Spero di non disturbarvi...

[zigiggi]

Sciao beli.
Come da titolo spero che quello che vi mostro non vi faccia scervellare per risolverlo.
E' da un paio di settimane che il mio computer mi sembra lento,così ho fatto uno scan con Kaspersky e poi un paio di Hijackthis.
Si,un paio perché già il primo mi aveva dato un paio di voci sospette.
Potreste buttarmici un occhio?
Ecco il log di Kaspersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, October 6, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, October 06, 2008 01:33:37
Records in database: 1293893
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 86019
Threat name: 4
Infected objects: 15
Suspicious objects: 0
Duration of the scan: 13:28:14


File name / Threat name / Threats count
C:\Programmi\UltraVNC\WinVNC.exe/C:\Programmi\UltraVNC\WinVNC.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\2\4ce0d702-18e45968 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\27\595587db-391a0b55 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\42\957ffea-6669f652 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\45\7531f2ad-55d89194 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\47\107b36ef-1e37cb93 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\7\25b73987-47f8bfd6 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\9\69cb33c9-2b7e7d4d Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Programmi\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\Programmi\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
D:\Programmi\Utility internet\SetupRevelationV2.exe Infected: not-a-virus:PSWTool.Win32.SnadBoy.2011 2
D:\Programmi\Utility varie\UltraVNC-102-Setup.zip Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 2
D:\Programmi\Utility varie\UltraVNC-102-Setup.zip Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1

The selected area was scanned.

Ed ecco quello di Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 20.05.55, on 06/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmi\FreePOPs\freepopsservice.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\UltraVNC\WinVNC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Spamihilator\spamihilator.exe
C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\FreePOPs\freepopsd.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programmi\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\Programmi\r2 studios\HideOE\HideOE.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programmi\Anti virus-aware\Efficienza Computer\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer der Catenella
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmi\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Spamihilator] "C:\Programmi\Spamihilator\spamihilator.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programmi\File comuni\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programmi\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\FILECO~1\TEKNUM~1\update.exe /startup
O4 - Startup: FreePOPs.lnk = C:\Programmi\FreePOPs\freepopsd.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Programmi\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Inserisci blog - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Inserisci &blog in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programmi\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: IE HTTPAnalyzer V3 - {3B28142E-6D05-47AB-A263-0556C785EBB4} - C:\Programmi\IEInspector\HTTPAnalyzerFullV3\IEHTTPAnalyzerV3.dll
O9 - Extra 'Tools' menuitem: IE HTTPAnalyzer V3 - {3B28142E-6D05-47AB-A263-0556C785EBB4} - C:\Programmi\IEInspector\HTTPAnalyzerFullV3\IEHTTPAnalyzerV3.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O11 - Options group: [TABS] Tabbed Browsing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp04.photoprintit.de/microsite/ ... loader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - (no file)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programmi\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programmi\File comuni\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FreePOPs - Unknown owner - C:\Programmi\FreePOPs\freepopsservice.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Programmi\File comuni\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\UltraVNC\WinVNC.exe" -service (file missing)

Grazie.
Bèèèèlla.

[Amantide]

I file infetti e quindi da eliminare sarebbero questi:

Codice: Seleziona tutto

C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\2\4ce0d702-18e45968 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\27\595587db-391a0b55 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\42\957ffea-6669f652 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\45\7531f2ad-55d89194 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\47\107b36ef-1e37cb93 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\7\25b73987-47f8bfd6 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\catenella\Dati applicazioni\Sun\Java\Deployment\cache\6.0\9\69cb33c9-2b7e7d4d Infected: Trojan-Downloader.Java.OpenConnection.aq 1

Per sicurezza fai anche la scansione con Malwarebytes' Anti-Malware ed aggiorna Java all'ultima versione.

[zigiggi]

Grassssie!
Però perdona un momento l'aerofagia della mia corteccia neurale:con cosa li elimino?
Sarà il sonno ma non mi viene in mente.
Bèèèèlla.

[Ettword]

quanto segnalato sopra è da cavare con l'antivirus..

io intanto ti segnalo anche alcune cosette che dovresti cavare via hijackthis:

O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe

[Amantide]

Per visualizzare questi file devi prima abilitare la visualizzazione dei file nascosti dalle Opzioni cartella e per eliminarli puoi usare Unlocker nel caso risultassero bloccati da qualche applicazione.

edit:

io intanto ti segnalo anche alcune cosette che dovresti cavare via hijackthis:

O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe

Sono alquanto innocui.

[zigiggi]

Sciao belo.
Allora ho già passato l'Hijack ed ho cancellato i file manualmente.
Faccio un giro di Antivir o vado do Kasper?
Bèèèèlla e grazie.

[Amantide]

Fai la scansione con Antivir, tanto Kaspersky online non ti troverà nulla di nuovo e non può nemmeno eliminare i file trovati.
Fai atenzione però ad escludere UltraVNC, altrimenti rischi di ritrovarti con il programma non funzionante.

[zigiggi]

Sciao bela.
GRazie mille,farò così e ti farò sapere.
Bèèèèlla.

[zigiggi]

Sciao beli.
Ho fatto una scansione con antivir ma niente,nella cartella dove mi indicava Kaspersky non mi ha trovato niente .
Intanto allego l'ultimo log di Kaspersky e fiducioso attendo notizie.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, October 7, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, October 07, 2008 07:09:36
Records in database: 1296706
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 85921
Threat name: 4
Infected objects: 15
Suspicious objects: 0
Duration of the scan: 04:03:27


File name / Threat name / Threats count
C:\Programmi\UltraVNC\WinVNC.exe/C:\Programmi\UltraVNC\WinVNC.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\Programmi\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\Programmi\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc44 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc45 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc46 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc47 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc48 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc49 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\RECYCLER\S-1-5-21-527237240-842925246-682003330-500\Dc50 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
D:\Programmi\Utility internet\SetupRevelationV2.exe Infected: not-a-virus:PSWTool.Win32.SnadBoy.2011 2
D:\Programmi\Utility varie\UltraVNC-102-Setup.zip Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 2
D:\Programmi\Utility varie\UltraVNC-102-Setup.zip Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1

The selected area was scanned.

Bèèèèlla.

[TheHacker66]

quanto segnalato sopra è da cavare con l'antivirus..

io intanto ti segnalo anche alcune cosette che dovresti cavare via hijackthis:

O10 - Unknown file in Winsock LSP: c:\programmi\bonjour\mdnsnsp.dll
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe

Questo viene usato da Itunes, non è nocivo.

[Amantide]

Sciao beli.
Ho fatto una scansione con antivir ma niente,nella cartella dove mi indicava Kaspersky non mi ha trovato niente .
Intanto allego l'ultimo log di Kaspersky e fiducioso attendo notizie.

Vedo che hai provveduto ad eliminare manualmente i file infetti, infatti ora si trovano nel cestino.
Provvedi ad aggiornare Java ad ultima versione, per il resto il pc è pulito.

[zigiggi]

Sciao bela.
Grazie mille per l'aiuto.
E cma sappi che sul portatile avevo una cosa simile ed ho fatto allo stesso modo...senza scassare qui .
Bèèèèlla.