"strani processi" e virus... aiuto!

[NUschoolMetal]

salve ragazzi di MegaLab!!

mi sono appena iscritto, perche ho un problema..

vado al sodo.

ho letto, usando cerca,
che a molti il processo avp.exe si gonfia fino ad ocupare il100% della CPU.
ma a me non e solo questo...

a parte avere 6 o 7 svchost.exe, ci sono altri processi ignoti...
e naturalmente il pc va lento...

questa e la lista dei processi, dal mio task menager.
[img=http://img179.imageshack.us/img179/8156/processinuschoolmetalmlib4.th.png]

http://img179.imageshack.us/img179/8156 ... lmlib4.png
in caso non funzioni il link


io ho kaspersky anivirus, originale.
ogni volta che accendo il pc o faccio una scansione, trova un virus TROYAN.General nel file vwunoias.exe nella castella SYSTEM32...
QUANDO PROVO AD ELIMINARLO, VIENE CHIUSO IL PROCESSO iSASS.EXE ed il sistema si riavvia da solo .

non so se sia collegato, ma internet explorer, per le poche volte che lo uso, mi apre un a pagina con un finto antivirus.

questo e tutto... vi ringrazio gia per il prezioso aiuto.

[NUschoolMetal]

scusate, non mi sono accorto prima dell omonimia, ma l' avpexe in questine e quello avviato da SYSTEM.

un altra precisazione che ci tengo a fare e: quando kaspersky disinfetta quel virus mi trova 3 o 4 immagini di windows non valide...e dice di controllare dall dischetto.
devo controllare o sono effetti dell infezione?

grazie ...

[crazy.cat]

Scarica ComboFix, salvandolo sul PC con un nome di fantasia, ed esegui la scansione seguendo queste istruzioni (giù in fondo). Al termine della scansione verrà creato il file di report C:\combofix.txt, copia qui il suo contenuto inserendolo tra i tag LOG.

[Al4]

......a parte avere 6 o 7 svchost.exe,

Questo cosa è normale.

[ste_95]

......a parte avere 6 o 7 svchost.exe,

Questo cosa è normale.

Eccome no? Non cadiamo per l'ennesima volta nella sottigliezza istanza-processo.

[Al4]

Questo cosa è normale.

Ops, mi sono accorto di un errore di battitura, volevo scrivere "Questa cosa è normale", e cioè il fatto di aprire diverse istanze da parte di svchost.exe, come giustamente diceva anche Ste95

[NUschoolMetal]

ComboFix 09-01-08.05 - Zagaria 2009-01-12 15.16.29.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.2047.1617 [GMT 1:00]
Eseguito da: c:\documents and settings\Zagaria\Desktop\combofix.exe.exe

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ajkieg.dll
c:\windows\system32\cjuopj.dll
c:\windows\system32\gvifudec.dll
c:\windows\system32\hhpygmuf.dll
c:\windows\system32\iahqfz.dll
c:\windows\system32\mmxokdcn.dll
c:\windows\system32\ofvpcx.dll
c:\windows\system32\otciyoyg.dll
c:\windows\system32\sAIOnUvw.ini
c:\windows\system32\sAIOnUvw.ini2
c:\windows\system32\scioia.dll
c:\windows\system32\virus.dll
c:\windows\system32\wavhekgy.dll
c:\windows\system32\wvUnOIAs.dll
c:\windows\system32\yiccdurh.ini
c:\windows\Tasks\yosxfyww.job

.
((((((((((((((((((((((((( Files Creati Da 2008-12-12 al 2009-01-12 )))))))))))))))))))))))))))))))))))
.

