www.MegaLab.it

da **crax56** » dom nov 16, 2008 10:41 am

C'è qualcosa nel mio computer che mi cambia la home page dicendomi che nel mio computer c'è un virus, ma il virus è lui stesso.Vi posto il file log come per le pagine che si aprivano da sole.Se non serve mi dite per piacere cosa altro fare? [grazie]

Siete magnifici! [applauso+]

[Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10.41.23, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\WebMediaViewer\qttask.exe
C:\Programmi\WebMediaViewer\hpmon.exe
C:\Programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\Programmi\Multimedia Card Reader\shwicon2k.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Conitech\WLAN\DAKOTA_Utility.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Programmi\WebMediaViewer\qttaskm.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Programmi\WebMediaViewer\hpmom.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programmi\Conitech\WLAN\WBSECSVC.EXE
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
D:\file scaricati\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Programmi\WebMediaViewer\hpmun.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: ilcorsaronero Toolbar - {f4035115-6152-4901-a81d-f4e0a0479615} - C:\Programmi\ilcorsaronero\tbilco.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: ilcorsaronero Toolbar - {f4035115-6152-4901-a81d-f4e0a0479615} - C:\Programmi\ilcorsaronero\tbilco.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programmi\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [StartCCC] C:\Programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Sunkist2k] C:\Programmi\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S93.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [DAKOTA_Utility] C:\Programmi\Conitech\WLAN\DAKOTA_Utility.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Programmi\uTorrent\uTorrent.exe"
O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Programmi\WebMediaViewer\qttask.exe
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Programmi\WebMediaViewer\hpmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game09.zylom.com/activex/zylomgamesplayer.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: wbsecsvc - Winbond - C:\Programmi\Conitech\WLAN\WBSECSVC.EXE

--
End of file - 8780 bytes

da **Bug2.0** » dom nov 16, 2008 10:50 am

Il malware che ti ha infettato il computer è un rouge.
Per questi casi, è utile usare in semplice programma free RougeRemover
Dopo averlo scaricato, dicci se la stuazione è migliorata!!! [^]

da **crazy.cat** » dom nov 16, 2008 10:56 am

Hai scaricato qualche codec per visualizzare qualche presunto video?
Mi sembra che somigli tanto a questo
http://www.prevx.com/blog.asp

Con hijackthis rifai la scansione e rimuovi queste righe.
O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Programmi\WebMediaViewer\hpmun.dll
O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Programmi\WebMediaViewer\qttask.exe
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Programmi\WebMediaViewer\hpmon.exe
però non basta a rimuovere tutta l'infezione, quindi consiglio scansione con Superantispyware o malwarebytes .

da **Bug2.0** » dom nov 16, 2008 11:21 am

Mi chiedo che hompage gli è stata messa.
Se una di quelle che dice prevx o una di certi falsi antivirus... [uhm]

da **crax56** » lun nov 17, 2008 5:39 pm

Ho usato il programma consigliatomi da Bug ma non si è risolto niente cosi come non si è risolta cancellando le righe dal file log

Dove trovo i programmi consigliatomi per la scansione (super spyware ecc)?

da **crazy.cat** » lun nov 17, 2008 5:48 pm

http://www.superantispyware.com/superan ... vspro.html Super antispyware
http://www.malwarebytes.org/mbam.php Malwarebytes

da **Bug2.0** » lun nov 17, 2008 5:58 pm

Advanced Antivirus è falso anti-spyware. Come altri software di truffa, avanzata antivirus si apre falsi avvisi di sicurezza per cercare di trucco è in avanzata Antivirus acquisto per $ 34.95-79.95. Advanced Antivirus può essere scaricato sul vostro stesso computer attraverso un trojan, come Zlob. Advanced Antivirus può avviare quando si avvia Windows, e antivirus avanzata maggio popup tonnellate di annunci che sono difficili da chiudere.

