possibile bagle- connessione disattivata

[raimondoi.]

Salve, apro un nuovo post in quanto penso si tratti di un virus bagle (il post di riferimento diceva di aprirne uno nuovo in caso di un virus simile); i sintomi sono:

1 antivirus (Vshield) disattivato. NON sono invece disattivati gli antispywares con cui ho già eseguito scansioni

2 TRAGICO: la connessione ad internet wifi (uso una scheda di rete D-LInk) risulta disattivata nonostante funzioni perfettamente sugli altri computer collegati alla stessa rete (come quello da cui scrivo). Aprendo infatti la pagina delle connessioni senza fili esce scritto questo messaggio:

"Impossiible configurare la connessione senza fili. Se si è attivato un altro programma per la gestione della connessione senza fili, utilizzare quel programma. Se si preferisce che sia windows a configurare la connessione, avviare il servizio zero configuration reti senza fili. Per informazioni sul servizio, vedere l'articolo 871122 nella Microsoft Knowledge Base nel sitoweb Microsoft.com"

Seguo quanto scritto nel sito web:

Per avviare il servizio Zero Configuration reti senza fili, attenersi alla seguente procedura:
1. Fare clic sul pulsante Start, scegliere Esegui, digitare %SystemRoot%\system32\services.msc /s, quindi scegliere OK.
2. Fare doppio clic su Zero Configuration reti senza fili.
3. Nell'elenco Tipo di avvio scegliere Automatico, quindi Applica.
4. Nell'area Stato del servizio scegliere Avvia, quindi scegliere OK.

mi da pero' il seguente errore:"Impossibile avviare il servizio Zero Configuration reti senza fili su Computer locale. Erore 1068: Avvio del gruppo o del servizio di dipendenza non riuscito.
Il problema che non ho rete è grave in quanto non posso eseguire scansioni online.

Ho tuttavia eseguito la scansione con avenger (seguendo lo script che ho trovato nel post in evidenza circa i bagle) e questo è il resoconto:

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 2)
Fri Sep 12 14:18:54 2008

14:18:34: Error: Invalid registry syntax in command:
"HKCU\Software\Microsoft\Windows\CurrentVersion\Run|drvsyskit"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry value deletion mode)
14:18:50: Error: Invalid registry syntax in command:
"HKCU\Software\Microsoft\Windows\CurrentVersion\Run|german.exe"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry value deletion mode)
14:18:52: Error: Invalid registry syntax in command:
"HKCU\Software\DateTime4|port"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry value deletion mode)
14:18:53: Error: Invalid registry syntax in command:
"HKCU\Software\DateTime4|uid"
Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program.
Skipping line. (Registry value deletion mode)
14:18:54: Error: Execution aborted by user!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:


Error: file "C:\WINDOWS\system32\drivers\srosa.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\srosa.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\WINDOWS\system32\wintems.exe" not found!
Deletion of file "C:\WINDOWS\system32\wintems.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\windows\system32\drivers\hldrrr.exe" not found!
Deletion of file "C:\windows\system32\drivers\hldrrr.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\WINDOWS\system32\mdelk.exe" not found!
Deletion of file "C:\WINDOWS\system32\mdelk.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\WINDOWS\system32\drivers\mdelk.exe" not found!
Deletion of file "C:\WINDOWS\system32\drivers\mdelk.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\windows\system32\hldrrr.exe" not found!
Deletion of file "C:\windows\system32\hldrrr.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist

Folder "C:\WINDOWS\system32\drivers\downld" deleted successfully.

Error: folder "C:\Documents and Settings\Raimondo\Dati applicazioni\m" not found!
Deletion of folder "C:\Documents and Settings\Raimondo\Dati applicazioni\m" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\srosa" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\srosa" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Completed script processing.

*******************

Finished! Terminate.

ho eseguito anche quella con fxbeagle
risultato:


W32.Beagle, Trojan.Tooso have not been found on your computer.


Aiutatemi vi prego!!!

P.S. non sono molto pratico di computer quindi vi sarei grato se "parlasse" con un linguaggio che sia il più elementare possibile!!!!!

[CARON67]

Ciao raimondoi . Scusami della domanda , hai provato a fare una scansione totale del tuo PC , in modalita' provvisoria ( premere ripetutamente il tasto F8 all ' avvio del PC ) con il tuo Antivirus ??? Un mio parere personale , dopo , fai anche due scansioni ( sempre in modalita' provvisoria ) con Malwarebytes' Anti-Malware Free e con SuperAntiSpyWare Free . Poi , se vuoi , posti un Log di HJT ai Moderatori del Forum , cosi' avranno ed avrai una panoramica migliore del problema .