2009-01-10 20:40 . 2009-01-10 20:40 <DIR> d-------- c:\programmi\Sega
2009-01-09 19:09 . 2009-01-09 19:22 <DIR> d-------- C:\zenvrenghe
2009-01-04 20:12 . 2009-01-04 20:12 268 --ah----- C:\sqmdata04.sqm
2009-01-04 20:12 . 2009-01-04 20:12 172 --ah----- C:\sqmnoopt04.sqm
2009-01-04 19:02 . 2009-01-04 19:02 268 --ah----- C:\sqmdata03.sqm
2009-01-04 19:02 . 2009-01-04 19:02 244 --ah----- C:\sqmnoopt03.sqm
2008-12-28 16:22 . 2008-04-13 11:46 37,888 --a------ c:\windows\system32\drivers\bthmodem.sys
2008-12-28 16:22 . 2008-04-13 11:46 37,888 --a--c--- c:\windows\system32\dllcache\bthmodem.sys
2008-12-21 11:38 . 2008-12-21 11:38 <DIR> d-------- c:\programmi\uTorrent
2008-12-21 11:38 . 2008-12-22 09:53 <DIR> d-------- c:\documents and settings\Zagaria\Dati applicazioni\uTorrent
2008-12-19 20:10 . 2008-12-19 20:10 268 --ah----- C:\sqmdata02.sqm
2008-12-19 20:10 . 2008-12-19 20:10 244 --ah----- C:\sqmnoopt02.sqm
2008-12-19 15:16 . 2008-12-19 15:16 268 --ah----- C:\sqmdata01.sqm
2008-12-19 15:16 . 2008-12-19 15:16 244 --ah----- C:\sqmnoopt01.sqm
2008-12-19 15:12 . 2008-12-19 15:12 268 --ah----- C:\sqmdata00.sqm
2008-12-19 15:12 . 2008-12-19 15:12 244 --ah----- C:\sqmnoopt00.sqm
2008-12-15 18:12 . 2008-12-15 18:12 45,008 --a------ C:\waxx.exe
2008-12-15 17:17 . 2008-12-15 18:08 96,976 --a------ c:\windows\system32\drivers\klin.dat
2008-12-15 17:17 . 2008-12-15 18:08 87,855 --a------ c:\windows\system32\drivers\klick.dat
2008-12-15 17:15 . 2008-12-15 17:15 <DIR> d-------- c:\programmi\Kaspersky Lab
2008-12-15 17:15 . 2009-01-12 15:27 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2008-12-15 17:15 . 2009-01-12 15:25 1,770,528 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-12-15 17:15 . 2009-01-12 15:25 237,600 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2008-12-15 17:15 . 2009-01-12 15:25 15,960 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-12-15 17:15 . 2009-01-12 15:25 1,892 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2008-12-14 20:44 . 2008-12-14 20:44 95 --a------ c:\windows\wininit.ini
2008-12-14 16:25 . 2008-12-17 20:30 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-12-14 16:14 . 2008-12-14 16:14 <DIR> d-------- C:\fsaua.data
2008-12-14 11:48 . 2008-12-14 11:48 <DIR> d-------- c:\windows\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-10 19:41 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-12-12 09:55 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Messenger Plus!
2008-12-10 13:06 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2008-12-10 09:17 --------- d-----w c:\programmi\File comuni\Adobe
2008-12-07 10:53 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-07 10:52 --------- d-----w c:\programmi\Java
2008-12-04 19:16 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\Winamp
2008-12-04 19:13 --------- d-----w c:\programmi\Winamp
2008-12-04 18:33 --------- d-----w c:\programmi\Messenger Plus! Live
2008-12-03 19:21 --------- dcsh--w c:\programmi\File comuni\WindowsLiveInstaller
2008-12-03 19:21 --------- d-----w c:\programmi\Windows Live
2008-12-03 19:05 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\WLInstaller
2008-12-03 14:55 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\DivX
2008-11-28 18:16 --------- d-----w c:\programmi\Microsoft Works
2008-11-28 17:50 --------- d-----w c:\programmi\File comuni\Ahead
2008-11-28 17:47 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Nero
2008-11-28 17:34 --------- d-----w c:\programmi\CCleaner
2008-11-28 17:32 --------- d-----w c:\programmi\Hercules
2008-11-28 17:31 --------- d-----w c:\programmi\File comuni\ArcSoft
2008-11-28 17:30 --------- d-----w c:\programmi\File comuni\InstallShield
2008-11-28 17:23 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\HP
2008-11-28 17:21 --------- d-----w c:\programmi\HP
2008-11-28 17:20 --------- d-----w c:\programmi\Hewlett-Packard
2008-11-28 17:08 --------- d-----w c:\programmi\DivX
2008-11-28 17:08 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\ArcSoft
2008-11-28 16:30 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\Ahead
2008-11-28 16:26 --------- d-----w c:\programmi\Nero
2008-11-28 15:07 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\HP
2008-11-27 20:13 --------- d-----w c:\programmi\REALTEK USB Wireless LAN Driver and Utility
2008-11-27 20:12 21,035 ----a-w c:\windows\system32\drivers\AegisP.sys
2008-11-27 20:12 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\InstallShield
2008-11-27 18:57 90,112 ----a-w c:\windows\DUMP4b32.tmp
2008-11-25 22:30 --------- d-----w c:\programmi\D-Link
2008-11-25 22:23 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\nView_Profiles
2008-11-25 21:46 --------- d-----w c:\programmi\microsoft frontpage
2008-11-25 21:45 --------- d-----w c:\programmi\Servizi in linea
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:00 668,672 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"MsnMsgr"="c:\programmi\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"WinampAgent"="c:\programmi\Winamp\winampa.exe" [2008-08-04 36352]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-07 136600]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVP"="c:\programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
REALTEK USB Wireless LAN Utility.lnk - c:\programmi\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2008-11-27 790528]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\wvUnOIAs

