TrojanClicker

[zampetta007]

Buongiorno a tutti e complimenti per il sito veramente funzionale.
Vi spiego il mio problema.
Da giorni si aprono pubblicità a centinaia e non so come bloccarle.Ho fatto uno scan con Nod e mi ha rilevato la presenza(nella cartella System32) di TrojanClicker,Trojan Downloader e anche di Virtumonde(già che ci stava XDXD).
Ho usato ComboFix e questp è il log.

ComboFix 08-12-18.01 - Andrea 2008-12-19 11.47.31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1040.18.511.147 [GMT 1:00]
Eseguito da: c:\documents and settings\Andrea\Desktop\ComboFix.exe
* Creato nuovo punto di ripristino
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bold.log
c:\documents and settings\Andrea\Dati applicazioni\QNVW601P.dll
c:\windows\system32\156d53vu.exe.a_a
c:\windows\system32\drivers\downld
c:\windows\system32\emakebav.ini
c:\windows\system32\ijilupiv.ini
c:\windows\system32\rerurepo.dll
c:\windows\system32\tomuzipu.dll
c:\windows\system32\uzogenin.ini
c:\windows\system32\wu3t006P.exe.a_a

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_asc3550p


((((((((((((((((((((((((( Files Creati Da 2008-11-19 al 2008-12-19 )))))))))))))))))))))))))))))))))))
.

2008-12-19 11:23 . 2008-12-19 11:23 250 --a------ c:\windows\gmer.ini
2008-12-19 10:07 . 2008-12-19 10:07 <DIR> d-------- c:\programmi\ESET
2008-12-19 10:07 . 2008-12-19 10:07 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\ESET
2008-12-17 19:37 . 2008-12-17 19:37 261 --a------ c:\windows\wininit.ini
2008-12-15 10:11 . 2008-12-15 10:11 <DIR> d-------- c:\documents and settings\NetworkService\Documenti
2008-12-15 10:00 . 2008-12-15 10:00 <DIR> d---s---- c:\documents and settings\NetworkService\Preferiti
2008-12-09 16:57 . 2008-12-09 19:07 159 --a------ c:\windows\system32\temp_0000_85-20.aok
2008-12-09 13:30 . 2008-12-09 17:34 943 --a------ c:\windows\wincmd.ini
2008-12-08 21:12 . 2008-12-09 14:37 <DIR> d-------- c:\documents and settings\Andrea\Dati applicazioni\Apple Computer
2008-12-08 21:12 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-08 21:12 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-08 21:10 . 2008-12-10 18:38 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Apple Computer
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\UC.PIF
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\RAR.PIF
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\PKZIP.PIF
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\PKUNZIP.PIF
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\NOCLOSE.PIF
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\LHA.PIF
2008-12-08 20:11 . 2008-08-08 07:04 545 --a------ c:\windows\ARJ.PIF
2008-12-08 19:58 . 2004-08-19 15:39 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-08 19:58 . 2001-08-30 23:07 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-12-04 14:11 . 2008-12-04 14:34 <DIR> d-------- c:\programmi\File comuni\ArcSoft
2008-12-04 13:49 . 2008-12-04 14:24 <DIR> d-------- c:\documents and settings\Andrea\Dati applicazioni\ArcSoft
2008-11-30 09:40 . 2008-11-30 09:50 107,134 --a------ c:\windows\UninstallFirefox.exe
2008-11-29 21:24 . 2008-12-13 13:43 <DIR> d-------- c:\programmi\MONOGRAM AMR SplitterDecoder
2008-11-29 16:17 . 2008-11-29 16:17 0 --a------ c:\windows\system32\atiicdxx.dat
2008-11-21 21:54 . 2008-11-21 22:07 <DIR> d-------- c:\documents and settings\Andrea\Dati applicazioni\Sony

