www.MegaLab.it

da **thread.net** » dom mag 18, 2008 5:14 pm

Ciao a tutti...Gmer mi ha trovato il seguente rootkit su uno dei miei computer :

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-05-18 18:00:16
Windows 5.1.2600 Service Pack 2

---- Services - GMER 1.0.14 ----

Service C:\Programmi\File comuni\Services\LxRT.exe (*** hidden *** ) [AUTO] SrvSqf <-- ROOTKIT !!!

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@Type 16
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@ImagePath "C:\Programmi\File comuni\Services\LxRT.exe"
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@DisplayName SrvSqf
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@ObjectName .\URGhwCvfPsApHUmeI
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf@Description Abilita un computer a riconoscere e adattarsi alle modifiche hardware con il minimo input da parte dell'utente o senza alcun input. Se il servizio viene arrestato o disabilitato, il sistema diventer? instabile.
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf\Security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@Type 16
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@Start 2
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@ImagePath "C:\Programmi\File comuni\Services\LxRT.exe"
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@DisplayName SrvSqf
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@ObjectName .\URGhwCvfPsApHUmeI
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf@Description Abilita un computer a riconoscere e adattarsi alle modifiche hardware con il minimo input da parte dell'utente o senza alcun input. Se il servizio viene arrestato o disabilitato, il sistema diventer? instabile.
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf\Security
Reg HKLM\SYSTEM\ControlSet002\Services\SrvSqf\Security@Security 0x01 0x00 0x14 0x80 ...

---------------------------------------------------------------

Vi posto anche il log di Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18.04.09, on 18/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\mgabg.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PDesk\PDesk.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\Temp\aaei1.exe
C:\Documents and Settings\All Users\Dati applicazioni\microsoft\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fastweb.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [aaei1.exe] C:\WINDOWS\Temp\aaei1.exe
O4 - HKLM\..\Run: [msmmi] C:\WINDOWS\system32\msmmi.exe
O4 - HKLM\..\Run: [ctfmon] C:\Documents and Settings\All Users\Dati applicazioni\microsoft\ctfmon.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Programmi\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1106190657
O23 - Service: Boonty Games - BOONTY - C:\Programmi\File comuni\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Family/IMPOST~1/Temp/msohtml1/01/clip_image002.gif

--
End of file - 4733 bytes

-----------------------------
Potete darmi una mano??? Non ho trovato nulla in rete di simile.. Grazie [V]

Ciao

da **ste_95** » dom mag 18, 2008 5:17 pm

Mica male...

In hijackthis, seleziona a sinistra queste voci e premi in basso Fix Checked:

O4 - HKLM\..\Run: [aaei1.exe] C:\WINDOWS\Temp\aaei1.exe
O4 - HKLM\..\Run: [msmmi] C:\WINDOWS\system32\msmmi.exe
O4 - HKLM\..\Run: [ctfmon] C:\Documents and Settings\All Users\Dati applicazioni\microsoft\ctfmon.exe

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nella box bianca che si è aperta:

Codice: Seleziona tutto: Files to delete: C:\Programmi\File comuni\Services\LxRT.exe C:\Documents and Settings\All Users\Dati applicazioni\microsoft\ctfmon.exe C:\WINDOWS\Temp\aaei1.exe C:\WINDOWS\system32\msmmi.exe Registry heys to delete: HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf

Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Prova a riscrivere manualmente la prima riga (Files to delete:) ricordando i due punti. Se il problema persiste prova con la vecchia versione di Avenger.

da **thread.net** » dom mag 18, 2008 5:42 pm

Si, infatti....
Il computer l'ho comprato da un collega per 50 euro, e' un po' vecchiotto ma come server o per testare delle reti va + che bene..

Complimenti per la velocita'....

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sun May 18 18:38:45 2008

18:38:45: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Sun May 18 18:38:54 2008

18:38:54: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Error: file "C:\Programmi\File comuni\Services\LxRT.exe" not found!
Deletion of file "C:\Programmi\File comuni\Services\LxRT.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
-->

the object does not exist

File "C:\Documents and Settings\All Users\Dati applicazioni\microsoft\ctfmon.exe" deleted successfully.
File "C:\WINDOWS\Temp\aaei1.exe" deleted successfully.
File "C:\WINDOWS\system32\msmmi.exe" deleted successfully.

Error: file "Registry heys to delete:" not found!
Deletion of file "Registry heys to delete:" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
-->

the object does not exist

Error: could not open file "HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf"
Deletion of file "HKLM\SYSTEM\CurrentControlSet\Services\SrvSqf" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
-->

bad path / the parent directory does not exist

Completed script processing.