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592]
R3 ovt530;Hercules Webcam Classic;c:\windows\system32\drivers\ov530vid.sys [2008-11-28 161792]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2008-11-27 207616]
R4 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2008-11-27 38144]
.
- - - - ORFÃOS REMOVIDOS - - - -

BHO-{048D34BE-4DF6-44C5-A1AE-69802E286E4B} - (no file)
BHO-{0BC9B203-8529-4FDF-9CD9-3F44EEFD60A3} - (no file)
BHO-{4AF7A442-3B04-4787-9829-D9CC12DF1728} - (no file)
BHO-{4D67F03A-0D94-477F-88D1-F5AB50FEF678} - (no file)
BHO-{578A9BED-7E6D-4CD3-8BCE-CAC7DB2D1F70} - (no file)
BHO-{58E82FC4-4F75-4858-82FC-DD92C85EFA41} - (no file)
BHO-{7D505D45-AED6-48AF-A9E6-2BA4AF950ED1} - (no file)
BHO-{8BF35D72-2BC1-40E0-9255-7343CA128817} - c:\windows\system32\wvUnOIAs.dll
BHO-{8CFCF5B9-8668-47E1-92AE-5E2F4A5D6F08} - (no file)
BHO-{916f0c57-e552-48a1-bd30-140012725d80} - c:\windows\system32\ajkieg.dll
BHO-{BEE3D8BA-175B-4D16-BE71-BFEB0DD0517F} - (no file)
BHO-{C128CC43-A505-4EBD-93D5-41BF6305F219} - (no file)
BHO-{C6EF1A9C-452F-4646-BEDD-86B2C4ED105B} - (no file)
BHO-{DD6E5672-13FB-449D-A32A-EF91EEEEAE81} - (no file)
BHO-{E7676034-3CF9-4677-B7DF-EFAC4B813EE3} - (no file)
BHO-{F21190C2-D428-4AFF-AA5B-07DF210ABB71} - (no file)
Notify-awtrOhEx - (no file)


.
------- Supplementare di scansione -------
.
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A617DCC1-28B1-447D-A78E-E3BE7E21057B} = 193.12.150.2
FF - ProfilePath - c:\documents and settings\Zagaria\Dati applicazioni\Mozilla\Firefox\Profiles\svq1f9om.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-12 15:27:07
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(1084)
c:\windows\system32\klogon.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-12 15:31:15 - macchina è stato riavviato [Zagaria]
ComboFix-quarantined-files.txt 2009-01-12 14:31:02