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-19 10:24 242 ----a-w c:\programmi\FxVMonde.log
2008-12-18 19:38 --------- d-----w c:\programmi\eCover
2008-12-18 19:26 --------- d-----w c:\documents and settings\Andrea\Dati applicazioni\Zoom Player
2008-12-14 12:21 --------- d-----w c:\programmi\eMule
2008-12-04 13:34 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-12-02 12:22 --------- d-----w c:\programmi\Microsoft Games
2008-11-29 09:41 --------- d-----w c:\programmi\Sony Corporation
2008-11-28 18:57 --------- d-----w c:\programmi\Zoom Player
2008-11-15 16:21 --------- d-----w c:\programmi\Real
2008-11-15 16:19 --------- d-----w c:\programmi\File comuni\Real
2008-11-13 17:37 --------- d-----w c:\programmi\PopCap Games
2008-11-13 17:37 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\PopCap
2008-11-12 20:56 --------- d-----w c:\documents and settings\Andrea\Dati applicazioni\GanymedeNet
2008-11-12 20:17 1,792 ----a-w C:\ADD.EXE
2008-11-10 13:28 --------- d-----w c:\programmi\Messenger Plus! Live
2008-11-06 14:15 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Ulead Systems
2008-11-06 12:33 --------- d-----w c:\documents and settings\Andrea\Dati applicazioni\Ulead Systems
2008-11-06 10:19 --------- d-----w c:\programmi\File comuni\SWiSHzone.com
2008-11-04 18:14 --------- d-----w c:\programmi\Windows Live
2008-11-04 17:56 --------- dcsh--w c:\programmi\File comuni\WindowsLiveInstaller
2008-11-04 17:48 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\WLInstaller
2008-11-04 17:16 --------- d-----w c:\programmi\VS Revo Group
2008-11-04 16:57 --------- d-----w c:\programmi\Microsoft
2008-11-03 13:31 --------- d-----w c:\documents and settings\Andrea\Dati applicazioni\Atari
2008-10-25 12:16 --------- d-----w c:\documents and settings\Andrea\Dati applicazioni\Nokia
2008-10-08 11:57 65,847 ----a-w c:\windows\BricoPackUninst.cmd
2008-10-08 11:57 6,116 ----a-w c:\windows\BricoPackFoldersDelete.cmd
2007-12-22 17:53 81,920 ----a-w c:\documents and settings\Andrea\Dati applicazioni\ezpinst.exe
2007-12-22 17:53 47,360 ----a-w c:\documents and settings\Andrea\Dati applicazioni\pcouffin.sys
2004-10-13 16:24 1,694,208 -csha-w c:\windows\ServicePackFiles\i386\msmsgs.exe
2007-11-03 16:03 88 -csha-r c:\windows\system32\88B7CC123C.sys
2007-11-03 16:03 2,516 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c58e2d84-d9be-4aaa-8225-7a0c5cfc8203}]
2008-09-17 10:12 62013 --ah----- c:\windows\system32\womovire.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]
"RocketDock"="c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-18 630784]
"PC Suite Tray"="c:\programmi\Nokia\Nokia PC Suite 6\PCSuite.exe" [2007-12-10 695808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\programmi\ESET\ESET NOD32 Antivirus\egui.exe" [2008-10-08 1451264]
"CPMaf8f96ff"="c:\windows\system32\bumefoni.dll" [2008-12-19 95806]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-19 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]

c:\documents and settings\Andrea\Menu Avvio\Programmi\Accessori\Esecuzione automatica\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]
TransBar.lnk - c:\windows\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"= "c:\windows\system32\bumefoni.dll" [2008-12-19 95806]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"= {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bumefoni.dll [2008-12-19 95806]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\WINDOWS\\system32\\spoolsv.exe"=

R1 bbcap;bbcap;c:\windows\system32\DRIVERS\bbcap.sys [2007-12-14 2944]
R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-10-08 34312]
R2 ekrn;Eset Service;"c:\programmi\ESET\ESET NOD32 Antivirus\ekrn.exe" [2008-10-08 468224]
S3 zlportio;zlportio;\??\c:\programmi\UltraStar Deluxe\zlportio.sys []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29558a0e-3b57-11dc-9835-0090d0d54e2c}]
\Shell\Auto\command - H:\UFO.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cf03a2c-3c41-11dc-9838-0090d0d54e2c}]
\Shell\AutoRun\command - welcome.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54aea7f0-6d08-11dd-a5e4-0090d0d54e2c}]
\Shell\Auto\command - sxs.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3094d35-3b09-11dc-9833-0040ca52552a}]
\Shell\Auto\command - sxs.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\nektewkc]
c:\windows\system32\nektewkc.exe
.
Contenuto della cartella 'Scheduled Tasks'