[raimondoi.]

Ciao raimondoi . Scusami della domanda , hai provato a fare una scansione totale del tuo PC , in modalita' provvisoria ( premere ripetutamente il tasto F8 all ' avvio del PC ) con il tuo Antivirus ??? Un mio parere personale , dopo , fai anche due scansioni ( sempre in modalita' provvisoria ) con Malwarebytes' Anti-Malware Free e con SuperAntiSpyWare Free . Poi , se vuoi , posti un Log di HJT ai Moderatori del Forum , cosi' avranno ed avrai una panoramica migliore del problema .

Con superantispyware già l'ho fatta (non in modalità provvisoria) invece cos'è HJT?? ne ho sentito molto parlare sul forum, dove lo scarico?

[CARON67]

Ciao . HJT e' la sigla di HijakThis e' lo puoi scaricare qui http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis , poi , se vuoi , prova a seguire la procedura che ti ho indicato nel topic precedente . Poi incolli , al finale di tutto il Log di HJT ai Moderatori del Forum , sul Post .

[raimondoi.]

ho eseguito la scansione con HJK e questo dovrebbe essere il risultato:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.40.29, on 12/09/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Spyware Doctor\pctsAuxs.exe
C:\Programmi\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
F3 - REG:win.ini: load=C:\DOCUME~1\Raimondo\IMPOST~1\Temp\logman.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {183F9DAE-C0B1-422C-8489-0C77AEAB522E} - C:\WINDOWS\system32\qoMdARKD.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programmi\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {CD912E69-1B5E-4B6D-B5C1-D34B5164F87B} - C:\WINDOWS\system32\vtUkIxvt.dll (file missing)
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [PTHOSTTR] C:\Programmi\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [WatchDog] C:\Programmi\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [H2O] C:\Programmi\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programmi\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [\YUR15.exe] C:\Windows\system32\YUR15.exe
O4 - HKLM\..\Run: [\YUR16.exe] C:\Windows\system32\YUR16.exe
O4 - HKLM\..\Run: [\YUR17.exe] C:\Windows\system32\YUR17.exe
O4 - HKLM\..\Run: [\YUR18.exe] C:\Windows\system32\YUR18.exe
O4 - HKLM\..\Run: [\YUR19.exe] C:\Windows\system32\YUR19.exe
O4 - HKLM\..\Run: [\YUR117.exe] C:\Windows\system32\YUR117.exe
O4 - HKLM\..\Run: [\YUR158.exe] C:\Windows\system32\YUR158.exe
O4 - HKLM\..\Run: [\YUR9.exe] C:\Windows\system32\YUR9.exe
O4 - HKLM\..\Run: [\YURA.exe] C:\Windows\system32\YURA.exe
O4 - HKLM\..\Run: [\YURB.exe] C:\Windows\system32\YURB.exe
O4 - HKLM\..\Run: [\YURC.exe] C:\Windows\system32\YURC.exe
O4 - HKLM\..\Run: [\YURD.exe] C:\Windows\system32\YURD.exe
O4 - HKLM\..\Run: [\YURF.exe] C:\Windows\system32\YURF.exe
O4 - HKLM\..\Run: [\YURE.exe] C:\Windows\system32\YURE.exe
O4 - HKLM\..\Run: [\YUR1DD.exe] C:\Windows\system32\YUR1DD.exe
O4 - HKLM\..\Run: [\YUR25A.exe] C:\Windows\system32\YUR25A.exe
O4 - HKLM\..\Run: [\YUR25C.exe] C:\Windows\system32\YUR25C.exe
O4 - HKLM\..\Run: [\YUR25D.exe] C:\Windows\system32\YUR25D.exe
O4 - HKLM\..\Run: [\YUR26.exe] C:\Windows\system32\YUR26.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISTray] "C:\Programmi\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [BM17136b71] Rundll32.exe "C:\WINDOWS\system32\kiuheoxl.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [mewqwkw] "c:\documents and settings\raimondo\impostazioni locali\dati applicazioni\mewqwkw.exe" mewqwkw
O4 - HKCU\..\Run: [\YUR15.exe] C:\Windows\system32\YUR15.exe
O4 - HKCU\..\Run: [\YUR16.exe] C:\Windows\system32\YUR16.exe
O4 - HKCU\..\Run: [\YUR17.exe] C:\Windows\system32\YUR17.exe
O4 - HKCU\..\Run: [\YUR18.exe] C:\Windows\system32\YUR18.exe
