Problema virus...

[randall_flag]

Ciao a tutti! Sono nuovo del forum....
So che nn si dovrebbe ma ho scaricato un file con bittorrent... e mi sono beccato un bel virus per punizione.
Col nod32 sono riuscito a cancellare un po' di roba, mi ha trovato diversi virus come small.nek, rustok.ngj, bho.nky,spaced.a e autorun.ch.
Dopo la presunta rimozione i browser sono andati (chrome ed explorer) e nn posso più accedere al regedit.
Inoltre la scansione online con kaspersky mi è impossibile perché anche installando opera QUEL sito ed i correlati nn sono raggiungibili.
Potete aiutarmi? NOD nn trova altro...

[crazy.cat]

Sblocca il registro
http://www.MegaLab.it/2515/registro-di- ... s-bloccato
Scansione con questo tool per eliminare eventuali virus rimasti
http://www.MegaLab.it/2894/kaspersky-virus-removal-tool
Se ancora non basta vediamo un log della scansione di Hijackthis.

Cosa vuol dire i browser sono andati?

[randall_flag]

Sono "andati " nel senso che chrome nn parte proprio più, mentre explorer si è riempito di bugs e codici strani.
In pratica explorer nn vede più i file d'immagine per cui tutti i gif e jpg nn vengono visualizzati e cliccando sui risultati di google vengo reindirizzato a siti porno.
Ho successivamente installato opera, con il quale navigo quasi senza problemi, ma sto cavolo di virus impedisce di collegarsi al sito di kaspersky.
In pratica appena do l'invio per raggiungere il sito, il browser (qualsiasi browser) me lo da come irraggiungibile senza manco averlo contattato..... all'istante.
Se lo pingo da una finestra di dos risponde, ma è irraggiungibile da browser....
La procedura per riattivare il regedit nn funziona, prevede di aprire il regedit stesso per modificare i settaggi.... ma io nn posso entrare nel regedit!
Allego un log di hijackthis v2.0.2, scusa se lo posto intero ma nn mi fa inviare in formato txt..... nn ho capito come fare...
Aiuto!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10.33.13, on 30/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\JMRaidSetup.exe
C:\WINDOWS\vsnpstd.exe
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\DAEMON Tools Pro\DTProAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\csrssc.exe
C:\Programmi\APC PowerChute Personal Edition\mainserv.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Documents and Settings\Randall_Flag\Desktop\OverClock Tools\RealTemp_2.70\RealTemp.exe
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\NVIDIA Corporation\nTune\nTuneService.exe
C:\Programmi\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Programmi\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Programmi\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Programmi\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Programmi\Skype\Plugin Manager\skypePM.exe
C:\Programmi\Opera\opera.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\Rar$EX00.015\MegaLab.it_H_i_J_a_C_k_T_h_I_s.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\ddcAttRK.dll
O2 - BHO: (no name) - {703FE432-81B1-4061-83BA-A609FBB5F0B3} - C:\WINDOWS\system32\nnnmlLFW.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: {340be680-77ed-d0da-c1e4-d6d8957c7a3c} - {c3a7c759-8d6d-4e1c-ad0d-de77086eb043} - C:\WINDOWS\system32\teljen.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\System32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [74a92558] rundll32.exe "C:\WINDOWS\system32\hascvdxg.dll",b
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Programmi\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Randall_Flag\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Programmi\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\csrssc.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Programmi\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\Programmi\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\Programmi\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\Programmi\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: APC UPS Status.lnk = C:\Programmi\APC PowerChute Personal Edition\Display.exe
O4 - Global Startup: Collegamento a RealTemp.exe.lnk = C:\Documents and Settings\Randall_Flag\Desktop\OverClock Tools\RealTemp_2.70\RealTemp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Fac ... oader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: teljen.dll
O20 - Winlogon Notify: ddcAttRK - C:\WINDOWS\SYSTEM32\ddcAttRK.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Programmi\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Programmi\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 7712 bytes

[crazy.cat]

La procedura per riattivare il regedit nn funziona, prevede di aprire il regedit stesso per modificare i settaggi.... ma io nn posso entrare nel regedit!

L'articolo si era decisamente incasinato e non si leggeva più tanto bene. Se ci riguardi adesso vedi che bisogna usare lo script vbs che si trova nell'allegato
http://www.MegaLab.it/3174/regedit-on-off per poter riabilitare il registro di configurazione.

