PDA

View Full Version : Aiuto, virus mi imposta il dns senza possibilità di cambiarlo

andr3a_rm
19-11-2008, 17:17
Ciao,
oggi ho preso un virus, che mi ha cambiato l'indirizzo dns della connessione e appena provo a rimettere quello funzionante che avevo prima, me lo ricambia in quello che vuole lui, esattamente: 85.255.112.121.

Ho fatto dei log con hijack e li posto qui sotto:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17.46.18, on 19/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programmi\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Cosimo\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe
C:\Programmi\Raize\CS3\Bin\CSDispatcher.exe
C:\Programmi\Launchy\Launchy.exe
C:\Programmi\3M\PSN2Lite\Psn2Lite.exe
C:\PROGRA~1\3M\PSN2Lite\PSNGive.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
C:\Programmi\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programmi\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Programmi\PrevxCSI\prevxcsi.exe
C:\Programmi\PrevxCSI\prevxcsi.exe
C:\Documents and Settings\Cosimo\Desktop\CF7AA1F.exe
C:\Documents and Settings\Cosimo\Desktop\CF7AA1F.exe
C:\Documents and Settings\Cosimo\Desktop\VundoFix.exe
C:\Programmi\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Cosimo\Desktop\KillBox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxymi:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Guida per l'accesso a Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmi\File comuni\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmi\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Programmi\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [\\ANDREA-EA3C68F2\EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P41 "\\ANDREA-EA3C68F2\EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [avgnt] "C:\Programmi\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programmi\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [\\192.168.1.130\EPSON Stylus D68 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAE.EXE /P39 "\\192.168.1.130\EPSON Stylus D68 Series" /O6 "USB001" /M "Stylus D68"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Quest Installer Notification Service] C:\PROGRA~1\QUESTS~1\QUESTI~1\QINS.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmi\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Proxy Monitor] "C:\Programmi\Internet Explorer Proxy Monitor\ieprxmon.exe" -atstartup
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Programmi\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Cosimo\Impostazioni locali\Dati applicazioni\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Avvio veloce di Adobe Acrobat.lnk = ?
O4 - Global Startup: Launchy.lnk = C:\Programmi\Launchy\Launchy.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Programmi\3M\PSN2Lite\Psn2Lite.exe
O8 - Extra context menu item: Aggiungi a PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti destinazione link in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti destinazione link in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {0006F063-0000-0000-C000-000000000046} (Microsoft Office Outlook View Control) - http://activex.microsoft.com/activex/controls/office/outlctlx.CAB
O16 - DPF: {00D9C306-6B11-492A-9AFC-C53CE30849CF} (Siebel SmartScript) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Smartscript.cab
O16 - DPF: {0D68687A-A2A3-46EB-9ED9-956C83875A6C} (Siebel Marketing HTML Editor) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Marketing_HTML_Editor.cab
O16 - DPF: {169ADD4B-EE8B-4B27-B332-2941A82DA7E2} (Siebel Microsite Layout Designer) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Microsite_Layout.cab
O16 - DPF: {16C7BBB7-738A-47D7-956E-52DD9A166A9A} (Siebel Event Calendar) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Marketing_Calendar.cab
O16 - DPF: {1D922C61-16AB-4179-8302-6B8A688C88D0} (CSSAxContainerCtrl Class) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Container_Control.cab