Per eliminare questo malware, ti consiglio di scaricare l versione di prova di SpyHunter
Dimmi poi se è stato eliminato!!!

da **crax56** » lun nov 17, 2008 6:50 pm

Graze a tutti ma non ho risolto con i programmi consigliatomi .Dovrò formattare.Poco male se il malaware è come al solito nel sistema operativo,perché l'ho installato in una partizione a parte.Comunque [grazie]

x 1000 per la disponibilità. [ciao]

da **Max01** » lun nov 17, 2008 8:16 pm

Bug2.0 ha scritto:Per eliminare questo malware, ti consiglio di scaricare l versione di prova di SpyHunter
Dimmi poi se è stato eliminato!!!

Non con SpyHunter però, che è un altro rogue program.

crax56 ha scritto:Graze a tutti ma non ho risolto con i programmi consigliatomi .Dovrò formattare.Poco male se il malaware è come al solito nel sistema operativo,perché l'ho installato in una partizione a parte.Comunque x 1000 per la disponibilità.

Prima di formattare prova anche con altri programmi: ad esempio Avira premium.

da **crax56** » lun nov 17, 2008 9:02 pm

Non mi è scomparso neanche con Avira Premium.Solo SpyHunter (versione di prova)mi rileva "Zlob.troyan" nel registro ma con la versione di prova non posso cancellarlo.Nessuna altra idea? [cry]

da **Amantide** » lun nov 17, 2008 9:13 pm

Scarica ComboFix ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto.

da **crax56** » lun nov 17, 2008 9:29 pm

ComboFix 08-11-16.05 - aaa 2008-11-17 21.25.23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.1455 [GMT 1:00]
Eseguito da: d:\file scaricati\ComboFix.exe
* Creato nuovo punto di ripristino

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\aaa\Documenti\My Documents.url
c:\documents and settings\aaa\Impostazioni locali\Dati applicazioni\wokae_nav.dat
c:\documents and settings\aaa\Impostazioni locali\Dati applicazioni\wokae_navps.dat
I:\Autorun.inf

.
((((((((((((((((((((((((( Files Creati Da 2008-10-17 al 2008-11-17 )))))))))))))))))))))))))))))))))))
.