O4 - HKCU\..\Run: [\YUR19.exe] C:\Windows\system32\YUR19.exe
O4 - HKCU\..\Run: [\YUR117.exe] C:\Windows\system32\YUR117.exe
O4 - HKCU\..\Run: [\YUR158.exe] C:\Windows\system32\YUR158.exe
O4 - HKCU\..\Run: [\YUR9.exe] C:\Windows\system32\YUR9.exe
O4 - HKCU\..\Run: [\YURA.exe] C:\Windows\system32\YURA.exe
O4 - HKCU\..\Run: [\YURB.exe] C:\Windows\system32\YURB.exe
O4 - HKCU\..\Run: [\YURC.exe] C:\Windows\system32\YURC.exe
O4 - HKCU\..\Run: [\YURD.exe] C:\Windows\system32\YURD.exe
O4 - HKCU\..\Run: [\YURF.exe] C:\Windows\system32\YURF.exe
O4 - HKCU\..\Run: [\YURE.exe] C:\Windows\system32\YURE.exe
O4 - HKCU\..\Run: [\YUR1DD.exe] C:\Windows\system32\YUR1DD.exe
O4 - HKCU\..\Run: [\YUR25A.exe] C:\Windows\system32\YUR25A.exe
O4 - HKCU\..\Run: [\YUR25C.exe] C:\Windows\system32\YUR25C.exe
O4 - HKCU\..\Run: [\YUR25D.exe] C:\Windows\system32\YUR25D.exe
O4 - HKCU\..\Run: [\YUR26.exe] C:\Windows\system32\YUR26.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKLM\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\Raimondo\DATIAP~1\cisvc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\WINDOWS\System\logman.exe /waitservice
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Cisvc] C:\WINDOWS\cisvc.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Cisvc] C:\WINDOWS\cisvc.exe /waitservice (User 'Default user')
O4 - S-1-5-18 Startup: Bat - Auto Update.lnk = C:\Programmi\Bat\Bat.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Logitech . Registrazione prodotti.lnk = C:\Programmi\Logitech\QuickCam\eReg.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Zapu Acceleration Engine.lnk = C:\Programmi\Zapu\Zapu\wincm.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Zapu.lnk = C:\Programmi\Zapu\Zapu\wDivi.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Bat - Auto Update.lnk = C:\Programmi\Bat\Bat.exe (User 'Default user')
O4 - .DEFAULT Startup: Logitech . Registrazione prodotti.lnk = C:\Programmi\Logitech\QuickCam\eReg.exe (User 'Default user')
O4 - .DEFAULT Startup: Zapu Acceleration Engine.lnk = C:\Programmi\Zapu\Zapu\wincm.exe (User 'Default user')
O4 - .DEFAULT Startup: Zapu.lnk = C:\Programmi\Zapu\Zapu\wDivi.exe (User 'Default user')
O4 - Startup: Bat - Auto Update.lnk = C:\Programmi\Bat\Bat.exe
O4 - Startup: Logitech . Registrazione prodotti.lnk = C:\Programmi\Logitech\QuickCam\eReg.exe
O4 - Startup: Zapu Acceleration Engine.lnk = C:\Programmi\Zapu\Zapu\wincm.exe
O4 - Startup: Zapu.lnk = C:\Programmi\Zapu\Zapu\wDivi.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Programmi\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://raimondothebest.spaces.live.com/ ... nPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: awtqrrRh - awtqrrRh.dll (file missing)
O20 - Winlogon Notify: vtUkIxvt - vtUkIxvt.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Programmi\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Programmi\M-Audio Fast Track\GBInst.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\Shared\hpqwmi.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: MSSysInterv (MSSysInterv1) - Unknown owner - C:\WINDOWS\winself.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe

--
End of file - 11758 bytes

aspetto vst notizie, grazie

[Amantide]

Hai il trojan Vundo.
Fai la scansione con VundoFix, seguendo questo articolo e dopo riposta il nuovo log di Hijackthis.

[raimondoi.]

Ho eseguito la scansione con vundofix in modalità provvisoria ma alla fine non ha trovato nessun file infetto, che faccio??

[Amantide]

Fai la scansione con Malwarebytes' Anti-Malware ed allega qui il report.

Se non risolvi nemmeno con questo, allora continueremo con la rimozione manuale.

