Controllo log di hjiackthis

[civi1966]

Ciao a tutti, qualcuno può dare un'occhiata al seguente Log?

Logfile of HijackThis v1.99.1
Scan saved at 22.45.19, on 13/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
c:\Programmi\Norton Personal Firewall\NISUM.EXE
C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Programmi\Norton Personal Firewall\ccPxySvc.exe
C:\Programmi\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Programmi\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Programmi\Multimedia Card Reader\shwicon2k.exe
C:\Programmi\File comuni\Symantec Shared\ccApp.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
C:\Programmi\HP\hpcoretech\hpcmpmgr.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe
C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\NoAdware4\NoAdware4.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\PROPRI~1\IMPOST~1\Temp\Rar$EX01.328\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ssesso.it
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-it10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-it10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ssesso.it
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-it10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-it10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-it10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ssesso.it
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Vista HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Programmi\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmi\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar con blocco Pop-Up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Programmi\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Sunkist2k] C:\Programmi\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [ccApp] "c:\Programmi\File comuni\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmi\File comuni\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ccRegVfy] "c:\Programmi\File comuni\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programmi\File comuni\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programmi\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [AnyDVD] C:\Programmi\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programmi\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\lib\NMBgMonitor.exe"
O4 - Startup: Utilità controllo supporti di Cyber-shot Viewer.lnk = C:\Programmi\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmi\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F1E718AB-4864-4C5F-B52B-8D42D337A6EF}: NameServer = 213.205.32.70 213.205.36.70
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - c:\Programmi\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servizio Auto-Protect di Norton AntiVirus (navapsvc) - Symantec Corporation - C:\Programmi\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - c:\Programmi\Norton Personal Firewall\NISUM.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmi\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FILECO~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmi\File comuni\Symantec Shared\CCPD-LC\symlcsvc.exe

[Amantide]

Rifai il log e fixa queste voci:
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34546} - C:\WINDOWS\System32\vbsys2.dll

Ora scarica questo archivio, estrai il file sul desktop e lancia il file Free6_Cleaner.vbs. Verranno creati 2 file:
-uno con l'estensione TXT che contiene le istruzioni per la rimozione di malware dovuto al file vbsys2.dll
-e l'altro con l'estensione REG - per la correzione delle voci di registro infette.
Dopo aver eseguito la pulizia, puoi eliminare il file C:\WINDOWS\System32\vbsys2.dll ed anche il file c:\eied_s7.cab. Prima di eliminarli, dalle Opzioni cartella abilita la visualizzazione dei file nascoti, se non riesci ad eliminarli manualmente usa il programma Unlocker o Delete Doctor.

[civi1966]

Ho scaricato l'archivio, non riesco però ad estrarre i files.

[Amantide]

Ho scaricato l'archivio, non riesco però ad estrarre i files.

Strano... l'ho scaricato anche io ma non ho i problemi ad aprirlo. Forse usi una versione vecchia di WinRar o qualche altro programma che non riesce ad aprirlo.
Comunque, non è un problema... possiamo creare quel file .vbs anche manualmente.
Copi questo testo su blocco note e salva il file con il nome Free6_Cleaner.vbs, dopo essere salvato il file avrà l'aspetto di una pergamena.

Codice: Seleziona tutto

Dim instructions
Dim notice
instructions = "Free6_Cleaner is a VBS file that will create a *.REG file that will help you clean your system of Free6" & vbcrlf
instructions = instructions & "The *.Reg file is/has-been created on your dektop." & vbcrlf
instructions = instructions & "To clean Free6:" & vbcrlf
instructions = instructions & vbtab & "1. Double-Click the file 'CleanFree6.reg' located on your Desktop." & vbcrlf
instructions = instructions & vbtab & "2. Restart You System." & vbcrlf
instructions = instructions & vbtab & "3. Browse to %SystemRoot%\System32\vbsys2.dll" & vbcrlf
instructions = instructions & vbtab & vbtab & "(%SystemRoot% is a short way to say your system folder: usually c:\windows)" & vbcrlf
instructions = instructions & vbtab & "4. Rename or/and Move/Remove the file vbsys2.dll" & vbcrlf
instructions = instructions & vbtab & "5. The Free6 popups should be gone! Mention us." & vbcrlf
instructions = instructions & vbtab & "Xpounded."
notice = "It appears that your system is free of Free6."
Function RegRead(key)
   Dim Sh, sRet
   Set Sh = CreateObject("WScript.Shell")
   sKey =  key
   On Error Resume Next
   sRet = Sh.RegRead(sKey)
   On Error Goto 0
   Set Sh = Nothing
   RegRead = sRet
End Function

