Runonce?

[Panetto]

Chiedo delucidazioni:

sto ripulendo il mio pc da gromozon/linkoptimizer e rustock (lzx32.sys), ecc. ecc.

Facendo una scansione con systemscan ho trovato questo:

-------------HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce-------------

[RunOnce]

[RunOnce\ApprovedByRegRun2]

[RunOnce\ApprovedByRegRun2\AntiRepl]

[RunOnce\ApprovedByRegRun2\AntiRepl\0]
"Operation"=dword:00000001
"Target"="\??\C:\WINDOWS\SYSTEM32\LZX32.SYS"
"Source"=""

[RunOnce\ApprovedByRegRun2\AntiRepl\1]
"Operation"=dword:00000001
"Target"="\??\C:\WINDOWS\SYSTEM32\LZX32.SYS"
"Source"=""

[RunOnce\ApprovedByRegRun2\AntiRepl\2]
"Operation"=dword:00000001
"Target"="C:\WINDOWS\SYSTEM32\LZX32.SYS"
"Source"=""

-------------HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx-------------

[RunOnceEx]

Cos'è? Tentativi precedenti di eliminare il file? Adesso tutti i programmi utilizzati per toglierlo (gmer, lo stesso regrun/reanimator, rustbix) mi danno il pc come pulito.

Come posso procedere?

Grazie!

[Panetto]

P.S.: questo è il "the-end" di systemscan:


-------------Hidden Files -------------

Scannig hidden processes ...

Scannig hidden services ...

Scannig hidden autostart entries ...

Scannig hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

-------------Checking Rustock rootkit-------------

-------------Checking Suspicious files -------------
(Unusually Runtime packers compressed exe and dll files in C:\, C:\WINDOWS\, C:\WINDOWS\system32\)
Note:Not all files found by this scanner are bad
-This file is compressed with UPX C:\WINDOWS\System32\MIOENG~1.EXE
-This file is compressed with Upack C:\WINDOWS\System32\IFMON.DLL

--------------------------
Scan completed in 30,8 minutes
End of report

[Amantide]

Le prime voci sono sicuramenti i residui della scansione fatta con Regrun Reanimator, per quanto riguarda la seconda domanda... siccome il nome di questo file non è indicato completamente è bene che lo carichi su www.virustotal.com e vedi di cosa si tratta:
C:\WINDOWS\System32\MIOENG~1.EXE

[Panetto]

Grazie! Questo il risultato:


STATUS: FINISHED

Complete scanning result of "mioengine.exe", received in VirusTotal at 03.09.2007, 14:48:24 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.41 03.09.2007 no virus found
Authentium 4.93.8 03.08.2007 no virus found
Avast 4.7.936.0 03.09.2007 no virus found
AVG 7.5.0.447 03.08.2007 no virus found
BitDefender 7.2 03.09.2007 no virus found
CAT-QuickHeal 9.00 03.08.2007 no virus found
ClamAV devel-20060426 03.09.2007 no virus found
DrWeb 4.33 03.09.2007 no virus found
eSafe 7.0.14.0 03.08.2007 suspicious Trojan/Worm
eTrust-Vet 30.6.3467 03.09.2007 no virus found
Ewido 4.0 03.09.2007 no virus found
FileAdvisor 1 03.09.2007 no virus found
Fortinet 2.85.0.0 03.09.2007 suspicious
F-Prot 4.3.1.45 03.08.2007 no virus found
F-Secure 6.70.13030.0 03.09.2007 no virus found
Ikarus T3.1.1.3 03.09.2007 no virus found
Kaspersky 4.0.2.24 03.09.2007 no virus found
McAfee 4980 03.08.2007 no virus found
Microsoft 1.2204 03.09.2007 no virus found
NOD32v2 2105 03.09.2007 no virus found
Norman 5.80.02 03.09.2007 no virus found
Panda 9.0.0.4 03.09.2007 Suspicious file
Prevx1 V2 03.09.2007 no virus found
Sophos 4.15.0 03.09.2007 no virus found
Sunbelt 2.2.907.0 03.07.2007 no virus found
Symantec 10 03.09.2007 no virus found
TheHacker 6.1.6.073 03.09.2007 no virus found
UNA 1.83 03.07.2007 no virus found
VBA32 3.11.2 03.08.2007 no virus found
VirusBuster 4.3.19:9 03.08.2007 no virus found


Aditional Information
File size: 407047 bytes
MD5: cf6f52894e503e3f6a5d792a32bbaa33
SHA1: 62cb1866578c2929605ebf37c5bd5f02c7788598
packers: UPX
packers: UPX
packers: UPX