virus win32 tenga

[tottina]

Anch'io sono stata infettata da questo virus.
Ho scaricato il programma Hijack This e questo è il file log che mi viene fuori.

Logfile of HijackThis v1.99.1
Scan saved at 17.36.39, on 13/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\mqsvc.exe
C:\Programmi\Logitech\iTouch\iTouch.exe
C:\Programmi\WIZZ\dazzler.exe
C:\Programmi\Common files\clockwise.exe
C:\Programmi\WIRESS\rssfeed.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programmi\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Programmi\Conexant\AccessRunner ADSL\CnxDslTb.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\System\CSRSS.EXE
C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\sysintc\lio\conf_F\bin\swmenu.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\Lanata\IMPOST~1\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.virgilio.it/free
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmi\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [WIZZ] C:\Programmi\WIZZ\dazzler.exe
O4 - HKLM\..\Run: [wise] C:\Programmi\Common files\clockwise.exe -boot
O4 - HKLM\..\Run: [WIRESS] C:\Programmi\WIRESS\rssfeed.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [SHA256] C:\Programmi\SHA256\secure.exe
O4 - HKLM\..\Run: [REAL] C:\Programmi\REAL\realjbox.exe
O4 - HKLM\..\Run: [PowerChute] C:\Programmi\APC_Power\Pwrchute.exe -boot_time
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [miniport] C:\WINDOWS\system32\usbmon.exe /start
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LocalProxy] C:\Programmi\LocalProxy\proxy4free.exe
O4 - HKLM\..\Run: [Jet Detection] C:\Programmi\Creative\SBLive\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programmi\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Dit] C:\WINDOWS\system32\dit.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Programmi\Conexant\AccessRunner ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [AdsBlocker] C:\Programmi\AdsBlocker\stopAds.exe
O4 - HKLM\..\Run: [3capplnk] C:\Programmi\US Robotics\\3capplnk.exe
O4 - HKLM\..\Run: [.svchost] C:\WINDOWS\System\CSRSS.EXE
O4 - HKLM\..\Run: [DSB] C:\Programmi\DSB\dsb.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [EnergyPlugIn] C:\Programmi\EnergyPlugIn\EnergyPlugin.exe
O4 - HKCU\..\Run: [NBJ] "C:\Programmi\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: conf_f.lnk = C:\sysintc\lio\conf_F\bin\swmenu.exe
O4 - Global Startup: Digisoft AntiDialer.lnk = C:\Programmi\Digisoft AntiDialer\AntiDialer.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra button: Umail - {11E2169B-1BBD-4F35-9576-BF1C39DD55A9} - http://www.umail.it (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.virgilio.it/free
O16 - DPF: {11BD6F81-233F-4B62-BAFB-27ECABD3CBCF} (NTR Activex 1.0.6) - http://80.206.174.91/inquiero/mod/ntractivex106.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093629326609
O17 - HKLM\System\CCS\Services\Tcpip\..\{9E0C9647-0D6C-4BEB-9915-5252F79421B9}: NameServer = 213.234.128.211 213.234.132.130
O17 - HKLM\System\CCS\Services\Tcpip\..\{B04FEAA6-CE9D-4F69-B13F-9A33BD744569}: NameServer = 192.168.0.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\System32\CTsvcCDA.EXE (file missing)
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Smart Card Base Component Helper (SetScardSvrService) - Unknown owner - C:\WINDOWS\system32\SetScardSvrService.exe (file missing)

qualcuno me lo puo' controllare per piacere??sto impazzendo dietro questo virus non ne posso +!!!
E poi come devo fare per eliminarlo definitivamente??
Grazie mille..
Tottina

[Stereogab]

intanto fixa questi:
O9 - Extra button: Umail - {11E2169B-1BBD-4F35-9576-BF1C39DD55A9} - http://www.umail.it (file missing) (HKCU)

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\System32\CTsvcCDA.EXE (file missing)

O23 - Service: Smart Card Base Component Helper (SetScardSvrService) - Unknown owner - C:\WINDOWS\system32\SetScardSvrService.exe (file missing)

questo è puttosto sospetto:
O4 - HKLM\..\Run: [.svchost] C:\WINDOWS\System\CSRSS.EXE

[matteo1]

nessuno al momento è riuscito a debellare questo virus;io ti consiglio di:
-disattivare il ripristino configurazione di sistema
-usare http://www.majorgeeks.com/download4191.html per eliminare tutti i temporanei
-scarica questo:
McAfee solo scannr antivirus (http://dl.codecpack.nl/m/mcafee_20050913.exe)
e fai doppio click,naturalmente devi avere pazienza.

[wgator]

Ciao,

in effetti quel virus è un osso duro :cry:

Ti segnalo:

C:\Programmi\WIZZ\dazzler.exe
C:\sysintc\lio\conf_F\bin\swmenu.exe
O4 - HKLM\..\Run: [WIZZ] C:\Programmi\WIZZ\dazzler.exe

questo tenta di farsi passare per un feedsreader, ma temo non la racconti giusta:
C:\Programmi\WIRESS\rssfeed.exe

CSRSS.EXE è un file di sistema ma va controllato perchè è "fuori cartella" quindi potrebbe essere il virus Netsky:
C:\WINDOWS\System\CSRSS.EXE

Ci sono anche altre cose, quindi vai anche con qualche scansione con i prodotti che ti hanno consigliato