2008-12-18 c:\windows\Tasks\At1.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At10.job
- c:\windows\system32\156d53vu.exe []

2008-12-19 c:\windows\Tasks\At11.job
- c:\windows\system32\156d53vu.exe []

2008-12-19 c:\windows\Tasks\At12.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At13.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At14.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At15.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At16.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At17.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At18.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At19.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At2.job
- c:\windows\system32\156d53vu.exe []

2008-12-18 c:\windows\Tasks\At20.job
- c:\windows\system32\156d53vu.exe []

2008-12-18 c:\windows\Tasks\At21.job
- c:\windows\system32\156d53vu.exe []

2008-12-18 c:\windows\Tasks\At22.job
- c:\windows\system32\156d53vu.exe []

2008-12-18 c:\windows\Tasks\At23.job
- c:\windows\system32\156d53vu.exe []

2008-12-18 c:\windows\Tasks\At24.job
- c:\windows\system32\156d53vu.exe []

2008-12-18 c:\windows\Tasks\At25.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At26.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At27.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At28.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At29.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At3.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At30.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At31.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At32.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At33.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At34.job
- c:\windows\system32\wu3t006P.exe []

2008-12-19 c:\windows\Tasks\At35.job
- c:\windows\system32\wu3t006P.exe []

2008-12-19 c:\windows\Tasks\At36.job
- c:\windows\system32\wu3t006P.exe []

2008-12-17 c:\windows\Tasks\At37.job
- c:\windows\system32\wu3t006P.exe []

2008-12-17 c:\windows\Tasks\At38.job
- c:\windows\system32\wu3t006P.exe []

2008-12-17 c:\windows\Tasks\At39.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At4.job
- c:\windows\system32\156d53vu.exe []

2008-12-17 c:\windows\Tasks\At40.job
- c:\windows\system32\wu3t006P.exe []

2008-12-17 c:\windows\Tasks\At41.job
- c:\windows\system32\wu3t006P.exe []

2008-12-17 c:\windows\Tasks\At42.job
- c:\windows\system32\wu3t006P.exe []

2008-12-17 c:\windows\Tasks\At43.job
- c:\windows\system32\wu3t006P.exe []

2008-12-19 c:\windows\Tasks\At44.job
- c:\windows\system32\wu3t006P.exe []

2008-12-18 c:\windows\Tasks\At45.job
- c:\windows\system32\wu3t006P.exe []

2008-12-18 c:\windows\Tasks\At46.job
- c:\windows\system32\wu3t006P.exe []

2008-12-18 c:\windows\Tasks\At47.job
- c:\windows\system32\wu3t006P.exe []

2008-12-18 c:\windows\Tasks\At48.job
- c:\windows\system32\wu3t006P.exe []

2008-12-14 c:\windows\Tasks\At5.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At6.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At7.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At8.job
- c:\windows\system32\156d53vu.exe []

2008-12-14 c:\windows\Tasks\At9.job
- c:\windows\system32\156d53vu.exe []

2008-12-19 c:\windows\Tasks\Verifica e correzione automatica.job
- c:\programmi\TuneUp Utilities 2008\OneClickStarter.exe []
.
- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-bunotenuge - c:\windows\system32\hekeyapi.dll


.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.gazzetta.it/
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
TCP: {A1AFA018-765B-47B7-BB0E-5FDAB00E1452} = 208.67.222.222
FF - ProfilePath - c:\documents and settings\Andrea\Dati applicazioni\Mozilla\Firefox\Profiles\kyvzzu87.default\
FF - plugin: c:\documents and settings\Andrea\Dati applicazioni\Mozilla\Firefox\Profiles\kyvzzu87.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07073001.dll
FF - plugin: c:\programmi\Mozilla Firefox\plugins\nppopcaploader.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
FF - user.js: network.http.max-connections-per-server - 8
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.version", 3);
c:\programmi\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.3.shown", false);
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-19 11:51:13
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(636)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\windows\system32\wdfmgr.exe
c:\windows\system32\rundll32.exe
c:\programmi\PC Connectivity Solution\ServiceLayer.exe
c:\programmi\PC Connectivity Solution\Transports\NclMSBTSrv.exe
c:\programmi\File comuni\Nokia\MPAPI\MPAPI3s.exe
.
**************************************************************************
.
Ora fine scansione: 2008-12-19 11:59:06 - macchina è stato riavviato
ComboFix-quarantined-files.txt 2008-12-19 10:59:02

Pre-Run: 2.859.356.160 byte disponibili
Post-Run: 2,837,106,688 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

297 --- E O F --- 2007-12-16 12:54:00

Come mi devo muovere?
Grazie in anticipo per l'aiuto.