Rifai la scansione con hijackthis e selezioni le caselle di queste righe poi premi fix checked per eliminarle
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\ddcAttRK.dll
O2 - BHO: (no name) - {703FE432-81B1-4061-83BA-A609FBB5F0B3} - C:\WINDOWS\system32\nnnmlLFW.dll
O2 - BHO: {340be680-77ed-d0da-c1e4-d6d8957c7a3c} - {c3a7c759-8d6d-4e1c-ad0d-de77086eb043} - C:\WINDOWS\system32\teljen.dll
O4 - HKLM\..\Run: [74a92558] rundll32.exe "C:\WINDOWS\system32\hascvdxg.dll",b
O4 - HKCU\..\Run: [xsjfn83jkemfofght] C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\winlogin.exe
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\csrssc.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - AppInit_DLLs: teljen.dll
O20 - Winlogon Notify: ddcAttRK - C:\WINDOWS\SYSTEM32\ddcAttRK.dll

ti consiglio una scansione con combofix così elimina il trojan vundo e poi una con il tool della kasperksy che ti ho già segnalato per eliminare il resto.

Che versione hai di nod?

[randall_flag]

La versione del nod è 2.7
Ho fatto qualche passo avanti, ora il regedit è sbloccato ma come nn riesco a collegarmi a kaspersky.com, nn riesco a raggiungere il sito....
Quando ne ho trovato uno hostato su un altro server, il nod ha rilevato un virus ed ho cancellato il file.
Ora sto provando a scricarne uno con e-mule, nn vorrei che il virus rigettasse ogni file di combofix scaricato....
Riguardo ad hijackthis mi ha cancellato tutte le chiavi tranne 3, ho risolto il problema cancellando i file a cui facevano riferimento bootando un sistema operativo da cd( nn va più la modalità provvisoria) e cancellandoli manualmente. (si chiama Bart-PE e nn è niente male....) Poi ho ricancellato le chiavi con hijack ed in effetti sono sparite.
Il problema nn è ancora risolto ma va già molto meglio, posto l'ultimo log di hijack. Mi dite come fare a postare i log?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.02.49, on 30/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
C:\Programmi\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmi\Java\jre6\bin\jusched.exe
C:\Programmi\DAEMON Tools Pro\DTProAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\MSN Messenger\MsnMsgr.Exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\Programmi\Skype\Phone\Skype.exe
C:\Programmi\APC PowerChute Personal Edition\mainserv.exe
C:\Programmi\Java\jre6\bin\jqs.exe
C:\Programmi\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Programmi\Eset\nod32krn.exe
C:\Programmi\NVIDIA Corporation\nTune\nTuneService.exe
C:\Programmi\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmi\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programmi\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Programmi\Skype\Plugin Manager\skypePM.exe
C:\Programmi\MSN Messenger\usnsvc.exe
C:\Programmi\Opera\opera.exe
C:\Programmi\eMule\emule.exe
C:\Programmi\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\RANDAL~1\IMPOST~1\Temp\Rar$EX00.844\MegaLab.it_H_i_J_a_C_k_T_h_I_s.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programmi\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\System32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmi\File comuni\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programmi\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Programmi\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Programmi\DAEMON Tools Pro\DTProAgent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programmi\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Randall_Flag\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Programmi\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Programmi\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\Programmi\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\Programmi\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\Programmi\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\Programmi\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: APC UPS Status.lnk = C:\Programmi\APC PowerChute Personal Edition\Display.exe
O4 - Global Startup: Collegamento a RealTemp.exe.lnk = C:\Documents and Settings\Randall_Flag\Desktop\OverClock Tools\RealTemp_2.70\RealTemp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Fac ... oader5.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Programmi\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programmi\Java\jre6\bin\jqs.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmi\Eset\nod32krn.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Programmi\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 6810 bytes

[crazy.cat]

La versione del nod è 2.7

Settalo per bene seguendo questa guida, altrimenti poi i virus passano che è un piacere.
http://www.MegaLab.it/2775/nod32-antivirus

Ora sto provando a scricarne uno con e-mule, nn vorrei che il virus rigettasse ogni file di combofix scaricato....

Prendi questo e lascia perdere il mulo, quando lo scarichi disattiva un attimo nod altrimenti te lo cancella.
http://www.wikifortio.com/844540/ZIPArchive.zip

(si chiama Bart-PE e nn è niente male....)

Dopo dai un occhiata a questo che è anche meglio
http://www.MegaLab.it/2726/megalab-it-c ... a-versione

Mi dite come fare a postare i log?

Li devi mettere tra i tag [log] /log (ci vanno le parentesi quadre) usando il pulsante che vedi quando vai ad inserire il nuovo post.

[randall_flag]

Grande! Il combofix che mi hai dato è andato alla grande ed ha trovato un rootkit all'avvio.
I browser (anche opera) danno qlc problema ma sta per partire la scansione di kaspersky, quindi un altro passo è fatto.
Grazie mille sei stato gentilissimo ed hai risposto ai miei post davvero in fretta!
Ti faro' sapere come è andata la scansione con kas, serve anche il log di combofix?