2008-11-17 20:54 . 2008-11-17 20:54 <DIR> d-------- c:\programmi\Avira
2008-11-17 20:54 . 2008-11-17 20:54 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Avira
2008-11-17 20:36 . 2008-11-17 20:36 <DIR> d-------- c:\programmi\MCS Studios
2008-11-17 20:36 . 2000-05-22 19:58 608,448 --a------ c:\windows\system32\comctl32.ocx
2008-11-17 20:36 . 2005-12-14 22:16 237,568 --a------ c:\windows\system32\mcstabs.ocx
2008-11-17 20:36 . 2006-02-07 13:02 152,848 --a------ c:\windows\system32\comdlg32.ocx
2008-11-17 20:36 . 2000-07-15 00:00 101,888 --a------ c:\windows\system32\VB6STKIT.DLL
2008-11-17 20:36 . 1998-06-18 00:00 89,360 --a------ c:\windows\system32\VB5DB.DLL
2008-11-17 20:18 . 2008-11-17 20:18 <DIR> d-------- c:\programmi\Enigma Software Group
2008-11-17 17:55 . 2008-11-17 17:55 <DIR> d-------- c:\programmi\SUPERAntiSpyware
2008-11-17 17:55 . 2008-11-17 17:55 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\SUPERAntiSpyware.com
2008-11-17 17:55 . 2008-11-17 17:55 <DIR> d-------- c:\documents and settings\aaa\Dati applicazioni\SUPERAntiSpyware.com
2008-11-17 17:54 . 2008-11-17 17:54 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2008-11-17 17:53 . 2008-11-17 17:53 <DIR> d-------- c:\programmi\Malwarebytes' Anti-Malware
2008-11-17 17:53 . 2008-11-17 17:53 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2008-11-17 17:53 . 2008-11-17 17:53 <DIR> d-------- c:\documents and settings\aaa\Dati applicazioni\Malwarebytes
2008-11-17 17:53 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-17 17:53 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-17 17:17 . 2008-11-17 17:17 <DIR> d-------- c:\programmi\RogueRemover FREE
2008-11-14 17:15 . 2008-11-16 10:28 <DIR> d-------- c:\programmi\ATS2
2008-11-14 15:34 . 2008-11-14 15:59 <DIR> d-------- c:\programmi\Yahoo!
2008-11-14 15:34 . 2008-11-14 15:57 <DIR> d-------- c:\programmi\DivX
2008-11-14 15:34 . 2008-11-14 15:34 <DIR> d-------- c:\documents and settings\aaa\Dati applicazioni\Yahoo!
2008-11-14 15:10 . 2008-11-17 20:55 <DIR> d-------- c:\programmi\WebMediaViewer
2008-11-13 02:24 . 2008-09-04 18:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-13 02:24 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 17:02 . 2008-11-12 17:02 <DIR> d-------- c:\windows\system32\config\systemprofile\Dati applicazioni\ATI
2008-11-12 17:02 . 2008-11-12 17:02 4,096 --a------ c:\windows\system32\crash
2008-11-11 18:13 . 2005-05-03 11:43 69,632 -r------- c:\windows\Alcmtr.exe
2008-11-10 18:12 . 2008-11-11 17:07 <DIR> d-------- c:\programmi\vanBasco's Karaoke Player
2008-11-09 11:05 . 2008-11-09 11:06 <DIR> d-------- c:\programmi\7 Wonders Treasures Of Seven
2008-11-09 10:51 . 2008-11-09 10:55 <DIR> d-------- c:\programmi\Jewel Quest Mysteries
2008-11-08 17:45 . 2008-11-16 10:28 <DIR> d-------- c:\documents and settings\aaa\Dati applicazioni\Zylom
2008-11-08 17:44 . 2008-11-16 10:49 <DIR> d-------- c:\programmi\Zylom Games
2008-11-08 17:42 . 2008-11-08 17:43 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Zylom
2008-11-06 20:39 . 2008-11-06 20:39 4,096 --a------ c:\windows\d3dx.dat
2008-11-06 19:11 . 2008-11-06 19:11 <DIR> d--hs---- c:\windows\ftpcache
2008-11-04 23:16 . 2008-11-04 23:16 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\MumboJumbo
2008-11-04 18:19 . 2008-11-08 17:30 <DIR> d-a------ c:\documents and settings\All Users\Dati applicazioni\TEMP
2008-11-04 18:18 . 2008-11-08 17:37 <DIR> d-------- c:\programmi\Oberon Media
2008-11-04 18:18 . 2008-11-08 17:36 <DIR> d-------- c:\programmi\File comuni\Oberon Media
2008-10-29 20:22 . 2008-10-29 20:22 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Activision
2008-10-29 20:22 . 2008-10-29 20:22 <DIR> d-------- c:\documents and settings\aaa\Dati applicazioni\Activision
2008-10-29 20:21 . 2008-10-29 20:21 <DIR> d-------- c:\windows\Logs
2008-10-29 20:15 . 2008-10-29 20:15 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-10-24 16:38 . 2008-10-15 17:36 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-10-23 02:00 . 2008-10-23 02:00 <DIR> d-------- c:\programmi\MSXML 4.0