*******************

Finished! Terminate.

da **ste_95** » dom mag 18, 2008 5:58 pm

Hai ancora problemi?

da **thread.net** » dom mag 18, 2008 6:15 pm

Per il momento no....

ora rifaccio un po' di scansioni con normali antivirus e antispyware

Ciao

PS.... Campioni d'Italia grazie a Ibra.. [devil]

bye

da **thread.net** » mar mag 20, 2008 8:09 pm

Ciao ste_95

Ho fatto tutte lescansioni possibili (McAfee, SpybotS&D, Ccleaner) ma
purtroppo ho ancora problemi, potrebbe essere stata una chiavetta usb infetta che ho gia scansionato e anche formattato.....
comunque fai con comodo non ho fretta..
grazie Ciao
---------------------------------------------------------------------------------------------

GMER 1.0.14.14205 - http://www.gmer.net
Rootkit scan 2008-05-20 21:06:12
Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.14 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xF48668BB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xF486683B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xF48668E5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF486684F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF486687B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xF486690F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF4866827]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xF48668CF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF4866865]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xF4866891]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF48668A7]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xF4866925]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xF48668F9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection

---- Devices - GMER 1.0.14 ----

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

---- Services - GMER 1.0.14 ----

Service C:\Programmi\File comuni\Services\LxRT.exe (*** hidden *** ) [AUTO] SrvSqf <-- ROOTKIT !!!

---- EOF - GMER 1.0.14 ----

Ti posto il solito log...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21.06.38, on 20/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\E_S00RP2.EXE
C:\Programmi\File comuni\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\programmi\file comuni\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FILECO~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\mgabg.exe
C:\Programmi\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PDesk\PDesk.exe
C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programmi\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmi\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1106190657
O17 - HKLM\System\CCS\Services\Tcpip\..\{6BB4C373-26C8-4144-89A4-511D111416BF}: NameServer = 193.70.152.15 193.70.152.25
O23 - Service: Boonty Games - BOONTY - C:\Programmi\File comuni\BOONTY Shared\Service\Boonty.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FILECO~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programmi\File comuni\EPSON\EBAPI\SAgent2.exe
O23 - Service: EPSON V3 Service2(02) (EPSON_PM_RPCV2_02) - SEIKO EPSON CORPORATION - C:\WINDOWS\system32\E_S00RP2.EXE
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Programmi\File comuni\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\programmi\file comuni\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FILECO~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Programmi\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/Family/IMPOST~1/Temp/msohtml1/01/clip_image002.gif

--
End of file - 6177 bytes

da **ste_95** » mar mag 20, 2008 8:17 pm

In modalità provvisoria controlla l'esistenza di questo file:

C:\Programmi\File comuni\Services\LxRT.exe

da **thread.net** » mar mag 20, 2008 9:37 pm

No, in quella cartella non c'e', neanche tra i files o cartelle nascoste
Ci sono solo 3 immagini bmp e 2 eseguibili.....

da **ste_95** » mer mag 21, 2008 5:38 am

Hai controllato in modalità provvisoria, vero? Eppure è strano... [acc2]

da **thread.net** » gio mag 22, 2008 6:02 pm

Si ho controllato in modalita' provvisoria : nella cartella C:\Programmi\File Comuni\Services ci sono 2 file exe che si chiamano CJGGsxH.exe e myh.exe piu' tre immagini bmp.
Se faccio la scansione con gmer mi da' quello che ti ho postato l'altro giorno........ cioe' sempre il file LxRT.exe (hidden) che poi non c'e'...... [boh]

, l'ho gia' fatta diverse volte.
Il McAfee non mi da niente di speciale..

da **ste_95** » gio mag 22, 2008 6:11 pm

In modalità provvisoria GMER rileva il file nascosto.

da **thread.net** » gio mag 22, 2008 6:39 pm

Si, me l'ha rilevato anche in modalita' provvisoria ed il log e' lo stesso della modalita' normale

da **ste_95** » gio mag 22, 2008 6:42 pm

Crea il MegaLabCD e fai il boot da quello all'avvio. Dopo che lo hai avviato apri il menù Start -> Programmi -> Gestione dati -> A43. Verifica se trovi il file segnalato come nascosto.

da **thread.net** » ven mag 23, 2008 4:45 pm

no, non c'e....
solo i file che ti ho gia' detto..

da **thread.net** » dom mag 25, 2008 11:36 am

Credo di aver risolto...

Ho cancellato alcuni files con estensione "exe" che mi ha segnalato Sophos
Antirootkit dopo di che ho ripulito il registro con McAfee Rootkit Detective .....

Infatti ora gmer non mi da piu' allarmi, anche se ieri sera alla prima scansione dopo aver ripulito mi ha segnalato in rosso lo stesso processo di gmer cioe', C:\Documents and Settings\Family\Desktop\gmer\gmer.exe ....strano eh?
non mi era mai capitato.

Vabe ' tanto stamattina non me l'ha piu' fatto...
Per ora credo di essere apposto.
Grazie a ste_95 ... dopo il tuo improvviso silenzio avevo gia' preso in mano il cd di ubuntu 7.1..........................

Ciao [^]

www.MegaLab.it

rootkit: LxRT.exe aiuto

rootkit: LxRT.exe aiuto

Chi c’è in linea