[Amantide]

serve anche il log di combofix?

Postalo, così vediamo se c'è qualcos'altro da rimuovere manualmente.

[randall_flag]

Eccolo, così vediamo se ho capito come si posta un log...

ComboFix 08-12-29.02 - Randall_Flag 2008-12-30 20:01:44.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.2046.1691 [GMT 1:00]
Eseguito da: c:\docume~1\RANDAL~1\IMPOST~1\Temp\Rar$EX10.093\PippoFix.exe
* Resident AV is active


ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\RANDAL~1\IMPOST~1\Temp\install_flash_player.exe
C:\InfoSat.txt
c:\windows\system32\drivers\TDSSmxoe.sys
c:\windows\system32\gxdvcsah.ini
c:\windows\system32\hascvdxg.dll
c:\windows\system32\jkse73hedfdgf.dll
c:\windows\system32\lxecfyhq.dll
c:\windows\system32\pmnKDSkJ.dll
c:\windows\system32\TDSScfum.log
c:\windows\system32\TDSSfxmp.dll
c:\windows\system32\TDSSmaxt.dat
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSoitu.dll
c:\windows\system32\TDSSosvd.dll
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.log
c:\windows\system32\teljen.dll
c:\windows\system32\WFLlmnnn.ini
c:\windows\system32\WFLlmnnn.ini2
c:\windows\system32\wvUkHAsr.dll
c:\windows\system32\xxyyyvVm.dll

.
((((((((((((((((((((((((((((((((((((((( Driver/Servizi )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys


((((((((((((((((((((((((( Files Creati Da 2008-11-28 al 2008-12-30 )))))))))))))))))))))))))))))))))))
.