[raimondoi.]

scansione effettuata eccone il risultato:

Malwarebytes' Anti-Malware 1.28
Versione del database: 1134
Windows 5.1.2600 Service Pack 2

12/09/08 7.32.44
mbam-log-2008-09-12 (19-32-44).txt

Tipo di scansione: Scansione rapida
Elementi scansionati: 46821
Tempo trascorso: 16 minute(s), 31 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 13
Valori di registro infetti: 39
Elementi dato del registro infetti: 0
Cartelle infette: 6
File infetti: 37

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cd912e69-1b5e-4b6d-b5c1-d34b5164f87b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vtukixvt (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cd912e69-1b5e-4b6d-b5c1-d34b5164f87b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webmediaplayer (Adware.EGDAccess) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSysInterv1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Batco (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Bat (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Bat (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WebMediaPlayer.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.

Valori di registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur15.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur17.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur18.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur19.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur117.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur158.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1dd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25c.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25d.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur15.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur16.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur17.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur18.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur19.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur117.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur158.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur9.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1dd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25c.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25d.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm17136b71 (Trojan.Agent) -> Quarantined and deleted successfully.

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
C:\Programmi\WebMediaPlayer (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\resources (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\skins (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\updates (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\Bat (Adware.Batco) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.

File infetti:
C:\WINDOWS\system32\vtUkIxvt.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hhfuqndl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\Privacy Policy.url (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\sqlite3.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\Terms and conditions.url (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\uninst.exe (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\Website.url (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\resources\languages_v2.xml (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\resources\webmedias (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\WebMediaPlayer\skins\classic.skn (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Programmi\Bat\Bat.dll.intermediate.manifest (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\Bat.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\Bat.info (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\Bat.original (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\Info.dll (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\un_BatSetup_15041.txt (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\X_Bat.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\Bat\X_Bat.log (Adware.Batco) -> Quarantined and deleted successfully.
C:\Programmi\MSA\MSA.exe (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Programmi\MSA\msa0.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Programmi\MSA\msa1.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Programmi\MSA\MSA.cpl (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\Programmi\MSA\MSA.ooo (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MSa.cpl (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kiuheoxl.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\didduid.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\123messenger.per (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\WINDOWS\licencia.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\telefonos.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\textos.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM17136b71.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BM17136b71.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvs2.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Desktop\WebMediaPlayer.lnk (Adware.EGDAccess) -> Quarantined and deleted successfully.

p.s. amantide, comunque vada, grazie mille per il tuo aiuto!!!

[Amantide]

Ok, il Malwarebytes ha fatto il suo sporco lavoro
Le cose adesso come vanno?

Leggi qui come riattivare wireless, invece per quanto riguarda l'antivirus, mi sa che lo devi reinstallare daccapo.

Posta anche il nuovo log di Hijackthis.

[raimondoi.]