2008-10-22 19:13 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-10-22 19:12 . 2008-08-14 14:22 2,192,896 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-22 19:12 . 2008-08-14 14:22 2,148,864 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-22 19:12 . 2008-08-14 14:22 2,069,760 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-22 19:12 . 2008-08-14 14:22 2,027,520 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-22 19:12 . 2008-09-15 16:24 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-22 19:12 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-22 19:12 . 2008-06-14 18:32 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-10-22 16:05 . 2008-05-01 15:34 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-10-22 16:04 . 2008-04-11 20:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-10-21 16:57 . 2008-10-21 16:57 79,085 --a------ c:\windows\system32\jegveefakk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-17 19:09 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\uTorrent
2008-11-17 17:18 --------- d-----w c:\programmi\ilcorsaronero
2008-11-16 12:26 --------- d-----w c:\programmi\Ricochet Infinity
2008-11-14 15:01 --------- d-----w c:\programmi\Spybot - Search & Destroy
2008-11-14 15:00 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-11-11 17:13 --------- d-----w c:\programmi\Realtek
2008-11-09 09:52 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\iWin
2008-10-31 09:29 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 15:58 --------- d-----w c:\programmi\7 Wonders II
2008-10-15 21:18 64,671 ----a-w c:\windows\BricoPackUninst.cmd
2008-10-15 21:18 6,110 ----a-w c:\windows\BricoPackFoldersDelete.cmd
2008-10-15 21:18 219,648 ----a-w c:\windows\system32\uxtheme.dll
2008-10-09 17:49 --------- d-----w c:\programmi\Conitech
2008-10-04 13:40 --------- d-----w c:\programmi\Sierra On-Line
2008-10-03 21:38 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\DigitalChocolate
2008-10-03 14:39 --------- d-----w c:\programmi\Electronic Arts
2008-10-03 07:36 --------- d-----w c:\programmi\epson
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-29 10:52 --------- d-----w c:\programmi\Full Tilt Poker
2008-09-28 20:59 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\Ahead
2008-09-28 20:57 --------- d-----w c:\programmi\File comuni\Ahead
2008-09-28 20:56 --------- d-----w c:\programmi\Nero
2008-09-28 20:48 40,960 ----a-w c:\windows\system32\xa46525265.exe
2008-09-28 20:48 40,960 ----a-w c:\windows\system32\xa46525046.exe
2008-09-28 10:31 --------- d-----w c:\programmi\ReflexiveArcade
2008-09-27 20:02 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\AdobeUM
2008-09-25 20:12 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\vlc
2008-09-25 15:55 --------- d-----w c:\programmi\Multimedia Card Reader
2008-09-25 15:53 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Nero
2008-09-24 16:02 --------- d-----w c:\programmi\Conduit
2008-09-23 19:31 --------- d-----w c:\programmi\Java
2008-09-23 19:31 --------- d-----w c:\programmi\File comuni\Java
2008-09-23 18:46 --------- d-----w c:\programmi\TeaTimer (Spybot - Search & Destroy)
2008-09-23 18:39 --------- d-----w c:\programmi\xp-AntiSpy
2008-09-23 18:38 --------- d-----w c:\programmi\Alwil Software
2008-09-23 18:36 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Avg8
2008-09-23 18:22 --------- d-----w c:\programmi\uTorrent
2008-09-23 17:53 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\Nero
2008-09-23 17:02 --------- d-----w c:\programmi\File comuni\Adobe
2008-09-23 16:50 --------- d-----w c:\programmi\AVG
2008-09-23 16:32 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\ATI
2008-09-23 16:32 --------- d-----w c:\documents and settings\aaa\Dati applicazioni\ATI
2008-09-23 16:30 --------- d-----w c:\programmi\ATI Technologies
2008-09-23 16:27 --------- d-----w c:\programmi\File comuni\InstallShield
2008-09-23 16:27 --------- d-----w c:\programmi\File comuni\ATI Technologies
2008-09-23 16:20 315,392 ----a-w c:\windows\HideWin.exe
2008-09-23 16:12 --------- d-----w c:\programmi\DIFX
2008-09-23 16:08 --------- d-----w c:\programmi\VideoLAN
2008-09-23 16:03 --------- d-----w c:\programmi\microsoft frontpage
2008-09-23 16:01 --------- d-----w c:\programmi\Servizi in linea
2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll
2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll
2008-09-15 15:24 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-22 01:08 869,376 ----a-w c:\windows\system32\wininet.dll
2008-08-22 01:08 43,008 ----a-w c:\windows\system32\licmgr10.dll
2008-08-22 01:06 72,704 ----a-w c:\windows\system32\admparse.dll
2008-08-22 01:06 71,680 ----a-w c:\windows\system32\iesetup.dll
2008-08-22 01:06 434,176 ----a-w c:\windows\system32\vbscript.dll
2008-08-22 01:05 48,640 ------w c:\windows\system32\PrivacIE.dll
2008-08-22 01:05 48,128 ----a-w c:\windows\system32\mshtmler.dll
2008-08-22 01:05 35,840 ----a-w c:\windows\system32\imgutil.dll
2008-08-22 01:04 45,568 ----a-w c:\windows\system32\mshta.exe
2008-08-22 00:57 156,160 ----a-w c:\windows\system32\msls31.dll
.