2019-08-12 10:29 . 2019-08-12 10:28 512,096 --a------ c:\windows\system32\drivers\amon.sys
2019-08-12 10:29 . 2019-08-12 10:28 298,104 --a------ c:\windows\system32\imon.dll
2019-08-12 10:29 . 2019-08-12 10:28 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2008-12-30 16:39 . 2008-12-30 16:39 <DIR> d-------- C:\MOComboFix
2008-12-30 16:37 . 2008-12-30 16:37 <DIR> d-------- C:\MOD-ComboFix
2008-12-29 19:04 . 2008-12-29 19:04 <DIR> d-------- c:\programmi\Opera
2008-12-29 17:14 . 2008-12-29 17:16 107 --a------ C:\file.bat
2008-12-29 16:21 . 2008-12-29 16:21 24,928 --a------ c:\documents and settings\Randall_Flag\kkncfoje.exe
2008-12-29 16:16 . 2008-12-29 16:16 24,928 --a------ c:\documents and settings\Randall_Flag\zjzkpzeh.exe
2008-12-29 16:16 . 2008-12-29 16:16 24,928 --a------ c:\documents and settings\Randall_Flag\kdqlkszj.exe
2008-12-29 16:15 . 2008-12-29 16:15 24,928 --a------ c:\documents and settings\Randall_Flag\gkgijqgw.exe
2008-12-29 16:03 . 2008-12-29 16:03 24,928 --a------ c:\documents and settings\Randall_Flag\dvompily.exe
2008-12-29 15:54 . 2008-12-29 15:54 24,928 --a------ c:\documents and settings\Randall_Flag\zbakeiru.exe
2008-12-29 13:25 . 2008-12-29 13:28 139,264 --a------ C:\ypniq.exe
2008-12-29 13:25 . 2008-12-29 13:25 0 --a------ C:\olra.exe
2008-12-29 13:24 . 2008-12-29 13:28 8,192 --a------ C:\otpke.exe
2008-12-29 13:24 . 2008-12-29 13:28 2 --a------ C:\1957242359
2008-12-26 04:03 . 2008-12-26 04:03 110,592 --a------ c:\windows\system32\bass.dll
2008-11-17 22:39 . 2008-11-17 22:39 <DIR> d-------- c:\windows\nview
2008-11-17 22:39 . 2008-10-07 13:33 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-11-17 22:39 . 2008-12-30 20:06 200,819 --a------ c:\windows\system32\nvapps.xml
2008-11-17 22:39 . 2008-10-07 13:33 18,477 --a------ c:\windows\system32\nvdisp.nvu
2008-11-17 22:34 . 2008-07-10 04:07 7,143 --a------ c:\windows\system32\nvide.nvu
2008-11-17 22:33 . 2008-08-27 13:58 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2008-11-17 22:33 . 2008-07-29 13:33 446,464 --a------ c:\windows\system32\nvunrm.exe
2008-11-17 22:33 . 2008-07-29 13:30 6,045 --a------ c:\windows\system32\nvnrm.nvu
2008-11-17 22:33 . 2008-07-08 01:45 4,984 --a------ c:\windows\system32\drivers\nvphy.bin
2008-11-17 18:57 . 2008-11-17 18:57 <DIR> d---s---- c:\documents and settings\LocalService\Preferiti
2008-11-17 18:44 . 2006-04-14 15:01 35,840 -ra------ c:\windows\system32\NVCOI.DLL
2008-11-17 18:43 . 2008-11-17 18:43 <DIR> d-------- c:\windows\NV39083912.TMP
2008-11-17 18:38 . 2008-11-17 18:38 <DIR> d-------- c:\programmi\My Company Name
2008-11-17 00:34 . 2008-11-17 00:34 <DIR> d-------- c:\windows\NV480248.TMP
2008-11-17 00:10 . 2008-11-17 00:10 <DIR> d-------- c:\windows\system32\AGEIA
2008-11-17 00:10 . 2008-11-17 00:10 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2008-11-17 00:10 . 2008-11-17 00:10 <DIR> d-------- c:\programmi\AGEIA Technologies
2008-11-17 00:09 . 2008-11-17 19:41 <DIR> d-------- C:\NVIDIA
2008-11-15 00:46 . 2008-11-15 00:46 5,760,054 --a------ c:\windows\BricoPack Wallpaper.bmp
2008-11-15 00:46 . 2008-11-15 00:46 60,368 --a------ c:\windows\BricoPackUninst.cmd
2008-11-15 00:45 . 2008-11-15 00:45 <DIR> d-------- c:\windows\BricoPacks
2008-11-15 00:45 . 2008-11-15 00:46 <DIR> d-------- c:\programmi\Vista Inspirat 2
2008-11-15 00:45 . 2008-11-15 00:46 5,400 --a------ c:\windows\BricoPackFoldersDelete.cmd
2008-11-02 00:07 . 2001-05-11 12:18 420,240 --a------ c:\windows\system32\mpg4c32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2019-08-12 08:55 --------- d-----w c:\programmi\Kaspersky Anti-Virus 2009
2008-12-30 19:06 --------- d-----w c:\documents and settings\Randall_Flag\Dati applicazioni\Skype
2008-12-30 18:59 --------- d-----w c:\documents and settings\Randall_Flag\Dati applicazioni\BitTorrent
2008-12-30 17:45 --------- d-----w c:\documents and settings\Randall_Flag\Dati applicazioni\skypePM
2008-12-30 17:42 --------- d-----w c:\programmi\eMule
2008-12-26 10:41 --------- d-----w c:\programmi\APC PowerChute Personal Edition
2008-12-23 16:58 138,512 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-04 08:44 --------- d-----w c:\programmi\Java
2008-11-23 15:51 --------- d-----w c:\programmi\DOSBox-0.72
2008-11-23 15:38 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-11-17 18:51 --------- d-----w c:\programmi\NVIDIA Corporation
2008-11-17 17:53 --------- d-----w c:\programmi\Panda Security
2008-03-29 11:05 22,328 ----a-w c:\documents and settings\Randall_Flag\Dati applicazioni\PnkBstrK.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\programmi\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\programmi\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2008-08-12 21741864]
"NVIDIA nTune"="c:\programmi\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"JMB36X Configure"="c:\windows\System32\JMRaidSetup.exe" [2006-10-30 1953792]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"snpstd"="c:\windows\vsnpstd.exe" [2004-05-10 286720]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2019-08-12 949376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Randall_Flag\Menu Avvio\Programmi\Esecuzione automatica\
RocketDock.lnk - c:\programmi\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]
TransBar.lnk - c:\programmi\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - c:\programmi\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - c:\programmi\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
APC UPS Status.lnk - c:\programmi\APC PowerChute Personal Edition\Display.exe [2008-03-22 221247]
Collegamento a RealTemp.exe.lnk - c:\documents and settings\Randall_Flag\Desktop\OverClock Tools\RealTemp_2.70\RealTemp.exe [2008-10-12 110592]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Games\\Quake Wars\\etqw.exe"=
"c:\\Games\\Quake Wars\\etqwded.exe"=
"c:\\Programmi\\DNA\\btdna.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Games\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-07-29 28544]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2019-08-12 15424]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d35cddb-f1c6-11dc-a51f-001d60563257}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43a26692-b433-11dd-8dae-806d6172696f}]
\Shell\AutoRun\command - d:\.\Bin\ASSETUP.exe
.
Contenuto della cartella 'Scheduled Tasks'

2008-12-30 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\documents and settings\Randall_Flag\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2008-09-03 08:17]
.
- - - - ORFÃOS REMOVIDOS - - - -

