ho preso sicuramente qualcosa - help me!!

[wilcoy]

saluti! ho preso sicuramente qualche schifezza, va tutto lentamente ed i file audio si blocchicchiano come del resto giochi tipo il flipper vanno a scatti. ho scansionato con avast (non in mod. provvisoria) ma non trova nulla, winaso registry optimizer nemmeno. datemi qualche dritta...grazie

[crazy.cat]

Se ci fai vedere un qualche log, meglio se quello ci combofix, proviamo a darti una mano.
Altrimenti non sappiamo proprio cosa gira nel tuo pc...

[wilcoy]

ok! intanto grazie domani scarico combofix e posto il tutto.

[tiger]

Ti propongo 2 operazioni da farsi al volo (in circa 1 ora):

1) Per facilitare la ricerca di un possibile malware ti consiglio Sysinspector. Sysinspector (prodotto da Eset) è un programma free che analizza il computer e mostra le informazioni su possibili pericoli e malware. link: http://download.eset.com/download/sysin ... pector.exe.

2) Interpreta i risultati dell'analisi di Sysinspector e se come penso ci sono dei virus/rootkit allora in modalita provvisoria esegui kaspersky virus removal tool (free) al seguente link: http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
ed effettua una scansione/clean totale del tuo pc.

[wilcoy]

allora...secondo me al momento dovrei assere "pulito", ma la mia asserzione è più dovuta ad empirismoo che ad altro...ho visto che la scansione di kaspersky in mod. provv. non ha rilevato niente sul registro e che adesso non noto nulla di strano come in precedenza, adesso fila via liscio liscio. l'unica cosa è che con Winaso registry non abbia tolto tutto prima e riavviando sia scomparso tutto, in ogni caso, per cortesia datemi un'occhiata al file log di combofix che allego....grazie a tutti

ComboFix 10-01-02.05 - ermanno 03/01/2010 15.36.22.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.39.1040.18.1023.439 [GMT 1:00]
Eseguito da: c:\documents and settings\ermanno\Documenti\Download\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 100102-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Creati Da 2009-12-03 al 2010-01-03 )))))))))))))))))))))))))))))))))))
.

2010-01-03 14:13 . 2010-01-03 14:13 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\hsswpr
2010-01-03 14:13 . 2010-01-03 14:13 -------- d-----w- c:\windows\LastGood
2010-01-02 16:39 . 2010-01-02 16:39 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\Malwarebytes
2010-01-02 16:39 . 2010-01-02 16:39 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Malwarebytes
2010-01-02 16:25 . 2009-11-15 21:48 17408 ----a-w- c:\windows\system32\drivers\DiagnosticScan.SYS
2010-01-02 16:25 . 2009-10-19 09:21 5120 ----a-w- c:\windows\system32\drivers\Start1Driver.SYS
2010-01-02 16:25 . 2010-01-02 16:27 -------- d-----w- c:\programmi\AA
2010-01-01 15:40 . 2010-01-03 14:15 -------- d-----w- c:\programmi\Future Pinball
2010-01-01 15:38 . 2010-01-01 15:38 -------- d-----w- c:\documents and settings\ermanno\fontconfig
2010-01-01 15:37 . 2010-01-03 12:14 -------- d-----w- c:\documents and settings\ermanno\.smplayer
2009-12-29 19:47 . 2009-12-29 19:48 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\U3
2009-12-29 16:31 . 1997-10-10 20:28 515072 ----a-w- c:\windows\system32\Worldscr.dll
2009-12-27 05:20 . 2009-12-27 05:20 0 ----a-w- c:\windows\system32\cd.dat
2009-12-26 08:54 . 2010-01-01 19:27 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\vlc
2009-12-26 08:53 . 2009-12-26 08:53 -------- d-----w- c:\programmi\VideoLAN
2009-12-21 19:12 . 2009-12-21 19:12 -------- d-----w- c:\programmi\Ontrack
2009-12-21 19:10 . 2009-12-21 19:13 -------- d-----w- c:\programmi\Easyrecovery
2009-12-20 15:11 . 2002-07-17 15:22 4672 ----a-w- c:\windows\system\WOWPOST.EXE
2009-12-20 15:11 . 2002-07-17 15:22 5600 ----a-w- c:\windows\system\WINASPI.DLL
2009-12-20 15:11 . 2002-07-17 08:20 45056 ----a-w- c:\windows\system32\WNASPI32.DLL
2009-12-20 15:11 . 2002-07-17 07:53 16877 ----a-w- c:\windows\system32\drivers\ASPI32.SYS
2009-12-20 15:10 . 2009-12-20 15:10 -------- d-----w- C:\Temp
2009-12-20 15:10 . 2009-12-20 15:10 -------- d-----w- c:\temp\Aspi 470
2009-12-20 15:10 . 2002-06-13 15:39 153088 ----a-w- c:\temp\UNWISE.EXE
2009-12-20 15:10 . 1999-11-24 00:00 288433 ----a-w- c:\temp\aspi32.exe
2009-12-19 18:48 . 2009-12-19 18:48 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Azureus
2009-12-19 18:48 . 2010-01-01 16:39 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\Azureus
2009-12-19 18:19 . 2009-12-19 18:20 134272800 ----a-w- c:\documents and settings\ermanno\Dati applicazioni\uTorrent\OOo_3.0.1_Win32Intel_install_en-US.exe
2009-12-14 22:15 . 2009-12-14 22:15 -------- d-----w- c:\programmi\WFR
2009-12-14 22:14 . 2009-12-14 22:14 -------- d-----w- c:\programmi\Microsoft Tablet PC Platform SDK
2009-12-13 19:08 . 2009-12-13 19:08 -------- d-----w- c:\programmi\Vision Objects
2009-12-08 12:35 . 2009-12-08 12:35 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Macrovision
2009-12-07 19:29 . 2009-12-07 19:31 -------- d-----w- c:\programmi\iconsext