------- Sigcheck -------

2004-08-19 14:39 658944 27966534a0820cd3bd988bd1517c8ff2 c:\windows\ie7\wininet.dll
2006-11-07 20:03 818688 92995334f993e6e49c25c6d02ec04401 c:\windows\ie8\wininet.dll
2008-08-22 02:08 869376 f921f8c0bf1e6e83cba3227d8a86d06a c:\windows\ServicePackFiles\i386\wininet.dll
2008-08-22 02:08 869376 f921f8c0bf1e6e83cba3227d8a86d06a c:\windows\system32\wininet.dll
2008-08-22 02:08 878592 df1cb456ed1e038b276123365a1a93c4 c:\windows\system32\dllcache\wininet.dll

2008-04-13 18:14 978432 3d46c53ca961c49272037f98807537bd c:\windows\explorer.exe
2004-08-19 14:39 1034752 178d42bd8fc34a9837417a6ce1d6bb7b c:\windows\$NtServicePackUninstall$\explorer.exe
2008-04-13 18:14 978432 3d46c53ca961c49272037f98807537bd c:\windows\ServicePackFiles\i386\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
2008-11-17 18:39 30381 --a------ c:\programmi\WebMediaViewer\hpmun.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"uTorrent"="c:\programmi\uTorrent\uTorrent.exe" [2008-10-08 270128]
"SUPERAntiSpyware"="c:\programmi\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"Acrobat Assistant 7.0"="c:\programmi\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"SunJavaUpdateSched"="c:\programmi\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Sunkist2k"="c:\programmi\Multimedia Card Reader\shwicon2k.exe" [2004-09-03 139264]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-12 81000]
"DAKOTA_Utility"="c:\programmi\Conitech\WLAN\DAKOTA_Utility.exe" [2006-09-01 958976]
"SpyHunter"="c:\programmi\Enigma Software Group\SpyHunter\SpyHunter.exe" [2007-04-26 2693248]
"avgnt"="c:\programmi\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-06-12 266497]
"SkyTel"="SkyTel.EXE" [2007-06-15 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\aaa\Menu Avvio\Programmi\Esecuzione automatica\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe [2008-09-23 25214]
Adobe Reader Speed Launch.lnk - c:\programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programmi\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\programmi\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-03 110160]
R1 wbsecdrv;wbsecdrv Protocol Driver;c:\windows\system32\DRIVERS\wbsecdrv.sys [2008-10-09 17952]
R2 AntiVirMailService;Avira AntiVir Premium MailGuard;"c:\programmi\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-11-17 164097]
R2 antivirwebservice;Avira AntiVir Premium WebGuard;"c:\programmi\Avira\AntiVir PersonalEdition Premium\AVWEBGRD.EXE" [2008-11-17 258305]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-10-03 20560]
R2 AVEService;Avira AntiVir Premium MailGuard helper service;"c:\programmi\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-11-17 41217]
R2 wbsecsvc;wbsecsvc;c:\programmi\Conitech\WLAN\WBSECSVC.EXE /service [2008-10-09 274432]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller;c:\windows\system32\DRIVERS\l151x86.sys [2008-09-23 36864]
R3 SunkFilt62;Alcor Micro Corp - 6362;\??\c:\windows\System32\Drivers\sunkfilt62.sys [2004-07-23 46536]
S3 SunkFilt6;Alcor Micro Corp - 6360;\??\c:\windows\System32\Drivers\sunkfilt6.sys []
S3 W35UND;W89C35 802.11bg WLAN USB Adapter Driver;c:\windows\system32\DRIVERS\W35UND.SYS [2008-10-09 105472]

*Newly Created Service* - ANTIVIRMAILSERVICE
*Newly Created Service* - ANTIVIRSCHEDULER
*Newly Created Service* - ANTIVIRSERVICE
*Newly Created Service* - ANTIVIRWEBSERVICE
*Newly Created Service* - AVESERVICE
*Newly Created Service* - AVGIO
*Newly Created Service* - AVGNTFLT
*Newly Created Service* - AVIPBB
*Newly Created Service* - PROCEXP90
*Newly Created Service* - WS2IFSL
.
Contenuto della cartella 'Scheduled Tasks'

