Da qualche giorno all'avvio del pc mi compare la scritta " trend chip away virus ha rivelato un virus sull'hard disk e una seria di indicazione su come rimuoverlo ... e sotto una faccina gialla che si muove velocemente da dx a sx.
Mi sono documentato un po' e ho seguito alcune guide online per risolvere il problema.
Ora posto i log dei programmi che ho trovato nelle suddette guide e prego qualche esperto di dirmi come fare a eliminare queste chiavi di registro infette, perché con i software gratuiti non vengono rimosse.
LOG di Stealth MBR rootkit detector:
- Codice: Seleziona tutto
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x098A412B
malicious code @ sector 0x098A412E !
PE file found in sector at 0x098A4144 !
LOG di Gmer:
LOG di Prevx:
- Codice: Seleziona tutto
[B] c:\windows\system32\drivers\utm0njk3.sys [PX5: 16590770003B863E1CA000B5C14F3D00CCFB2D16] Malware Group: Medium Risk Malware
[B] c:\documents and settings\helpassistant\desktop\simple port forwarding\unimsglib.ocx [PX5: FEF8496E00DFE51EB07C01D4395B5A00B8473FDD] Malware Group: Medium Risk Malware
[BP] c:\programmi\starcraft\scloader2a.exe [PX5: 3F17D833C2F7273434D201E01A7CD100587A3EC2] Malware Group: Medium Risk Malware
[B] c:\documents and settings\casa\impostazioni locali\dati applicazioni\xyqsbmn.exe [PX5: DB6561CC00CF3CB000C507FE545F60009F57D6C1] Malware Group: High Risk Fraudulent Security Program
LOG di Kaspersky:
- Codice: Seleziona tutto
21/01/2010 8.37.46 Task started
21/01/2010 9.04.37 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class
21/01/2010 9.04.37 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class
21/01/2010 9.04.37 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class
21/01/2010 9.04.37 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class Postponed
21/01/2010 9.04.37 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class Postponed
21/01/2010 9.04.37 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class Postponed
21/01/2010 9.04.37 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class
21/01/2010 9.04.37 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class Postponed
21/01/2010 9.04.37 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class
21/01/2010 9.04.37 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class Postponed
21/01/2010 9.04.37 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class
21/01/2010 9.04.38 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class Postponed
21/01/2010 9.14.46 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class
21/01/2010 9.14.46 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class Postponed
21/01/2010 9.14.46 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class
21/01/2010 9.14.46 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class Postponed
21/01/2010 9.14.46 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class
21/01/2010 9.14.46 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class
21/01/2010 9.14.46 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class Postponed
21/01/2010 9.14.46 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class
21/01/2010 9.14.46 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class Postponed
21/01/2010 9.14.46 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class Postponed
21/01/2010 9.14.46 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class
21/01/2010 9.14.46 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class Postponed
21/01/2010 10.00.30 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class
21/01/2010 10.00.30 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class
21/01/2010 10.00.30 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class
21/01/2010 10.00.30 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class Postponed
21/01/2010 10.00.30 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class Postponed
21/01/2010 10.00.30 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class Postponed
21/01/2010 10.00.30 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class
21/01/2010 10.00.30 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class Postponed
21/01/2010 10.00.30 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class
21/01/2010 10.00.30 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class
21/01/2010 10.00.30 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class Postponed
21/01/2010 10.00.30 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class Postponed
21/01/2010 10.07.36 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class
21/01/2010 10.07.36 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class Postponed
21/01/2010 10.07.36 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class
21/01/2010 10.07.36 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class
21/01/2010 10.07.36 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class Postponed
21/01/2010 10.07.36 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class
21/01/2010 10.07.36 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class Postponed
21/01/2010 10.07.36 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class Postponed
21/01/2010 10.07.36 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class
21/01/2010 10.07.36 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class Postponed
21/01/2010 10.07.36 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class
21/01/2010 10.07.36 Untreated: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class Postponed
21/01/2010 10.27.20 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class
21/01/2010 18.32.47 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class
21/01/2010 18.32.52 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class
21/01/2010 18.33.06 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class
21/01/2010 18.33.06 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class