HKCU-Run-AlcoholAutomount - c:\programmi\Alcohol 120\axcmd.exe
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
SafeBoot-sglfb.sys
SafeBoot-tga.sys
SafeBoot-wd.sys
SafeBoot-sacsvr


.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.google.it/
LSP: c:\windows\system32\imon.dll

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-30 20:06:06
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\scecli.dll
c:\windows\system32\imon.dll
c:\programmi\Eset\pr_imon.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\APC PowerChute Personal Edition\mainserv.exe
c:\programmi\Java\jre6\bin\jqs.exe
c:\programmi\ESET\nod32krn.exe
c:\programmi\NVIDIA Corporation\nTune\nTuneService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
c:\programmi\APC PowerChute Personal Edition\apcsystray.exe
c:\programmi\Skype\Plugin Manager\skypePM.exe
c:\programmi\MSN Messenger\usnsvc.exe
.
**************************************************************************
.
Ora fine scansione: 2008-12-30 20:09:18 - macchina è stato riavviato
ComboFix-quarantined-files.txt 2008-12-30 19:08:51

Pre-Run: 42,563,432,448 byte disponibili
Post-Run: 43,193,524,224 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe

235

[Amantide]

Copia ed incolla il seguente testo su blocconote e salva il file su desktop con il nome CFScript.txt.

Codice: Seleziona tutto

File::
c:\documents and settings\Randall_Flag\kkncfoje.exe
c:\documents and settings\Randall_Flag\zjzkpzeh.exe
c:\documents and settings\Randall_Flag\kdqlkszj.exe
c:\documents and settings\Randall_Flag\gkgijqgw.exe
c:\documents and settings\Randall_Flag\dvompily.exe
c:\documents and settings\Randall_Flag\zbakeiru.exe
C:\ypniq.exe
C:\olra.exe
C:\otpke.exe
C:\1957242359


Ora trascina il file CFScript.txt sull'icona di ComboFix. Aspetta il termine della scansione e posta il nuovo log di Combofix.

[randall_flag]

Lo faro'... nel mentre posto il log di kaspersky

Wednesday, December 31, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, December 30, 2008 18:10:45
Records in database: 1533181
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
A:\
C:\
D:\
E:\
F:\
H:\
Scan statistics
Files scanned 79511
Threat name 11
Infected objects 20
Suspicious objects 1
Duration of the scan 01:50:43

File name Threat name Threats count
C:\Documents and Settings\Randall_Flag\Dati applicazioni\Sun\Java\Deployment\cache\6.0\17\68998a91-45e9ca7a Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\Randall_Flag\Dati applicazioni\Sun\Java\Deployment\cache\6.0\18\5b8aa912-56613e36 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\Randall_Flag\Dati applicazioni\Sun\Java\Deployment\cache\6.0\42\5c0ee46a-7590a6f4 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\otpke.exe Infected: Trojan-Downloader.Win32.Agent.axgj 1
C:\Programmi\ESET\infected\MR0JTSBA.NQF Infected: Trojan-Downloader.Win32.Agent.aszi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\hascvdxg.dll.vir Infected: Trojan.Win32.Pakes.mlu 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
E:\Identities\{F84AB6EE-3505-496A-9D84-44D591244CAF}\Microsoft\Outlook Express\Posta in arrivo.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
E:\mi\storage work\ARCHIVIO\JOLAI\vnc-E4_1_6-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.414 2
E:\mi\storage work\ARCHIVIO\programmi\radmin22it.exe Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.22 3
The selected area was scanned.

[randall_flag]

Ecco il log di combofix dopo la scansione con lo script che mi hai dato.
Ora faccio ripartire lo scan con kasp e vedo che succede, vi faccio sapere domattina.
Il mio NOD sarà corrotto?
Devo reinstallarlo?

ComboFix 08-12-29.02 - Randall_Flag 2008-12-31 1.33.40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1040.18.2046.1341 [GMT 1:00]
Eseguito da: c:\documents and settings\Randall_Flag\Desktop\PippoFix.exe
Interruttori di comando utilizzati :: c:\documents and settings\Randall_Flag\Desktop\CFScript.txt
* Creato nuovo punto di ripristino
* Resident AV is active


ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

FILE ::
C:\1957242359
c:\documents and settings\Randall_Flag\dvompily.exe
c:\documents and settings\Randall_Flag\gkgijqgw.exe
c:\documents and settings\Randall_Flag\kdqlkszj.exe
c:\documents and settings\Randall_Flag\kkncfoje.exe
c:\documents and settings\Randall_Flag\zbakeiru.exe
c:\documents and settings\Randall_Flag\zjzkpzeh.exe
C:\olra.exe
C:\otpke.exe
C:\ypniq.exe
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\1957242359
c:\documents and settings\Randall_Flag\dvompily.exe
c:\documents and settings\Randall_Flag\gkgijqgw.exe
c:\documents and settings\Randall_Flag\kdqlkszj.exe
c:\documents and settings\Randall_Flag\kkncfoje.exe
c:\documents and settings\Randall_Flag\zbakeiru.exe
c:\documents and settings\Randall_Flag\zjzkpzeh.exe
C:\olra.exe
C:\otpke.exe
C:\ypniq.exe

.
((((((((((((((((((((((((( Files Creati Da 2008-11-28 al 2008-12-31 )))))))))))))))))))))))))))))))))))
.