[crazy.cat]

C:\ADD.EXE
In attesa di amantide che è la nostra esperta di combofix, puoi cominciare a vedere se questi file sono ancora presenti nel tuo pc.
c:\programmi\File comuni\SWiSHzone.com
c:\windows\system32\88B7CC123C.sys
c:\windows\system32\KGyGaAvL.sys
c:\windows\system32\womovire.dll
c:\windows\system32\bumefoni.dll
H:\UFO.exe
sxs.exe

Anche questi due exe e tutti i job che sono molto sospetti.
2008-12-18 c:\windows\Tasks\At1.job
- c:\windows\system32\156d53vu.exe []
2008-12-18 c:\windows\Tasks\At25.job
- c:\windows\system32\wu3t006P.exe []

I file li puoi fare analizzare sul sito www.virustotal.com per vedere cosa c'è di infetto.
Poi in base a cosa trovi vediamo come pulirli.

[zampetta007]

Su VirusTotal stranamente non mi da niente di infetto.
Comunque tra i file che mi avevi detto,l'unico ancora presente è womovire.dll.
Per gli altri file sospetti,l'ultimo in particolare,Nod mi dave TriojanClicker.
Adesso aspetto l'esperta.XD

[crazy.cat]

l'unico ancora presente è womovire.dll.

allora comincia a cancellarlo perché è qualcosa di abbastanza nuovo
http://www.prevx.com/filenames/14187033 ... 2EDLL.html

Dopo la rimozione di womovire.dll hai ancora le pubblicità?

[zampetta007]

Il problema è come cancellarlo.
Provando a cancellarlo normalmente,mi dà errore.Ed anche con l'antivirus mi dice che non riesce ad eliminarlo.

[crazy.cat]

Scarica Avenger
Estrailo in una cartella a tua scelta
Esegui il file avenger.exe con la figura di una spada
Ora incolla queste righe nel box bianco che si è aperto:

Codice: Seleziona tutto

Files to delete:
C:\ADD.EXE
c:\windows\system32\womovire.dll
c:\windows\system32\bumefoni.dll
H:\UFO.exe

Folder to delete:
c:\windows\Tasks


Togli il segno di spunta dalla voce Scan for Rootkits
Premi il pulsante Execute
Rispondi di Si alle due richieste di Avenger
Adesso il tuo computer dovrebbe riavviarsi, nel caso non succedesse, riavvialo tu manualmente
Al riavvio del computer, copia e incolla qui il contenuto del blocco note che apparirà.

Se ti da un errore di script errato, prova a riscrivere manualmente la prima riga (Files to delete:) ricordando i due punti.

[zampetta007]

File cancellato.
Per il momento il problema non si presenta.
Però mi sa che l'altro file,aveva qualcosa a che fare con la rundll.Infatti adesso,appena caricato windows mi dice "Errore Rundll bumefoni.dll modulo non trovato".
So che sarò noioso,ma che si deve fare?
Grazie ancora per l'iuto e la disponibilità

[crazy.cat]

Fai una scansione con hijackthis e posta il log.

[Amantide]

Copia ed incolla il seguente testo su blocconote e salva il file su desktop con il nome CFScript.txt.

Codice: Seleziona tutto

File::
c:\windows\UC.PIF
c:\windows\RAR.PIF
c:\windows\PKZIP.PIF
c:\windows\PKUNZIP.PIF
c:\windows\NOCLOSE.PIF
c:\windows\LHA.PIF
c:\windows\ARJ.PIF
c:\windows\wincmd.ini
c:\windows\system32\temp_0000_85-20.aok
c:\windows\system32\womovire.dll
c:\windows\system32\bumefoni.dll
c:\windows\system32\nektewkc.exe
c:\windows\system32\156d53vu.exe
c:\windows\system32\wu3t006P.exe

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c58e2d84-d9be-4aaa-8225-7a0c5cfc8203}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPMaf8f96ff"=-
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\nektewkc]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{29558a0e-3b57-11dc-9835-0090d0d54e2c}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4cf03a2c-3c41-11dc-9838-0090d0d54e2c}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54aea7f0-6d08-11dd-a5e4-0090d0d54e2c}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a3094d35-3b09-11dc-9833-0040ca52552a}]


Ora trascina il file CFScript.txt sull'icona di ComboFix. Aspetta il termine della scansione e posta il nuovo log di Combofix.