O16 - DPF: {253A9D23-F982-11D4-8BE4-00D0B7E61414} (SiebelHTMLApplication Class) - http://10.16.160.96/eenergy_enu/16279/applets/siebelhtml.cab
O16 - DPF: {353F130D-72DB-4F14-B750-625F90D75D1B} (Siebel Test Automation) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Test_Automation.cab
O16 - DPF: {3E8C4740-70C5-439E-AE2F-16234083E248} (Siebel High Interactivity Framework) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_HI_Client.cab
O16 - DPF: {48CE1C1F-092D-461C-A385-A0C3D19FE052} (Siebel iHelp) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_iHelp.cab
O16 - DPF: {5FCAD8CF-85C1-4FD9-BD04-995CBEBA5BEB} (Siebel Hospitality Gantt Chart) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Hospitality_Gantt.cab
O16 - DPF: {68CDB19A-6305-4589-8C35-41E3502CD451} (Siebel Option Pack for IE 7.5.3) - http://10.16.160.96/eenergy_enu/16279/applets/SiebelOptionPack.cab
O16 - DPF: {73EF83D1-DA75-4F58-8DB6-1CD6D8F9C8A1} (Siebel Calendar) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Calendar.cab
O16 - DPF: {756E01C3-2CF9-4364-8724-B8C850CB0D50} (UInboxDynBtn Class) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_UInbox.cab
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} (Siebel Desktop Integration) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Desktop_Integration.cab
O16 - DPF: {8F4F3368-54CA-4268-8225-0F4367472CF4} (MailClient Class) - http://10.16.160.96/eenergy_enu/16279/applets/SiebExtMailClient.cab
O16 - DPF: {96A3E5AB-C228-4D1D-B31F-712BA35EE470} (Siebel Gantt Chart) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Gantt_Chart.cab
O16 - DPF: {B2870751-812C-44E2-8005-99E19276C1D5} (Siebel Option Pack for IE 7.5.3) - http://10.16.189.34/eenergy_enu/16279/applets/SiebelOptionPack.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5FEEC93-506D-4B41-A38B-3A59BF5B41AB} (Siebel Callcenter Communications Toolbar) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_CTI_Toolbar.cab
O16 - DPF: {C657D5D2-D725-4F0E-91A9-EA74647DCF84} (Siebel Marketing Allocation) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_Marketing_Allocation.cab
O16 - DPF: {D6CC2526-859B-40C0-8515-1A47946478B6} (Siebel Email Support for Microsoft Outlook and Lotus Notes) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\SiebelAx_OutBound_mail.cab
O16 - DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} (CIC Ink Control) - file://C:\Sea78\Client\PUBLIC\enu\19213\applets\iTools.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{95C7E47D-78CA-4D57-B3D1-CEDC232FF66E}: NameServer = 85.255.112.121;85.255.112.76
O17 - HKLM\System\CCS\Services\Tcpip\..\{D213DF84-B98A-448C-B185-717850C04E63}: NameServer = 85.255.112.121;85.255.112.76
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = infostrada.it,wind,wind.it,wind.root.it
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = infostrada.it,wind,wind.it,wind.root.it
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = infostrada.it,wind,wind.it,wind.root.it
O18 - Protocol: qcom - {B8DBD265-42C3-43E6-B439-E968C71984C6} - C:\PROGRA~1\COMMON~1\QUESTS~1\CODEXP~1\qcom.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programmi\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmi\File comuni\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Programmi\Bonjour\mDNSResponder.exe
O23 - Service: CSIScanner - Prevx - C:\Programmi\PrevxCSI\prevxcsi.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Servizio iPod (iPod Service) - Apple Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: OracleOraHome921ClientCache - Unknown owner - C:\ora92\BIN\ONRSD.EXE
O23 - Service: OracleOraHome92TNSListener - Unknown owner - C:\oracle\ora92\BIN\TNSLSNR.exe
O23 - Service: OracleServiceCOSIMO - Oracle Corporation - c:\oracle\ora92\bin\ORACLE.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SWIHPWMI - Sierra Wireless Inc. - C:\Programmi\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe

--
End of file - 13837 bytes
FulValBot
19-11-2008, 17:53
vai in modalità provvisoria senza rete, stacca il modem/router.

dopodichè da lì cerca di rimuovere i file infetti che l'antivirus dovrebbe aver visto.

tra poco dò un'occhiata al log e vedremo.
wjmat
19-11-2008, 18:06
x andr3a_rm

riedita cortesemente il tuo post caricando il log secondo le modalità (http://www.hwupgrade.it/forum/showthread.php?t=1779308)

poi per ripulire completamente il pc segui la guida alla disinfezione per infetti (http://www.hwupgrade.it/forum/showthread.php?t=1599737) ed esegui, in ordine, tutte le scansioni ed il caricamento dei relativi log, in un unico post, e secondo le modalità (http://www.hwupgrade.it/forum/showthread.php?t=1779308).

Leggi bene tutto questo post, e salvo problemi gravi, arriverai in fondo alla guida in perfetta autonomia



Con la pulizia files inutili, e le scansioni vere e proprie di antispyware (1 e 2) ed antivirus (3 e 4) avrai un pc già ripulito al 90%, le prima 4 scansioni dureranno minimo un'oretta ciascuna, le altre scansioni sono veloci e servono a noi per avere le informazioni necessarie per i restanti interventi.

Ricapitolando, dopo aver disabilitato il ripristino di sistema (http://www.hwupgrade.it/forum/showpost.php?p=24113221&postcount=23), fatto la pulizia dei file inutili con ATFCleaner (http://www.hwupgrade.it/forum/showpost.php?p=24033021&postcount=2), vogliamo necessariamente in ordine e anche se non è stato rilevato nulla:

log di Malwarebytes Anti-Malware (http://www.hwupgrade.it/forum/showpost.php?p=24033097&postcount=9) aggiornato ad oggi
log di A-squared (http://www.hwupgrade.it/forum/showpost.php?p=24033085&postcount=8) scansione deep aggiornato ad oggi
log di Kaspersky Virus Removal Tool (http://www.hwupgrade.it/forum/showpost.php?p=24033078&postcount=7) scaricato oggi oppure di F-Secure OnLine (http://www.hwupgrade.it/forum/showpost.php?p=24033058&postcount=6)
log di Dr.Web CureIT (http://www.hwupgrade.it/forum/showpost.php?p=24033048&postcount=5) scaricato oggi
log di ESET SysInspector (http://www.hwupgrade.it/forum/showpost.php?p=24033155&postcount=12)
log di HiJackThis (http://www.hwupgrade.it/forum/showpost.php?p=24033212&postcount=13)
log di Gmer (http://www.hwupgrade.it/forum/showpost.php?p=24033143&postcount=11)
log di PrevxCSI (http://www.hwupgrade.it/forum/showpost.php?p=24033225&postcount=14)


Se il pc dovessse essere molto compromesso (es. riavvii frequenti, schermate blu) oppure hai problemi con internet per aggiornare i programmi leggi qui (http://www.hwupgrade.it/forum/showpost.php?p=24315070&postcount=27)

Se pensi che l'infezione possa essere partita da chiavette usb, o di avere hard disk esterni infetti, collegali prima del punto1 in modo che vengano ripuliti durante la disinfezione, in questo modo eviti di reinfettarti ancora dopo che hai ripulito il pc.

Tranne che per eseguire gli aggiornamenti e fare le scansioni che richiedano la connessione ad internet è sempre consigliato rimanere sconnessi e non usare il pc per altre operazioni.
Le scansioni falle in ordine e non contemporaneamente, rischi che i programmi non svolgano a dovere il loro compito, e comunque affaticando maggiormente il sistema non guadagneresti comunque tempo...



Questa (http://www.hwupgrade.it/forum/showthread.php?t=1779308) è una brevissima guida alla pubblicazione dei log, qui (http://www.hwupgrade.it/forum/showpost.php?p=23619723&postcount=5) e qui (http://www.hwupgrade.it/forum/showpost.php?p=24073905&postcount=3) esempi precisi ed ordinati di come vorremmo tu li caricassi.

link utili per il caricamento log ed immagini
caricamento log fileqube.com, (http://fileqube.com/) wikisend.com (http://wikisend.com/), mediafire.com (http://www.mediafire.com/index.php)
caricamento immagini fileqube.com, imageshack (http://fileqube.com/)