Function RegFileToCleanFree6(strCLSSID)
   Dim ret
   ret="REGEDIT4" & vbcrlf
   ret=ret & ";Xpounded File to Remove Probable Free6 Hijacker vbsys2" & vbcrlf
   ret=ret & ";" & vbcrlf
   ret=ret & ";HKEY_CLASSES_ROOT\CLSID" & strCLSSID & "\InProcServer32" & vbcrlf
   ret=ret & ";REG_EXPAND_SZ @ C:\WINDOWS\System32\vbsys2" & vbcrlf
   ret=ret & "[HKEY_CLASSES_ROOT\CLSID" & strCLSSID & "\InProcServer32]" & vbcrlf
   ret=ret & "@=-"  & vbcrlf
   ret=ret & "[-HKEY_CLASSES_ROOT\CLSID" & strCLSSID & "\InProcServer32]" & vbcrlf & vbcrlf
   ret=ret & ";HKEY_CLASSES_ROOT\CLSID" & strCLSSID & vbcrlf
   ret=ret & ";REG_EXPAND_SZ @ System Check Application" & vbcrlf & vbcrlf
   ret=ret & "[HKEY_CLASSES_ROOT\CLSID" & strCLSSID & "]" & vbcrlf
   ret=ret & "@=-" & vbcrlf
   ret=ret & "[-HKEY_CLASSES_ROOT\CLSID" & strCLSSID & "]" & vbcrlf & vbcrlf
   ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID" & strCLSSID & "\InProcServer32" & vbcrlf
   ret=ret & ";REG_EXPAND_SZ @ C:\WINDOWS\System32\vbsys2" & vbcrlf
   ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID" & strCLSSID & "\InProcServer32]" & vbcrlf
   ret=ret & "@=-" & vbcrlf
   ret=ret & "[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID" & strCLSSID & "\InProcServer32]" & vbcrlf & vbcrlf
   ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID" & strCLSSID & vbcrlf
   ret=ret & ";REG_EXPAND_SZ @ System Check Application" & vbcrlf
   ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID" & strCLSSID & "]" & vbcrlf
   ret=ret & "@=-" & vbcrlf
   ret=ret & "[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID" & strCLSSID & "]" & vbcrlf & vbcrlf
   ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" & vbcrlf
   ret=ret & ";REG_SZ SystemCheck2 " & strCLSSID & vbcrlf
   ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]" & vbcrlf
   ret=ret & chr(34) & "SystemCheck2" & chr(34) & "=-" & vbcrlf & vbcrlf
   ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" & vbcrlf
   ret=ret & ";REG_SZ SystemCheck2 " & strCLSSID & vbcrlf
   ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]" & vbcrlf
   ret=ret & chr(34) & "SystemCheck2" & chr(34) & "=-" & vbcrlf
   RegFileToCleanFree6 = ret
End Function

Sub saveFile(path,sContent)
   Dim result
   Set result = fso.createTextFile(path,True)
   result.Write sContent
   result.Close
   Set result = Nothing
End Sub

Dim fso, desktop, WshShell
set WshShell = WScript.CreateObject("WScript.Shell")
desktop = WshShell.SpecialFolders("Desktop")
set WshShell = Nothing
Set fso = createObject("Scripting.FileSystemObject")

free6CLSSID=RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2")
If free6CLSSID <> "" Then
   regFile = RegFileToCleanFree6(free6CLSSID)
   saveFile desktop & "\CleanFree6.reg", regFile
   saveFile desktop & "\CleanFree6.txt", instructions
Else
   saveFile desktop & "\CleanFree6.txt", notice
End If
msgbox "Read the 'CleanFree6.txt' instructions on your Desktop to Clean free6 from your system",vbokonly,"Completed"



[civi1966]

Un mega grazie per l'aiuto, il problema si è risolto.
Saluto tutti e Vi consiglierò