21/01/2010 18.33.07 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\HelpAssistant\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class
21/01/2010 18.33.07 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/AppletPanel.class
21/01/2010 18.33.07 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache17395.tmp/Main.class
21/01/2010 18.33.07 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/AppletPanel.class
21/01/2010 18.33.07 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache46750.tmp/Main.class
21/01/2010 18.33.07 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/AppletPanel.class
21/01/2010 18.33.08 Detected: Trojan-Downloader.Java.Agent.ah C:\Documents and Settings\casa\Impostazioni locali\Temp\jar_cache63541.tmp/Main.class
21/01/2010 18.33.08 Task completed
LOG di CureIt:
Trend Micro HijackThis v2.0.3 (BETA):
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10.06.32, on 22/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\sstray.exe
C:\Programmi\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\documents and settings\casa\impostazioni locali\dati applicazioni\xyqsbmn.exe
C:\DOCUME~1\casa\IMPOST~1\Temp\Ox1.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmi\Prevx\prevx.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\Spyware Doctor\pctsAuxs.exe
C:\Programmi\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
C:\Programmi\Prevx\prevx.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\hjackthis\TrendMicro\HiJackThis\HiJackThis.exe
C:\Programmi\Mozilla Firefox\firefox.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programmi\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Programmi\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [xyqsbmn] "c:\documents and settings\casa\impostazioni locali\dati applicazioni\xyqsbmn.exe" xyqsbmn
O4 - HKCU\..\Run: [BMIMZMHMFM] C:\DOCUME~1\casa\IMPOST~1\Temp\Ox1.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm147YYIT
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted IP range: http://192.168.1.1
O15 - ESC Trusted IP range: http://192.168.1.1
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... .0.1.3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se8942.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stag ... taller.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B3ECDB48-BA5C-4F99-9D6A-613A55EADEE7}: NameServer = 85.37.17.44 85.38.28.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBA9782C-61E3-4A22-8EA4-7B1BAAC04D55}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: CSIScanner - Prevx - C:\Programmi\Prevx\prevx.exe
O23 - Service: Servizio di Google Update (gupdate1ca50fb206af7d8) (gupdate1ca50fb206af7d8) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
--
End of file - 9294 bytes
Scan saved at 10.06.32, on 22/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\sstray.exe
C:\Programmi\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe
C:\documents and settings\casa\impostazioni locali\dati applicazioni\xyqsbmn.exe
C:\DOCUME~1\casa\IMPOST~1\Temp\Ox1.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programmi\Prevx\prevx.exe
C:\Programmi\File comuni\LightScribe\LSSrvc.exe
C:\Programmi\Google\Update\GoogleUpdate.exe
C:\Programmi\Spyware Doctor\pctsAuxs.exe
C:\Programmi\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
C:\Programmi\Prevx\prevx.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\hjackthis\TrendMicro\HiJackThis\HiJackThis.exe
C:\Programmi\Mozilla Firefox\firefox.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programmi\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmi\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programmi\File comuni\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Programmi\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmi\File comuni\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [xyqsbmn] "c:\documents and settings\casa\impostazioni locali\dati applicazioni\xyqsbmn.exe" xyqsbmn
O4 - HKCU\..\Run: [BMIMZMHMFM] C:\DOCUME~1\casa\IMPOST~1\Temp\Ox1.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredi ... xdm147YYIT
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programmi\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programmi\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted IP range: http://192.168.1.1
O15 - ESC Trusted IP range: http://192.168.1.1
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/200 ... oader5.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... .0.1.3.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resour ... se8942.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stag ... taller.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B3ECDB48-BA5C-4F99-9D6A-613A55EADEE7}: NameServer = 85.37.17.44 85.38.28.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBA9782C-61E3-4A22-8EA4-7B1BAAC04D55}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FILECO~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Precaricatore Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Daemon di cache delle categorie di componenti - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: CSIScanner - Prevx - C:\Programmi\Prevx\prevx.exe
O23 - Service: Servizio di Google Update (gupdate1ca50fb206af7d8) (gupdate1ca50fb206af7d8) - Google Inc. - C:\Programmi\Google\Update\GoogleUpdate.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programmi\File comuni\LightScribe\LSSrvc.exe
O23 - Service: My Web Search Service (MyWebSearchService) - Unknown owner - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Programmi\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programmi\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programmi\Spyware Doctor\pctsSvc.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Programmi\TomTom HOME 2\TomTomHOMEService.exe
--
End of file - 9294 bytes
Ditemi come liberarmi di questi maledetti virus!
Grazie.