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-03 14:16 . 2009-06-19 19:47 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\ZipGenius
2010-01-03 11:06 . 2009-07-01 15:50 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\uTorrent
2010-01-02 17:03 . 2009-06-20 10:00 1 ----a-w- c:\documents and settings\ermanno\Dati applicazioni\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-29 03:16 . 2009-06-19 19:40 330520 ----a-w- c:\documents and settings\ermanno\Impostazioni locali\Dati applicazioni\GDIPFONTCACHEV1.DAT
2009-12-21 19:12 . 2009-06-19 19:31 -------- d--h--w- c:\programmi\InstallShield Installation Information
2009-12-08 12:34 . 2009-06-19 20:50 -------- d-----w- c:\programmi\File comuni\Adobe
2009-12-07 22:51 . 2009-10-18 14:36 -------- d-----w- c:\programmi\GetRight
2009-12-07 14:06 . 2009-11-23 18:39 79488 ----a-w- c:\documents and settings\ermanno\Dati applicazioni\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-29 19:39 . 2009-11-29 19:15 -------- d-----w- c:\programmi\tvuplayer
2009-11-29 19:17 . 2009-11-29 19:17 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\TVU Networks
2009-11-19 16:52 . 2009-06-22 20:12 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\Skype
2009-11-19 16:40 . 2009-06-22 20:14 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\skypePM
2009-11-18 19:41 . 2009-11-18 19:41 -------- d-----w- c:\documents and settings\ermanno\Dati applicazioni\FastStone
2009-11-18 19:41 . 2009-11-18 19:41 -------- d-----w- c:\programmi\FastStone Capture
2009-11-13 20:48 . 2009-11-13 20:48 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-11 20:27 . 2009-11-11 20:21 -------- d-----w- c:\programmi\SpeedBit Video Downloader
2009-11-11 19:32 . 2009-11-11 19:32 -------- d-----w- c:\programmi\Microsoft
2009-11-09 19:50 . 2009-06-22 20:11 -------- d-----r- c:\programmi\Skype
2009-11-09 19:48 . 2009-11-09 19:48 -------- d-----w- c:\programmi\File comuni\Skype
2009-11-09 19:48 . 2009-06-22 20:11 -------- d-----w- c:\documents and settings\All Users\Dati applicazioni\Skype
2009-10-25 06:27 . 2001-08-31 10:00 69568 ----a-w- c:\windows\system32\perfc010.dat
2009-10-25 06:27 . 2001-08-31 10:00 437272 ----a-w- c:\windows\system32\perfh010.dat
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* i valori vuoti & legittimi/default non sono visualizzati.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programmi\File comuni\Ahead\lib\NMBgMonitor.exe" [2005-10-28 94208]
"msnmsgr"="c:\programmi\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"HIDAgent"="c:\programmi\WFR\HIDAgent.exe" [2008-12-29 97912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\programmi\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"RTHDCPL"="RTHDCPL.EXE" [2008-03-06 16858112]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2006-07-07 262144]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-18 843776]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SunJavaUpdateSched"="c:\programmi\Java\jre6\bin\jusched.exe" [2009-06-20 148888]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"WinampAgent"="c:\programmi\Winamp\winampa.exe" [2009-07-01 37888]
"QuickTime Task"="c:\programmi\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\programmi\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"EverioService"="c:\programmi\CyberLink\PCM4Everio\EverioService.exe" [2008-04-03 151552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-19 15360]

