[HELP] Mal/Packer & Win32.Malware.gen!90

[GhiaccioNero]

Ciao a tutti, come da titolo, come faccio a rimuoverli? :confused: In rete non trovo nessun tool....

grazie 1000


ps. non ho nessun log perchè il mio antivirus non li rileva, ma ho analizzato un file installato di recente con http://www.virustotal.com/it/ e dopo la scansione con 12 antivirus è stata rilevata nell'archivio la presenza di questi 2 simpaticoni.

Ora: Come rimuoverli, se sono presenti nel sistema? grazie


pps. aggiunto log:


Logfile of HijackThis v1.99.1
Scan saved at 20.02.06, on 18/08/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\LClock\LClock.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
C:\Program Files\Eset\Eset Smart Security\egui.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Windows Live Mail desktop\wlmail.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Users\Io\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: &ZuneIt - {A8533C62-9399-4640-B36B-D1DDE91EB8B1} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\Eset\Eset Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [LClock] C:\Program Files\LClock\lclock.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Yahoo! Widget Engine.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: ZuneIt - {00951C02-5731-44e9-B2F5-544EC2279417} - mscoree.dll (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Invia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: I&nvia a OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9DDA4EDE-7374-43FE-9A3D-19D768B61753}: NameServer = 85.37.17.14 85.38.28.78
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live Mail desktop\mailcomm.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Eset Service (ekrn) - Eset - C:\Program Files\Eset\Eset Smart Security\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

[oasis90]

Allora il log è pulito.
Fai così: scarica A-Squared free, aggiornalo, e fai una scansione.

P.S. Ti consiglio di scaricare dall'area download l'ultima versione di Hijackthis, cioè la 2.0.2..;)

P.P.S. Ma che antivirus hai?

[GhiaccioNero]

E riposto il log?

ps. ho windows vista

[oasis90]

E riposto il log?

ps. ho windows vista

ah..beh non cambia niente, A-Squared è compatibile con Vista. Intanto fai la scansione con questo e vedi se ti trova qualcosa.

[GhiaccioNero]

Ecco il log con a-squared:

a-squared Free - Version 3.0
Last update: 19/08/2007 9.39.02

Impostazioni scansione:

Oggetti: Memoria, Tracce, Cookies, C:\
Archivio scansioni: On
Scientifico: On
ADS Scan: On

Scansione avviata: 19/08/2007 9.40.00

Key: HKEY_LOCAL_MACHINE\software\realvnc rilevati: Trace.Registry.VNC
Key: HKEY_LOCAL_MACHINE\software\realvnc\winvnc4 rilevati: Trace.Registry.VNCServer
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@2o7[1].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@atdmt[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@bluestreak[1].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@bs.serving-sys[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@doubleclick[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@ehg-nokiafin.hitbox[1].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@hitbox[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@mediaplex[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@serving-sys[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@tradedoubler[2].txt rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:5 rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:6 rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:7 rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:8 rilevati: Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:25 rilevati: Trace.TrackingCookie
C:\Users\Io\Documents\My Received Files\vnc.zip/vnc-4_1_1-x86_win32.exe rilevati: Riskware.RemoteAdmin.Win32.WinVNC.4110

Scansionati

Files: 149988
Tracce: 252055
Cookies: 232
Processi: 67

Rilevato

Files: 1
Tracce: 2
Cookies: 15
Processi: 0
Chiavi registro: 0

Fine scansione: 19/08/2007 10.38.06
Tempo scansione: 0.58.06

C:\Users\Io\Documents\My Received Files\vnc.zip/vnc-4_1_1-x86_win32.exe Cancellato Riskware.RemoteAdmin.Win32.WinVNC.4110
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@2o7[1].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@atdmt[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@bluestreak[1].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@bs.serving-sys[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@doubleclick[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@ehg-nokiafin.hitbox[1].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@hitbox[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@mediaplex[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@serving-sys[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Microsoft\Windows\Cookies\io@tradedoubler[2].txt Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:5 Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:6 Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:7 Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:8 Cancellato Trace.TrackingCookie
C:\Users\Io\AppData\Roaming\Mozilla\Firefox\Profiles\jsrp6yju.default\cookies.txt:25 Cancellato Trace.TrackingCookie
Key: HKEY_LOCAL_MACHINE\software\realvnc\winvnc4 Cancellato Trace.Registry.VNCServer
Key: HKEY_LOCAL_MACHINE\software\realvnc Cancellato Trace.Registry.VNC

Cancellato

Files: 1
Tracce: 2
Cookies: 15

Devo buttarmi dal 4 piano? non credo dai :D

[juninho85]

se VNC l'avevi installato te puoi veramente buttarti dal 4° piano :D

[GhiaccioNero]

non so manco cos'è vnc :D

ah ora ho visto, si l'avevo installato perchè mi serviva, ma non l'ho mai avviato... Ho percepito un tremito nella forza :D Subito dopo l'ho piallato.