32\spoolsvc.exe
O4 - HKLM\..\Run: [oeuai] C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Dati applicazioni\tofareraci\systvmrs.exe
O15 - Trusted Zone: www.1987324.com
O15 - Trusted Zone: www.adslconnection.name
O15 - Trusted Zone: *.aflashcounter.com
O15 - Trusted Zone: www.linkautomatici.com
O15 - Trusted Zone: www.redfunny.com
O15 - Trusted Zone: www.sgrunt.biz
O15 - Trusted Zone: www.skymasters.biz
O15 - Trusted Zone: www.softlab.name
O15 - Trusted Zone: www.xxx-content.name
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/19027/CD/Mondo.exe
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.softlab.name/closer/close.exe
O23 - Service: Gestione estesa dischi fissi (dskex) - Unknown owner - C:\WINNT\downlo~1\qcycc\tsnkg2.exe (file missing)

[andorra24]

Ciao, apri hijackthis, premi su ''open the misc tools section'', poi premi ''open process manager'', individua le voci indicate sotto e premi ''kill process'':

C:\WINNT\SERVICES.EXE
C:\WINNT\system32\spoolsvc.exe
C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Dati applicazioni\tofareraci\systvmrs.exe

Poi vai in basso e premi il tasto back e subito dopo il tasto scan. Metti la spunta nella casellina accanto alle voci indicate sotto e premi ''fix checked'' :

F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\SERVICES.EXE
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\SERVICES.EXE
O2 - BHO: IEHlprObj Class - {01FB9C55-FC66-4476-A199-389241193188} - C:\WINNT\system32\YLOXBH~1.DLL (file missing)
O4 - HKLM\..\Run: [SERVICES.EXE] C:\WINNT\SERVICES.EXE
O4 - HKLM\..\Run: [Systems] C:\WINNT\system32\spoolsvc.exe
O4 - HKLM\..\Run: [oeuai] C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Dati applicazioni\tofareraci\systvmrs.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
TUTTE LE VOCI 015
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
O16 - DPF: {86EEF11E-FF16-48CE-B1A2-474B663041A9} - http://kit.carpediem.fr/19027/CD/Mondo.exe
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.softlab.name/closer/close.exe
O23 - Service: Gestione estesa dischi fissi (dskex) - Unknown owner - C:\WINNT\downlo~1\qcycc\tsnkg2.exe (file missing)
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoRpc.exe (file missing)
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoRT.exe (file missing)
O23 - Service: eTrust Antivirus Job Server (InoTask) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoTask.exe (file missing)
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Unknown owner - C:\Programmi\Trend Micro\PC-cillin 2002\PCCPFW.exe (file missing)
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Programmi\Trend Micro\PC-cillin 2002\Tmntsrv.exe (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\RealVNC\WinVNC\WinVNC.exe" -service (file missing)

Visualizza cartelle e file nascosti. Scarica killbox da qui:
http://www.bleepingcomputer.com/files/killbox.php

con killbox assicurati di eliminare i seguenti files exe:

C:\WINNT\SERVICES.EXE
C:\WINNT\system32\spoolsvc.exe (da non confondere con il legittimo spoolsv.exe)
C:\Documents and Settings\FERRANTI.COLUSSIGROUP\Dati applicazioni\tofareraci\systvmrs.exe (elimina anche la cartella tofareraci).


Fai una scansione con ewido:
http://www.ewido.net/en/onlinescan/

[andorra24]

Opsss scusa crazy.cat non avevo visto la tua risposta.

[crazy.cat]

O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoRpc.exe (file missing)
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoRT.exe (file missing)
O23 - Service: eTrust Antivirus Job Server (InoTask) - Unknown owner - C:\Programmi\CA\eTrust Antivirus\InoTask.exe (file missing)
O23 - Service: PC-cillin PersonalFirewall (PCCPFW) - Unknown owner - C:\Programmi\Trend Micro\PC-cillin 2002\PCCPFW.exe (file missing)
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Programmi\Trend Micro\PC-cillin 2002\Tmntsrv.exe (file missing)

Io però aspetterei per questi, anche perché non si capisce bene quale antivirus stia usando in questo momento.
Ma essendo (credo) in una rete aziendale è più facile che stia adoperando proprio questo.
Avg e antivir dovrebbero essere solo in "prova".

Opsss scusa crazy.cat non avevo visto la tua risposta

Nessun problema, anzi da giovedì prossimo ti lascio tutta la sezione sicurezza se hai voglia.
Vado in ferie.

[andorra24]

Nessun problema, anzi da giovedì prossimo ti lascio tutta la sezione sicurezza se hai voglia.
Vado in ferie.

Allora verro' a dare un'occhiata in tua assenza. :)

[ric74]

Grazie tante per le risposte date.

Visto che il computer infetto non è il mio, Vi farò sapere dell'esito dell'operazione quando l'agente in questione (spero sappia come muoversi) avrà fatto il tutto.

Ciao!!!