Poi abilita la visualizzazione dei file nascosti, apri il seguente file con il blocco note e posta qui il suo contenuto.
c:\windows\wininit.ini

Per finire, collega al pc tutte le unità rimovibili ed esegui la scansione con Perlovga Removal Tool.

[zampetta007]

Fatto tutto come mi avevate detto.
Questo è il contenuto di wininit.ini:

[rename]
c:\tempjunk1539.tmp=C:\Documents and Settings\Andrea\Dati applicazioni\WeatherDPA\Weather\WeatherStartup.xml
nul=c:\tempjunk8913.tmp
c:\tempjunk63.tmp=c:\windows\system32\fotuliza.dll_old
c:\tempjunk8913.tmp=C:\WINDOWS\system32\hekeyapi.dll_old

All'inizio adesso mi dà errore proprio per hekeyapi.dll.
Devo seguire la stessa procedura usata prima,cambiando una riga ed inserendo la dll in questione?

[Amantide]

Rinomina il file wininit.ini in wininit.old, dopodiché esegui con Avenger questo script e posta qui il log:

Codice: Seleziona tutto

Files to delete:
c:\tempjunk8913.tmp
c:\tempjunk63.tmp
c:\windows\system32\fotuliza.dll_old
c:\tempjunk8913.tmp
C:\WINDOWS\system32\hekeyapi.dll_old
c:\windows\system32\fotuliza.dll
C:\WINDOWS\system32\hekeyapi.dll

Fai anche la scansione completa con Malwarebytes Anti-malware e posta qui il report.

[zampetta007]

Questo è il log Malwarebytes:

Malwarebytes' Anti-Malware 1.31
Versione del database: 1525
Windows 5.1.2600 Service Pack 2

20/12/2008 11.59.48
mbam-log-2008-12-20 (11-59-48).txt

Tipo di scansione: Scansione completa (C:\|)
Elementi scansionati: 82220
Tempo trascorso: 1 hour(s), 5 minute(s), 15 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 5
Valori di registro infetti: 1
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 6

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)

Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CLASSES_ROOT\solution.solution (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\solution.solution.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{892b2785-b0d0-4aa2-ae6a-0ed60b00a979} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{00476c87-a276-49bf-86bc-ff005732430b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{e81cf86b-f683-422a-b742-3f2427ea9d6a} (Trojan.BHO) -> Quarantined and deleted successfully.

Valori di registro infetti:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bunotenuge (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
C:\System Volume Information\_restore{F8BCDBE7-14DF-4D4E-9E07-D9A6A368CF0B}\RP2\A0000117.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vabekame.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zevihami.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vipuliji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ninegozu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\niwebazi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Questo invece il log di Avenger:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:


Error: file "c:\tempjunk8913.tmp" not found!
Deletion of file "c:\tempjunk8913.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "c:\tempjunk63.tmp" not found!
Deletion of file "c:\tempjunk63.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist

File "c:\windows\system32\fotuliza.dll_old" deleted successfully.

Error: file "c:\tempjunk8913.tmp" not found!
Deletion of file "c:\tempjunk8913.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist

File "C:\WINDOWS\system32\hekeyapi.dll_old" deleted successfully.

Error: file "c:\windows\system32\fotuliza.dll" not found!
Deletion of file "c:\windows\system32\fotuliza.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Error: file "C:\WINDOWS\system32\hekeyapi.dll" not found!
Deletion of file "C:\WINDOWS\system32\hekeyapi.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
the object does not exist


Completed script processing.

*******************

Finished! Terminate.

[Amantide]

Adesso il pc sembra essere pulito.
Tienimi aggiornata su come si comporterà prossimamente.

[zampetta007]

Grazie mille..vi farò sapere in caso di altri errori.
Ancora un grazie enorme per la vostra disponibilità!!
Un saluto e visto che manca poco un Felice Natale a tutti!!