2008-11-17 c:\windows\Tasks\User_Feed_Synchronization-{01DA46F7-6074-404A-BF3D-BBB3B5CE7C33}.job
- c:\windows\system32\msfeedssync.exe [2008-08-22 02:05]
.
- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-NBKeyScan - c:\programmi\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Explorer_Run-VMware hptray - c:\programmi\WebMediaViewer\hpmon.exe

.
------- Supplementare di scansione -------
.
uStart Page = hxxp://google.it/
IE: Convert link target to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\programmi\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php
IE: {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php -
LSP: avsda.dll

c:\windows\Downloaded Program Files\zylomgamesplayer.dll - O16 -: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B}
hxxp://game09.zylom.com/activex/zylomgamesplayer.cab
c:\windows\Downloaded Program Files\ZylomGamesPlayer.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-17 21:27:04
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
Ora fine scansione: 2008-11-17 21.27.49
ComboFix-quarantined-files.txt 2008-11-17 20:27:47

Pre-Run: 6.943.838.208 byte disponibili
Post-Run: 7,522,988,032 byte disponibili

259 --- E O F --- 2008-11-13 02:00:52

da **Amantide** » lun nov 17, 2008 9:44 pm

Scarica The Avenger, estrailo in una cartella ed avvia il file avenger.exe.
Incolla il seguente spript nello spazio bianco sotto alla voce Input script here, togli la spunta alla voce Scan for rootkits e clicca su Execute.

Codice: Seleziona tutto: Files to delete: c:\windows\system32\jegveefakk.exe c:\windows\system32\xa46525265.exe c:\windows\system32\xa46525046.exe

Il pc dovrebbe riavviarsi, se così non fosse, riavvialo manualmente.
Al riavvio dovrebbe apparire il log avenger.txt, posta qui il suo contenuto.

P.S. Correggi il report di Combofix inserendolo tra i tag LOG.

da **Amantide** » lun nov 17, 2008 9:55 pm

Dimenticavo, ma WebMediaViewer hai disinstallato o no?
Vedi se riesci a disinstallarlo dal Pannello di controllo, altrimenti ti preparo lo script per Avenger.

da **crax56** » lun nov 17, 2008 10:02 pm

non ho il programma webmediawiever[LOG][L/LOG]

da **Amantide** » lun nov 17, 2008 10:12 pm

Ok, allora ti correggo lo script da usare con Avenger:

Codice: Seleziona tutto: Files to delete: c:\windows\system32\jegveefakk.exe c:\windows\system32\xa46525265.exe c:\windows\system32\xa46525046.exe Folders to delete: c:\programmi\WebMediaViewer Registry keys to delete: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}

Rifai anche la scansione con Hijackthis, seleziona e fixa le seguenti voci:
O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Programmi\WebMediaViewer\qttask.exe
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Programmi\WebMediaViewer\hpmon.exe
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)

da **crax56** » lun nov 17, 2008 10:29 pm

Amantide ha scritto:Ok, allora ti correggo lo script da usare con Avenger:

Codice: Seleziona tutto
Files to delete: c:\windows\system32\jegveefakk.exe c:\windows\system32\xa46525265.exe c:\windows\system32\xa46525046.exe Folders to delete: c:\programmi\WebMediaViewer Registry keys to delete: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}

Rifai anche la scansione con Hijackthis, seleziona e fixa le seguenti voci:
O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Programmi\WebMediaViewer\qttask.exe
O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Programmi\WebMediaViewer\hpmon.exe
O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)

Con questo sembra sia andato tutto a posto [applauso+]

.Sei stato-a bravissimo-a. [grazie]

a te e a tutti gli altri amici di [MLI]

senza di voi sarebbero state [XX(]

Ciao a tuutti.

www.MegaLab.it

home page cambiata

home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Re: home page cambiata

Chi c’è in linea