sei grande...ora la connessione è nuovamente attiva.
questo il risultato di hjk

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19.58.01, on 12/09/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Network Associates\VirusScan\Avsynmgr.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\M-Audio Fast Track\GBInst.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programmi\Spyware Doctor\pctsAuxs.exe
C:\Programmi\Spyware Doctor\pctsSvc.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmi\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Media Player\WMPNetwk.exe
C:\Programmi\Network Associates\VirusScan\VsStat.exe
C:\Programmi\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\Raimondo\DATIAP~1\cisvc.exe
C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmi\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\Spyware Doctor\pctsTray.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programmi\Java\jre1.5.0\bin\jusched.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programmi\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\D-Link AirPlus\AirPlus.exe
C:\Programmi\Zapu\Zapu\wincm.exe
C:\Programmi\Zapu\Zapu\wDivi.exe
C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
F3 - REG:win.ini: load=C:\DOCUME~1\Raimondo\IMPOST~1\Temp\logman.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {183F9DAE-C0B1-422C-8489-0C77AEAB522E} - C:\WINDOWS\system32\qoMdARKD.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programmi\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Programmi\Share_Accelerator_MM\tbShar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programmi\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [PTHOSTTR] C:\Programmi\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Cpqset] C:\Programmi\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Programmi\File comuni\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Programmi\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [WatchDog] C:\Programmi\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [H2O] C:\Programmi\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Programmi\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programmi\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISTray] "C:\Programmi\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [mewqwkw] "c:\documents and settings\raimondo\impostazioni locali\dati applicazioni\mewqwkw.exe" mewqwkw
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programmi\Windows Media Player\WMPNSCFG.exe
O4 - HKLM\..\Policies\Explorer\Run: [Cisvc] C:\DOCUME~1\Raimondo\DATIAP~1\cisvc.exe /waitservice
O4 - HKCU\..\Policies\Explorer\Run: [Logman] C:\WINDOWS\System\logman.exe /waitservice
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [Cisvc] C:\WINDOWS\cisvc.exe /waitservice (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [Cisvc] C:\WINDOWS\cisvc.exe /waitservice (User 'Default user')
O4 - S-1-5-18 Startup: Bat - Auto Update.lnk = C:\Programmi\Bat\Bat.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Logitech . Registrazione prodotti.lnk = C:\Programmi\Logitech\QuickCam\eReg.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Zapu Acceleration Engine.lnk = C:\Programmi\Zapu\Zapu\wincm.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Zapu.lnk = C:\Programmi\Zapu\Zapu\wDivi.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Bat - Auto Update.lnk = C:\Programmi\Bat\Bat.exe (User 'Default user')
O4 - .DEFAULT Startup: Logitech . Registrazione prodotti.lnk = C:\Programmi\Logitech\QuickCam\eReg.exe (User 'Default user')
O4 - .DEFAULT Startup: Zapu Acceleration Engine.lnk = C:\Programmi\Zapu\Zapu\wincm.exe (User 'Default user')
O4 - .DEFAULT Startup: Zapu.lnk = C:\Programmi\Zapu\Zapu\wDivi.exe (User 'Default user')
O4 - Startup: Bat - Auto Update.lnk = C:\Programmi\Bat\Bat.exe
O4 - Startup: Logitech . Registrazione prodotti.lnk = C:\Programmi\Logitech\QuickCam\eReg.exe
O4 - Startup: Zapu Acceleration Engine.lnk = C:\Programmi\Zapu\Zapu\wincm.exe
O4 - Startup: Zapu.lnk = C:\Programmi\Zapu\Zapu\wDivi.exe
O4 - Global Startup: D-Link AirPlus.lnk = ?
O4 - Global Startup: DVD Check.lnk = C:\Programmi\InterVideo\DVD Check\DVDCheck.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://raimondothebest.spaces.live.com/ ... nPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmi\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: awtqrrRh - awtqrrRh.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Programmi\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: Fast Track Installer (FastTrackInstallerService) - Nemesis - C:\Programmi\M-Audio Fast Track\GBInst.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Programmi\HPQ\Shared\hpqwmi.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programmi\File comuni\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programmi\Spyware Terminator\sp_rsser.exe

--
End of file - 11029 bytes

non so davvero come ringraziarti.

P.S. dove posso andare per vedere tutti i programmi che si attivano all'avvio del computer?? e magari eliminarne pure qualcuno...

[Amantide]

P.S. dove posso andare per vedere tutti i programmi che si attivano all'avvio del computer?? e magari eliminarne pure qualcuno...

Sono le voci O4 nel Hijackthis, devi spuntare i programmi che non vuoi che partono all'avvio e cliccare su Fix.

Nel log si vedono ancora un bel po' di schifezze e, prima di farteli eliminare manualmente, vorrei che eseguissi la scansione anche con ComboFix (Il link si trova nello stesso articolo su Vundo).
Alla fine postami sia il log di ComboFix che quello nuovo di Hijackthis.

[TheHacker66]

Volendo per avere una cosa più chiara ed ordinata di HijackThis puoi andare in Start -> Esegui e digitare msconfig. Poi vai nella scheda Avvio e lì ci sono i programmi che partono all'avvio. Fai come ti è più comodo..

[raimondoi.]

ciao amantide,

In questo periodo sono stato fuori quindi non ho letto il tuo mess. comunque ora posto il risultato delle scansioni che mi hai consigliato anche perché quel problema non si pone più però ce ne sono altri sopratutto all'avvio (a volte si blocca explorer, volte si blocca tutto il computer e devo resettare....)!!!!

[Amantide]

anche perché quel problema non si pone più però ce ne sono altri sopratutto all'avvio (a volte si blocca explorer, volte si blocca tutto il computer e devo resettare....)!!!!

E ci credo!!! Ci sono ancora almeno una decina di file infetti tra quelli che si vedono solo nel log, non oso nemmeno immaginare quanti ci ne sono ancora di quelli non visibili.

[raimondoi.]

combofix mi si chiude all'avvio e non riesco a fare la scansione.