Pre-Run: 46.778.232.832 byte disponibili
Post-Run: 46,992,347,136 byte disponibili

WindowsXP-KB310994-SP2-Home-BootDisk-ITA.exe

208 --- E O F --- 2008-12-11 20:41:28

questo e il log di combofix

vorrei sottolineare che l' antivirus (kaspersky antivirus) ha riconosciuto uno scaricamento nascosto di file sio prima di riavviare la macchina sia alla chiusura di combofix... e normale?

per quanto riguarda il ripristino del service pack due, non l' ho fatto installare. Ma vedo che nel log lo riporta come una cosa negativa... dovevo?

In ogni caso sembra che avp.exe non dia piu problemi . . . . . per ora

GRAZIE TANTE CRAZY.CAT!

... ehm... non ho capito il fatto di "istanza-processo" ...

[NUschoolMetal]

ragazzi, sto tenendo task menager aperto, e appena ho aperto winamp avp.exe si e gonfiato di nuovo fino a 99.

ho chiuso winamp. l'ho riaperto. stessa storia.

non so come si comporti ne a cosa serva avp.exe, quindi vi chiedo.. e normale?

[ste_95]

Avevi un bel Trojan Vundo. Ora dovresti essere a posto.

[NUschoolMetal]

stessa identi ca storia
ancora!

2 differenze:
-explorer che tenta il phishing viene bloccata da kaspersky, ma ci riesce con un altro sito molto simile.
-oltre ad avp.exe ci si mettono i processi che iniziano per NMB (ho messo i miei processi nel primo intervento)

qundi il pomeriggio decente di ieri e come se non ci sia stato, perche ieri ha lavorato bene, oggi stessa storia.

che devo fare???
... e, per favore... una risposta esauriente sarebbe gradita...

[NUschoolMetal]

ComboFix 09-01-08.05 - Zagaria 2009-01-13 16.48.33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1040.18.2047.1595 [GMT 1:00]
Eseguito da: c:\documents and settings\Zagaria\Desktop\combofix.exe.exe

ATENÇÃO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mdpjpf.dll
c:\windows\system32\sAIOnUvw.ini
c:\windows\system32\sAIOnUvw.ini2
c:\windows\system32\vnxwvity.dll
c:\windows\system32\wvUnOIAs.dll

.
((((((((((((((((((((((((( Files Creati Da 2008-12-13 al 2009-01-13 )))))))))))))))))))))))))))))))))))
.