c:\documents and settings\ermanno\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
OpenOffice.org 3.1.lnk - c:\programmi\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]

c:\documents and settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\
Adobe Gamma Loader.lnk - c:\programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-10-09 12:11 25623336 ----a-r- c:\programmi\Skype\Phone\Skype.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmi\\Messenger\\msmsgs.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programmi\\uTorrent\\uTorrent.exe"=
"c:\\Programmi\\iTunes\\iTunes.exe"=
"c:\\Programmi\\StreamTorrent 1.0\\StreamTorrent.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Programmi\\CyberLink\\PCM4Everio\\PCM4Everio.exe"=
"c:\\Programmi\\CyberLink\\PCM4Everio\\EverioService.exe"=
"c:\\Programmi\\Java\\jre6\\bin\\java.exe"=
"c:\\Programmi\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programmi\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmi\\Skype\\Phone\\Skype.exe"=
"c:\\Programmi\\tvuplayer\\TVUPlayer.exe"=
"c:\\Programmi\\Bonjour\\mDNSResponder.exe"=

R0 DiagnosticScan;DiagnosticScan;c:\windows\system32\drivers\DiagnosticScan.SYS [02/01/2010 17.25.05 17408]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [20/06/2009 8.41.23 114768]
R1 Start1Driver;Start1Driver;c:\windows\system32\drivers\Start1Driver.SYS [02/01/2010 17.25.05 5120]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [20/06/2009 8.41.23 20560]
R2 FastPara;FastPara;c:\windows\system32\drivers\fastpara.sys [20/06/2009 9.07.57 37836]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [19/06/2009 21.54.11 59466]
R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [19/06/2009 21.54.10 538925]
S3 esihdrv;esihdrv;\??\c:\docume~1\ermanno\IMPOST~1\Temp\esihdrv.sys c:\docume~1\ermanno\IMPOST~1\Temp\esihdrv.sys
.
.
------- Scansione supplementare -------
.
IE: Download with GetRight Pro - c:\programmi\GetRight\GRdownload.htm
IE: Open with GetRight Pro Browser - c:\programmi\GetRight\GRbrowse.htm
TCP: {0918B1DD-6D24-4D62-9666-235B03580844} = 91.80.36.136 91.80.37.100
FF - ProfilePath - c:\documents and settings\ermanno\Dati applicazioni\Mozilla\Firefox\Profiles\08rmp1cy.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.corriere.it/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 15:41
Windows 5.1.2600 Service Pack 2 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- CHIAVI DI REGISTRO BLOCCATE ---------------------

[HKEY_USERS\S-1-5-21-1993962763-1644491937-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FFE3DD19-A219-A690-46E3-A3D9ACC98426}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iaanlijlcohhkmaacg"=hex:6b,61,63,6b,63,64,6c,67,66,61,6c,6c,68,67,6b,6e,62,65,
69,6e,6b,6f,00,00
"hagofofjgkhdgcek"=hex:6b,61,63,6b,63,64,6c,67,66,61,6c,6c,68,67,6b,6e,62,65,
69,6e,6b,6f,00,00
.
--------------------- Dlls caricate dai processi in esecuzione ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2924)
c:\windows\system32\msi.dll
.
Ora fine scansione: 2010-01-03 15:44:48
ComboFix-quarantined-files.txt 2010-01-03 14:44
ComboFix2.txt 2009-09-30 18:55

Pre-Run: 90.762.301.440 byte disponibili
Post-Run: 90.944.507.904 byte disponibili

WindowsXP-KB310994-SP2-Pro-BootDisk-ITA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - B2C6D6D57AF6069FC423DD496E13033A

ho modificato adesso il messaggio perché contrariamente a quanto detto, direi che il problema persiste, direi quando lancio il flipper...mah!

[tiger]

1) Scarica lo strepitoso process hacker (free) al seguente link:
http://sourceforge.net/projects/process ... p/download
Scompattalo in una directory di comodo e avvialo.
Quando il computer va lento esamina quale processo satura la RAM e/o la CPU e faccelo sapere, esamina anche
se ci sono dei processi nascosti tramite la voce di menu Tool-->Hidden Process.

2) Se ti avanza tempo e per sicurezza esegui un altra scansione con un altro potente scanner free (piu' orientato agli spyware)
asquared (free) emergency usb scaricalo al seguente link http://download1.emsisoft.com/a2usb.zip
Sempre in modalita provvisoria, Scompatta lo zip in una directory di comodo ed esegui a2free.exe (per fare veloce esegui la smart scan).