Questo è il risultto di quella con HJK:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16.32.48, on 15/09/08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\Bonjour\mDNSResponder.exe
C:\Programmi\M-Audio Fast Track\GBInst.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\File comuni\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programmi\Spyware Doctor\pctsAuxs.exe
C:\Programmi\Spyware Doctor\pctsSvc.exe
C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Media Player\WMPNetwk.exe
C:\Programmi\Spyware Doctor\pctsTray.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\File comuni\LogiShrd\LVCOMSER\LVComSer.exe
C:\Programmi\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmi\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programmi\HPQ\Quick Launch Buttons\EabServr.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programmi\Java\jre1.5.0\bin\jusched.exe
C:\DOCUME~1\Raimondo\IMPOST~1\Temp\logman.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\Programmi\File comuni\Real\Update_OB\realsched.exe
C:\Programmi\SyncroSoft\Pos\H2O\cledx.exe
C:\Programmi\File comuni\LogiShrd\LComMgr\Communications_Helper.exe
C:\Programmi\Logitech\QuickCam\Quickcam.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\D-Link AirPlus\AirPlus.exe
C:\Programmi\File comuni\Logishrd\LQCVFX\COCIManager.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\Programmi\Windows Media Player\wmplayer.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\File comuni\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmi\Windows Live\Messenger\msnmsgr.exe
C:\Programmi\Windows Live\Messenger\usnsvc.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmi\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 2761 bytes

[Amantide]

Ok, facciamo così.
Riscarica il file su desktop e rinominalo in qwerty.exe
Ora disconnettiti da internet e vai su Start--> Esegui, incolla nello spazio bianco questa stringa e premi Ok:

Codice: Seleziona tutto

"%userprofile%\desktop\qwerty.exe" /killall

Fammi sapere se in questo modo ComboFix si avvierà.

Dopo vai su Start--> Esegui ed apri il registro di sistema digitando

Codice: Seleziona tutto

regedit

Espandendo le "cartelle" vedi se esiste la chiave

Codice: Seleziona tutto

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Se la trovi, cliccaci sopra ed annota i dati (il percorso di un file) che saranno indicati nella scheda a destra.

[raimondoi.]

Ok, facciamo così.
Riscarica il file su desktop e rinominalo in qwerty.exe
Ora disconnettiti da internet e vai su Start--> Esegui, incolla nello spazio bianco questa stringa e premi Ok:

Codice: Seleziona tutto

"%userprofile%\desktop\qwerty.exe" /killall

Fammi sapere se in questo modo ComboFix si avvierà.

Dopo vai su Start--> Esegui ed apri il registro di sistema digitando

Codice: Seleziona tutto

regedit

Espandendo le "cartelle" vedi se esiste la chiave

Codice: Seleziona tutto

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Se la trovi, cliccaci sopra ed annota i dati (il percorso di un file) che saranno indicati nella scheda a destra.

per quanto riguarda l prima operazione continua a non aprirmelo

per quanto riguarda la seconda la cartella non è presente nell'elenco in Image File Execution Options

[Demon@]

Elimina combofix
- Start
- Esegui
- nella casella copia ed incolla questo comando: combofix /u
premi invio

Scaricalo nuovamente
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[Amantide]

Intanto proviamo ad eliminare i file infetti ricavati dal log di Hijackthis.

Scarica The Avenger, estrai archivio ed avvia il file Avenger.exe.
Seleziona l'opzione Input Script Manually, clicca sulla lente di ingrandimento e all'interno della finestra che si apre copia ed incolla questo script:

Codice: Seleziona tutto

Files to delete:
C:\DOCUME~1\Raimondo\DATIAP~1\cisvc.exe
C:\DOCUME~1\Raimondo\IMPOST~1\Temp\logman.exe
C:\WINDOWS\system32\qoMdARKD.dll
c:\documents and settings\raimondo\impostazioni locali\dati applicazioni\mewqwkw.exe
C:\WINDOWS\System\logman.exe
C:\WINDOWS\cisvc.exe


Dopodichè clicca sul pulsante Done, poi 2 volte sull'icona del semaforo verde e rispondi alle successive domande Si .
Il pc dovrebbe riavviarsi da solo,se cosi non fosse riavvialo manualmente.
Alla fine allegami il log di Avenger che si trova in C:/avenger.txt

Ah, il secondo log di Hijackthis non è completo, mi servirebbe un altro.

Poi scarica CurIt Dr.Web e vedi se riesci a procurarmi il report della scansione (Express Scan), possibilmente dalla modalità provvisoria, sempre se non è stata disabilitata.
Controlla anche se in modalità provvisoria funziona anche ComboFix.