2009-01-10 20:40 . 2009-01-10 20:40 <DIR> d-------- c:\programmi\Sega
2009-01-09 19:09 . 2009-01-09 19:22 <DIR> d-------- C:\zenvrenghe
2009-01-04 20:12 . 2009-01-04 20:12 268 --ah----- C:\sqmdata04.sqm
2009-01-04 20:12 . 2009-01-04 20:12 172 --ah----- C:\sqmnoopt04.sqm
2009-01-04 19:02 . 2009-01-04 19:02 268 --ah----- C:\sqmdata03.sqm
2009-01-04 19:02 . 2009-01-04 19:02 244 --ah----- C:\sqmnoopt03.sqm
2008-12-28 16:22 . 2008-04-13 11:46 37,888 --a------ c:\windows\system32\drivers\bthmodem.sys
2008-12-28 16:22 . 2008-04-13 11:46 37,888 --a--c--- c:\windows\system32\dllcache\bthmodem.sys
2008-12-21 11:38 . 2008-12-21 11:38 <DIR> d-------- c:\programmi\uTorrent
2008-12-21 11:38 . 2008-12-22 09:53 <DIR> d-------- c:\documents and settings\Zagaria\Dati applicazioni\uTorrent
2008-12-19 20:10 . 2008-12-19 20:10 268 --ah----- C:\sqmdata02.sqm
2008-12-19 20:10 . 2008-12-19 20:10 244 --ah----- C:\sqmnoopt02.sqm
2008-12-19 15:16 . 2008-12-19 15:16 268 --ah----- C:\sqmdata01.sqm
2008-12-19 15:16 . 2008-12-19 15:16 244 --ah----- C:\sqmnoopt01.sqm
2008-12-19 15:12 . 2008-12-19 15:12 268 --ah----- C:\sqmdata00.sqm
2008-12-19 15:12 . 2008-12-19 15:12 244 --ah----- C:\sqmnoopt00.sqm
2008-12-15 18:12 . 2008-12-15 18:12 45,008 --a------ C:\waxx.exe
2008-12-15 17:17 . 2008-12-15 18:08 96,976 --a------ c:\windows\system32\drivers\klin.dat
2008-12-15 17:17 . 2008-12-15 18:08 87,855 --a------ c:\windows\system32\drivers\klick.dat
2008-12-15 17:15 . 2008-12-15 17:15 <DIR> d-------- c:\programmi\Kaspersky Lab
2008-12-15 17:15 . 2009-01-13 17:01 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Kaspersky Lab
2008-12-15 17:15 . 2009-01-13 16:59 1,770,528 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-12-15 17:15 . 2009-01-13 16:59 237,600 --ahs---- c:\windows\system32\drivers\fidbox2.dat
2008-12-15 17:15 . 2009-01-13 16:59 15,960 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-12-15 17:15 . 2009-01-13 16:59 1,892 --ahs---- c:\windows\system32\drivers\fidbox2.idx
2008-12-14 20:44 . 2008-12-14 20:44 95 --a------ c:\windows\wininit.ini
2008-12-14 16:25 . 2008-12-17 20:30 <DIR> d-------- c:\documents and settings\All Users\Dati applicazioni\Spybot - Search & Destroy
2008-12-14 16:14 . 2008-12-14 16:14 <DIR> d-------- C:\fsaua.data
2008-12-14 11:48 . 2008-12-14 11:48 <DIR> d-------- c:\windows\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-10 19:41 --------- d--h--w c:\programmi\InstallShield Installation Information
2008-12-12 09:55 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Messenger Plus!
2008-12-10 13:06 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Microsoft Help
2008-12-10 09:17 --------- d-----w c:\programmi\File comuni\Adobe
2008-12-07 10:53 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-07 10:52 --------- d-----w c:\programmi\Java
2008-12-04 19:16 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\Winamp
2008-12-04 19:13 --------- d-----w c:\programmi\Winamp
2008-12-04 18:33 --------- d-----w c:\programmi\Messenger Plus! Live
2008-12-03 19:21 --------- dcsh--w c:\programmi\File comuni\WindowsLiveInstaller
2008-12-03 19:21 --------- d-----w c:\programmi\Windows Live
2008-12-03 19:05 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\WLInstaller
2008-12-03 14:55 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\DivX
2008-11-28 18:16 --------- d-----w c:\programmi\Microsoft Works
2008-11-28 17:50 --------- d-----w c:\programmi\File comuni\Ahead
2008-11-28 17:47 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\Nero
2008-11-28 17:34 --------- d-----w c:\programmi\CCleaner
2008-11-28 17:32 --------- d-----w c:\programmi\Hercules
2008-11-28 17:31 --------- d-----w c:\programmi\File comuni\ArcSoft
2008-11-28 17:30 --------- d-----w c:\programmi\File comuni\InstallShield
2008-11-28 17:23 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\HP
2008-11-28 17:21 --------- d-----w c:\programmi\HP
2008-11-28 17:20 --------- d-----w c:\programmi\Hewlett-Packard
2008-11-28 17:08 --------- d-----w c:\programmi\DivX
2008-11-28 17:08 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\ArcSoft
2008-11-28 16:30 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\Ahead
2008-11-28 16:26 --------- d-----w c:\programmi\Nero
2008-11-28 15:07 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\HP
2008-11-27 20:13 --------- d-----w c:\programmi\REALTEK USB Wireless LAN Driver and Utility
2008-11-27 20:12 21,035 ----a-w c:\windows\system32\drivers\AegisP.sys
2008-11-27 20:12 --------- d-----w c:\documents and settings\Zagaria\Dati applicazioni\InstallShield
2008-11-27 18:57 90,112 ----a-w c:\windows\DUMP4b32.tmp
2008-11-25 22:30 --------- d-----w c:\programmi\D-Link
2008-11-25 22:23 --------- d-----w c:\documents and settings\All Users\Dati applicazioni\nView_Profiles
2008-11-25 21:46 --------- d-----w c:\programmi\microsoft frontpage
2008-11-25 21:45 --------- d-----w c:\programmi\Servizi in linea
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:00 668,672 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( snapshot@2009-01-12_15.29.10.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-16 01:00:27 3,088,896 -c--a-w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-12 17:01:05 3,088,896 -c--a-w c:\windows\system32\dllcache\mshtml.dll
- 2008-10-16 01:00:27 3,088,896 ----a-w c:\windows\system32\mshtml.dll
+ 2008-12-12 17:01:05 3,088,896 ----a-w c:\windows\system32\mshtml.dll
+ 2009-01-13 16:00:58 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_108.dat
.
((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
"MsnMsgr"="c:\programmi\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MSMSGS"="c:\programmi\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"HP Software Update"="c:\programmi\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"NeroFilterCheck"="c:\programmi\File comuni\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"WinampAgent"="c:\programmi\Winamp\winampa.exe" [2008-08-04 36352]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2008-12-07 136600]
"Adobe Reader Speed Launcher"="c:\programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"AVP"="c:\programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-04-25 201992]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 c:\windows\system32\bthprops.cpl]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
REALTEK USB Wireless LAN Utility.lnk - c:\programmi\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2008-11-27 790528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=mdpjpf.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\wvUnOIAs