2019-08-12 10:29 . 2019-08-12 10:28 512,096 --a------ c:\windows\system32\drivers\amon.sys
2019-08-12 10:29 . 2019-08-12 10:28 298,104 --a------ c:\windows\system32\imon.dll
2019-08-12 10:29 . 2019-08-12 10:28 15,424 --a------ c:\windows\system32\drivers\nod32drv.sys
2008-12-30 16:39 . 2008-12-30 16:39 <DIR> d-------- C:\MOComboFix
2008-12-30 16:37 . 2008-12-30 16:37 <DIR> d-------- C:\MOD-ComboFix
2008-12-29 19:04 . 2008-12-29 19:04 <DIR> d-------- c:\programmi\Opera
2008-12-29 17:14 . 2008-12-29 17:16 107 --a------ C:\file.bat
2008-12-26 04:03 . 2008-12-26 04:03 110,592 --a------ c:\windows\system32\bass.dll
2008-11-17 22:39 . 2008-11-17 22:39 <DIR> d-------- c:\windows\nview
2008-11-17 22:39 . 2008-10-07 13:33 453,152 --a------ c:\windows\system32\nvudisp.exe
2008-11-17 22:39 . 2008-12-30 20:06 200,819 --a------ c:\windows\system32\nvapps.xml
2008-11-17 22:39 . 2008-10-07 13:33 18,477 --a------ c:\windows\system32\nvdisp.nvu
2008-11-17 22:34 . 2008-07-10 04:07 7,143 --a------ c:\windows\system32\nvide.nvu
2008-11-17 22:33 . 2008-08-27 13:58 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2008-11-17 22:33 . 2008-07-29 13:33 446,464 --a------ c:\windows\system32\nvunrm.exe
2008-11-17 22:33 . 2008-07-29 13:30 6,045 --a------ c:\windows\system32\nvnrm.nvu
2008-11-17 22:33 . 2008-07-08 01:45 4,984 --a------ c:\windows\system32\drivers\nvphy.bin
2008-11-17 18:57 . 2008-11-17 18:57 <DIR> d---s---- c:\documents and settings\LocalService\Preferiti
2008-11-17 18:44 . 2006-04-14 15:01 35,840 -ra------ c:\windows\system32\NVCOI.DLL
2008-11-17 18:43 . 2008-11-17 18:43 <DIR> d-------- c:\windows\NV39083912.TMP
2008-11-17 18:38 . 2008-11-17 18:38 <DIR> d-------- c:\programmi\My Company Name
2008-11-17 00:34 . 2008-11-17 00:34 <DIR> d-------- c:\windows\NV480248.TMP
2008-11-17 00:10 . 2008-11-17 00:10 <DIR> d-------- c:\windows\system32\AGEIA
2008-11-17 00:10 . 2008-11-17 00:10 <DIR> d-------- c:\programmi\File comuni\Wise Installation Wizard
2008-11-17 00:10 . 2008-11-17 00:10 <DIR> d-------- c:\programmi\AGEIA Technologies
2008-11-17 00:09 . 2008-11-17 19:41 <DIR> d-------- C:\NVIDIA
2008-11-15 00:46 . 2008-11-15 00:46 5,760,054 --a------ c:\windows\BricoPack Wallpaper.bmp
2008-11-15 00:46 . 2008-11-15 00:46 60,368 --a------ c:\windows\BricoPackUninst.cmd
2008-11-15 00:45 . 2008-11-15 00:45 <DIR> d-------- c:\windows\BricoPacks
2008-11-15 00:45 . 2008-11-15 00:46 <DIR> d-------- c:\programmi\Vista Inspirat 2
2008-11-15 00:45 . 2008-11-15 00:46 5,400 --a------ c:\windows\BricoPackFoldersDelete.cmd
2008-11-02 00:07 . 2001-05-11 12:18 420,240 --a------ c:\windows\system32\mpg4c32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2019-08-12 08:55 --------- d-----w c:\programmi\Kaspersky Anti-Virus 2009
2008-12-31 00:06 --------- d-----w c:\documents and settings\Randall_Flag\Dati applicazioni\Skype
2008-12-30 23:07 --------- d-----w c:\documents and settings\Randall_Flag\Dati applicazioni\skypePM
2008-12-30 18:59 --------- d-----w c:\documents and settings\Randall_Flag\Dati applicazioni\BitTorrent
2008-12-30 17:42 --------- d-----w c:\programmi\eMule
2008-12-26 10:41 --------- d-----w c:\programmi\APC PowerChute Personal Edition
2008-12-23 16:58 201,440 ----a-w c:\windows\system32\PnkBstrB.exe