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-03-25 24592]
R3 ovt530;Hercules Webcam Classic;c:\windows\system32\drivers\ov530vid.sys [2008-11-28 161792]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [2008-11-27 207616]
R4 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2008-11-27 38144]
.
- - - - ORFÃOS REMOVIDOS - - - -

BHO-{5BEC9CA6-EB82-4C39-BD73-9132C0F41463} - c:\windows\system32\wvUnOIAs.dll
BHO-{a7641bb6-b0db-4cc2-9148-0390de2dabb2} - c:\windows\system32\mdpjpf.dll


.
------- Supplementare di scansione -------
.
IE: E&sporta in Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A617DCC1-28B1-447D-A78E-E3BE7E21057B} = 193.12.150.2
FF - ProfilePath - c:\documents and settings\Zagaria\Dati applicazioni\Mozilla\Firefox\Profiles\svq1f9om.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-13 17:01:24
Windows 5.1.2600 Service Pack 3 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(1084)
c:\windows\system32\klogon.dll
.
------------------------ Altri processi in esecuzione ------------------------
.
c:\programmi\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\programmi\File comuni\Ahead\Lib\NMIndexStoreSvr.exe
.
**************************************************************************
.
Ora fine scansione: 2009-01-13 17:05:32 - macchina è stato riavviato
ComboFix-quarantined-files.txt 2009-01-13 16:05:26
ComboFix2.txt 2009-01-12 14:31:17

Pre-Run: 46.925.324.288 byte disponibili
Post-Run: 46,933,602,304 byte disponibili

191 --- E O F --- 2009-01-12 20:24:36

ecco
ho rifatto con combofix... anche se ora va un po meglio ho capito che e inutile.
mi date un altra soluzione? sto impazzendo!

please

[ste_95]

Segui questa guida:
http://www.MegaLab.it/2785/vundo-liberi ... per-sempre