2008-12-23 16:58 138,512 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2008-12-04 08:44 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-04 08:44 --------- d-----w c:\programmi\Java
2008-11-23 15:51 --------- d-----w c:\programmi\DOSBox-0.72
2008-11-23 15:38 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-11-17 18:51 --------- d-----w c:\programmi\NVIDIA Corporation
2008-11-17 17:53 --------- d-----w c:\programmi\Panda Security
2008-11-14 23:46 219,648 ----a-w c:\windows\system32\uxtheme.dll
2008-10-24 22:23 139,264 ----a-w c:\windows\system32\hpzjrd01.dll
2008-09-08 10:10 270,336 ----a-w c:\windows\system32\nvLsp.dll
2008-09-04 08:31 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe
2008-03-29 11:05 22,328 ----a-w c:\documents and settings\Randall_Flag\Dati applicazioni\PnkBstrK.sys
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Pro Agent"="c:\programmi\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MsnMsgr"="c:\programmi\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2006-04-21 94208]
"Skype"="c:\programmi\Skype\Phone\Skype.exe" [2008-08-12 21741864]
"NVIDIA nTune"="c:\programmi\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920]
"Google Update"="c:\documents and settings\Randall_Flag\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]
"JMB36X Configure"="c:\windows\System32\JMRaidSetup.exe" [2006-10-30 1953792]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"snpstd"="c:\windows\vsnpstd.exe" [2004-05-10 286720]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"nod32kui"="c:\programmi\Eset\nod32kui.exe" [2019-08-12 949376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 c:\windows\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\Randall_Flag\Menu Avvio\Programmi\Esecuzione automatica\
RocketDock.lnk - c:\programmi\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 630784]
TransBar.lnk - c:\programmi\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - c:\programmi\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - c:\programmi\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
APC UPS Status.lnk - c:\programmi\APC PowerChute Personal Edition\Display.exe [2008-03-22 221247]
Collegamento a RealTemp.exe.lnk - c:\documents and settings\Randall_Flag\Desktop\OverClock Tools\RealTemp_2.70\RealTemp.exe [2008-10-12 110592]
Microsoft Office.lnk - c:\programmi\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Games\\Quake Wars\\etqw.exe"=
"c:\\Games\\Quake Wars\\etqwded.exe"=
"c:\\Programmi\\DNA\\btdna.exe"=
"c:\\Programmi\\BitTorrent\\bittorrent.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Games\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Programmi\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmi\\MSN Messenger\\msnmsgr.exe"=
"c:\\Programmi\\MSN Messenger\\livecall.exe"=
"c:\\Programmi\\eMule\\emule.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-07-29 28544]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2019-08-12 15424]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d35cddb-f1c6-11dc-a51f-001d60563257}]
\Shell\AutoRun\command - G:\nideiect.com
\Shell\explore\Command - G:\nideiect.com
\Shell\open\Command - G:\nideiect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{43a26692-b433-11dd-8dae-806d6172696f}]
\Shell\AutoRun\command - d:\.\Bin\ASSETUP.exe
.
Contenuto della cartella 'Scheduled Tasks'

2008-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-725345543-839522115-1003.job
- c:\documents and settings\Randall_Flag\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe [2008-09-03 08:17]
.
.
------- Supplementare di scansione -------
.
uStart Page = hxxp://www.google.it/
LSP: c:\windows\system32\imon.dll

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-31 01:35:37
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'lsass.exe'(1036)
c:\windows\system32\scecli.dll
c:\windows\system32\imon.dll
c:\programmi\Eset\pr_imon.dll
.
Ora fine scansione: 2008-12-31 1.36.09
ComboFix-quarantined-files.txt 2008-12-31 00:35:52
ComboFix2.txt 2008-12-30 19:09:18

Pre-Run: 43.128.147.968 byte disponibili
Post-Run: 43,167,551,488 byte disponibili

202

[randall_flag]

Kas mi trova ancora un po' di roba strana.... Posto il log

Wednesday, December 31, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, December 30, 2008 21:27:31
Records in database: 1533806
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
A:\
C:\
D:\
E:\
F:\
H:\
Scan statistics
Files scanned 79648
Threat name 11
Infected objects 21
Suspicious objects 1
Duration of the scan 01:50:00

File name Threat name Threats count
C:\Documents and Settings\Randall_Flag\Dati applicazioni\Sun\Java\Deployment\cache\6.0\17\68998a91-45e9ca7a Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\Randall_Flag\Dati applicazioni\Sun\Java\Deployment\cache\6.0\18\5b8aa912-56613e36 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Documents and Settings\Randall_Flag\Dati applicazioni\Sun\Java\Deployment\cache\6.0\42\5c0ee46a-7590a6f4 Infected: Trojan-Downloader.Java.OpenConnection.aq 1
C:\Programmi\ESET\cache\FND0.NFI Infected: Trojan-Downloader.Win32.Agent.axgj 1
C:\Programmi\ESET\infected\GV4NLECA.NQF Infected: Trojan-Downloader.Win32.Agent.axgj 1
C:\Programmi\ESET\infected\MR0JTSBA.NQF Infected: Trojan-Downloader.Win32.Agent.aszi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\hascvdxg.dll.vir Infected: Trojan.Win32.Pakes.mlu 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
E:\Identities\{F84AB6EE-3505-496A-9D84-44D591244CAF}\Microsoft\Outlook Express\Posta in arrivo.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
E:\mi\storage work\ARCHIVIO\JOLAI\vnc-E4_1_6-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.414 2
E:\mi\storage work\ARCHIVIO\programmi\radmin22it.exe Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.22 3
The selected area was scanned.

[randall_flag]

Ciao a tutti!
Vi ringrazio per il vostro aiuto, ci vediamo domani e buon anno!!!!
Da domani torno a stressarvi con il mio pc....

[crazy.cat]

Per rimuovere i virus java
http://www.MegaLab.it/2467/strani-virus ... la-di-java

Il resto sono dei virus nella cartella di quarantena di nod che puoi svuotare e questa cartella la puoi eliminare C:\Qoobox\

Gli altri non sono virus.

[randall_flag]

Ho guardato il link, ho reinstallato java dopo una disinfezione con nod ed ora le cose con opera vanno molto meglio...
Ora ripeto la scansione con kas e postero' il log.
Secondo voi il mio nod è corrotto? Devo reinstallarlo o va bene così?

[randall_flag]

Apparentemente sembra tornato tutto a posto, vi posto il log di kas.
C'è altro he posso fare per verificare che sia davvero pulito? Posso stare tranquillo per il mio nod?

Thursday, January 1, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, January 01, 2009 13:51:57
Records in database: 1543170
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
A:\
C:\
D:\
E:\
F:\
H:\
Scan statistics
Files scanned 79723
Threat name 8
Infected objects 15
Suspicious objects 1
Duration of the scan 01:51:28

File name Threat name Threats count
C:\Programmi\ESET\infected\GV4NLECA.NQF Infected: Trojan-Downloader.Win32.Agent.axgj 1
C:\Programmi\ESET\infected\MR0JTSBA.NQF Infected: Trojan-Downloader.Win32.Agent.aszi 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
E:\Download\Ophcrack LiveCD 1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.2 1
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.s 1
E:\Download\ophcrack-livecd-1.1.4.iso Infected: not-a-virus:PSWTool.Win32.PWDump.d 2
E:\Identities\{F84AB6EE-3505-496A-9D84-44D591244CAF}\Microsoft\Outlook Express\Posta in arrivo.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
E:\mi\storage work\ARCHIVIO\JOLAI\vnc-E4_1_6-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.414 2
E:\mi\storage work\ARCHIVIO\programmi\radmin22it.exe Infected: not-a-virus:RemoteAdmin.Win32.RAdmin.22 3
The selected area was scanned.

[enea83]

Apparentemente sembra tornato tutto a posto, vi posto il log di kas.
C'è altro he posso fare per verificare che sia davvero pulito?

se quello che ha rilevato kasp nella ultima scansione online e' solo malware gia' bloccato in quarantena da nod allora il pc dovrebbe essere pulito

Posso stare tranquillo per il mio nod?

se lo hai settato come si deve seguendo la guida di crazy.cat dovresti essere ok...

altrimenti ti consiglio vivamente di provvedere

[randall_flag]

In effetti sia kas che nod nn trovano più nulla...Evviva!
Unico prob rimasto... Explorer continua a nn andare ma nn riesco a reinstallarlo, esiste una procedura per rimuoverlo?
Vorrei disinstallare la ver 7 per poi rimetterla.

[crazy.cat]

Explorer continua a nn andare ma nn riesco a reinstallarlo, esiste una procedura per rimuoverlo?
Vorrei disinstallare la ver 7 per poi rimetterla.

http://www.MegaLab.it/2746/come-disinst ... windows-xp